tourcoder/sing-box-fml repository overview

⁠sing-box-fml

A minimal sing-box container with an interactive setup wizard. Pick one protocol, answer a few questions, done.

Multi-arch: linux/amd64, linux/arm64, linux/arm/v7.

⁠Protocols

One container runs exactly one protocol. To run two protocols, run two containers.

vless-reality holds no certificate: it proxies the TLS handshake to a real site, so a prober sees that site instead. Pick a target that speaks TLS 1.3 with HTTP/2 and has no connection to you. Its public key is printed once and stored nowhere — save it, the client needs it.

⁠Deploy

mkdir -p /opt/sing-box-fml && cd /opt/sing-box-fml

Create docker-compose.yaml:

services:
  sing-box-fml:
    image: tourcoder/sing-box-fml:latest
    container_name: sing-box-fml
    restart: unless-stopped
    # Host mode: best performance, and ACME needs a real :80
    network_mode: host
    volumes:
      # ACME account + certificate data (unused by vless-reality/shadowsocks)
      - ./ssl:/ssl
      # Generated config
      - ./config:/etc/sing-box
      # Fallback static page (trojan only)
      - ./www:/var/www/html
      # Logs
      - ./logs:/var/log/sing-box

Then start it and run the wizard:

docker compose up -d
docker exec -it sing-box-fml fml

The wizard asks which protocol to run, then only the questions that protocol actually needs. Anything left blank that can be generated — passwords, UUIDs, WebSocket paths, shadowsocks keys, REALITY key pairs — is generated for you and printed once.

It writes the config, validates it, then restarts the container. For the certificate-backed protocols the first start takes a few seconds while ACME issues the certificate.

docker logs -f sing-box-fml

⁠Requirements

For trojan, vless, vmess and hysteria2:

• DNS A/AAAA record already pointing at the server
• Port 80/tcp open in the cloud firewall
• Port 443 open, tcp for trojan/vless/vmess, udp for hysteria2

Port 80 is used for the ACME HTTP-01 challenge. It is needed again at every renewal, not only at install time, so leave it open.

For vless-reality: port 443/tcp only. No DNS record and no port 80 — it never talks to Let's Encrypt.

For shadowsocks: just the port you picked, tcp and udp. No DNS record and no port 80.

⁠Tags

• latest — built against the newest stable sing-box release
• <version> — pinned to that sing-box version, e.g. 1.13.18

⁠Upgrading

docker compose pull && docker compose up -d

Config and certificates live in bind mounts, so they survive image upgrades.

⁠Reconfiguring

Re-run the wizard at any time:

docker exec -it sing-box-fml fml

It overwrites the config and restarts the container, and can also be used to switch to a different protocol. Existing ACME data is reused if the domain is unchanged. A config that fails validation never replaces a working one.

vless-reality mints a fresh key pair on every run, so re-running the wizard cuts off existing clients until they are given the new public key.