naumso/docker-xray-vless repository overview

⁠Xray gateway for MikroTik RouterOS

Alpine-based container that turns an Xray client into a transparent gateway. Point RouterOS at the container's veth interface and selected traffic goes out through VLESS or Trojan.

Inside the container xray exposes a local SOCKS5 proxy, tun2socks bridges a tun0 device to it, and the entrypoint rewrites the routing table so that everything except the Xray server itself, RFC1918 networks and the DNS resolver goes through the tunnel.

Source and setup guide: github.com/naumso/xray-mikrotik⁠ — the README there is a step-by-step RouterOS walkthrough (in Russian).

⁠Quick start

The only required variable is URL — a connection string or a subscription link:

docker run -d --cap-add=NET_ADMIN --device /dev/net/tun \
  -e URL='vless://<uuid>@example.com:443?type=tcp&security=reality&pbk=...&fp=chrome&sni=...&sid=...&flow=xtls-rprx-vision' \
  naumso/docker-xray-vless:latest

Subscription links are fetched and base64-decoded. If a server fails to come up, the container automatically moves on to the next one in the list.

In RouterOS the image is attached with remote-image=naumso/docker-xray-vless:latest and the URL variable is passed through an envlist.

⁠Supported combinations

⁠Environment variables

⁠Requirements

Needs NET_ADMIN and access to /dev/net/tun to create the tunnel interface — either --cap-add=NET_ADMIN --device /dev/net/tun or --privileged. A HEALTHCHECK is built in: it verifies both processes, the tun device, the SOCKS port and end-to-end connectivity through the proxy.

⁠Tags

• latest — current build
• <xray-version> (e.g. 26.7.28) — pinned to a specific Xray release

Built for linux/amd64, linux/arm64 and linux/arm/v7.

⁠License

Container scripts are MIT⁠. Bundled binaries are taken unmodified from official releases: