Hi Acris,

I've been using your plan, ss docker server + asus router with merlin, for a long time, most of the time works like a charm until recently, it's down.

Login server, check logs with "docker logs shadowsocks-libev -f --tail 5", errors show as below:
2021/02/21 11:18:31 tcp:223.73.209.84:25203 accepted tcp:127.0.0.1:0
2021/02/21 11:18:31 tcp:112.97.55.215:21208 accepted tcp:127.0.0.1:0
2021-02-21 11:18:31 ERROR: unable to resolve 1dot0dot0dot1.clouldflare-dns.com
2021/02/21 11:18:32 tcp:112.97.55.215:21208 accepted tcp:127.0.0.1:0
2021-02-21 11:18:32 ERROR: unable to resolve 1dot0dot0dot1.clouldflare-dns.com
2021/02/21 11:18:33 tcp:223.73.209.84:25289 accepted tcp:127.0.0.1:0
...

I'm not sure is it because the Cloudflare DNS is down or block, I'd updated the server docker image by "docker pull acrisliu/shadowsocks-libev", the connection improves a little but still randomly unreachable.

Please check if it's necessary to change the docker image's DNS resolver or whatever you think is suitable. Thanks.

打扰了！镜像拉下来不是最新的，麻烦您给检查一下，谢谢！
docker pull acrisliu/shadowsocks-libev:latest
docker images
acrisliu/shadowsocks-libev latest ee9790bbaa05 3 weeks ago 26.5MB
试了多次都是3周前的。

如何填写DNS_ADDRS走本机默认DNS，而不是填写某一个IP。
如果不写他就会默认走8.8.8.8或1.1.1.1了，是否可以写127.0.0.1，他默认就走系统的DNS？

I see following codes, but what do "yourdomain.com" and "YourPassword" mean? is this my ss server ip address and password? or the v2ray server address and password?

docker run -d
-e "ARGS=--plugin v2ray-plugin --plugin-opts server;tls;host=yourdomain.com -u"
-e PASSWORD=YourPassword
-v /home/username/.acme.sh:/root/.acme.sh
--name=shadowsocks-libev
-p 8388:8388/tcp
-p 8388:8388/udp
--restart=always
acrisliu/shadowsocks-libev

And how to use docker-compose? sorry for the questions you might think it's stupid...I don't know all of this until today...

Since the container ports are exposed to internet 24*7, it could be possible that the container get compromised. Then the hacker could run tcpdump or arp-scan to get more info on the network.

Is it possible to add that in the docker file, like following?

# Add a new user "john" with user id 8877
RUN useradd -u 8877 john
# Change to non-root privilege
USER john

按照readme中步骤，进行操作的，证书也成功生成，但是依然握手失败，无tls启动的话是没问题的。

path=/v2ray

这参数放在哪儿啥意思啊？你Dockerfile里可不是这么写的啊？

Seems both Android and PC can no longer connect after the upgrade.

PC side worked fine after upgraded v2ray plugin to v4.8.3.

But it seems there is no v2ray plug-in update on Android. Any app to recommend? Thanks!
(I'm using https://play.google.com/store/apps/details?id=com.github.shadowsocks.plugin.v2ray)

目前使用自签名证书需要手动把证书添加到系统信任列表。
有没有办法不用手动添加就能使用

1、-v /home/username/.acme.sh:/root/.acme.sh后面应该也要有 \吧。
2、可否增加自定义fast_open参数，默认这个参数是打开的，我这边会报错ERROR: failed to set TCP_FASTOPEN_CONNECT，而且貌似tcp fastopen在docker里面启用好像没什么作用吧。
综上，我觉得可能用配置文件的形式更灵活一点，启动参数也可以不用这么多。

It looks there are some vulnerability fix for ShadowSocks, please see if it's applicable? Thanks!
https://github.com/edwardz246003/shadowsocks

Hi Acris, 两个问题请教下,谢谢

1._如何避免server端ss端口被block? 已经出现过两次,6/7和今天6/28, 症状均是突然断联, 检查docker top shadowsocks-libev运行正常, 再docker logs shadowsocks-libev -f --tail 100, 发现无持续握手输出, 重启docker, logs 仅仅显示到V2Ray 4.38.3 started就再无输出. 于是更改端口/dns,重启docker和对应修改端口的客户端后一切正常. 由此可否判断是端口被封,(检测/干扰?). 如是今后如何避免呢?

-e SERVER_PORT=newport \
-e DNS_ADDRS=aa.aa.aa.aa, bb.bb.bb.bb \
-p newport:newport/tcp \
-p newport:newport/udp \

2._ docker-compose修改端口/dns后, dns启用修改的,但端口还是8388.如何让新端口生效, 贴出file,请帮忙看看

version: "3.7"
services:
  shadowsocks-libev:
    container_name: shadowsocks-libev
    image: acrisliu/shadowsocks-libev:latest
    user: root
    ports:
      - "newport:newport/tcp"
      - " newport:newport/udp"
    volumes:
      - /home/myusername/.acme.sh:/home/myusername/.acme.sh:ro
    environment:
      - METHOD=aes-256-gcm
      - DNS_ADDRS=aa.aa.aa.aa, bb.bb.bb.bb
      - PASSWORD=mypassword
      - ARGS=--plugin v2ray-plugin --plugin-opts server;tls;host=mydomain;path=/mypath;cert=/home/myusername/.acme.sh/mydomin/fullchain.cer;key=/home/myusername/.acme.sh/mydomain/mydomain.key -u
    restart: always

我想问下端口号有限制嘛, 我的一直没配置成功, 容器起来了,但是在自己电脑上shadowsocksX-NG 配上没有用

Since ECC certificates are more secure, is it possible to support Acme.sh created ECC certificates? These certificates can be created like below, and located in domain.com_ecc folder, everything else are the same as regular RSA certificates.
acme.sh --issue --keylength ec-384 -d domain.com --standalone

Thanks!

container报错如下：

 2020-03-01 07:53:13 ERROR: plugin service exit unexpectedly
 2020-03-01 07:53:13 INFO: error on terminating the plugin.
 2020-03-01 07:53:17 INFO: enable TCP no-delay
 2020-03-01 07:53:17 INFO: plugin "v2ray-plugin" enabled
 2020-03-01 07:53:17 INFO: UDP relay enabled
 2020-03-01 07:53:17 INFO: enable TCP no-delay
 2020-03-01 07:53:17 INFO: initializing ciphers... aes-256-cfb
 2020-03-01 07:53:17 INFO: using nameserver: 1.1.1.1,1.0.0.1
 2020-03-01 07:53:17 INFO: tcp server listening at 127.0.0.1:53987
 2020-03-01 07:53:17 INFO: tcp port reuse enabled
 2020-03-01 07:53:17 INFO: udp server listening at 0.0.0.0:8388
 2020-03-01 07:53:17 INFO: udp port reuse enabled
2020/03/01 07:53:17 V2Ray 4.22.1 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.13.7 linux/amd64)
2020/03/01 07:53:17 A unified platform for anti-censorship.
2020/03/01 07:53:17 main: failed to parse config > main: failed to read cert > open /root/.acme.sh/v2ray.***.com/fullchain.cer: permission denied

启动shell:

docker run -d \
-e "ARGS=--plugin v2ray-plugin --plugin-opts server;tls;host=v2ray.***.com;path=/v2ray;cert=/root/.acme.sh/v2ray.***.com/fullchain.cer;key=/root/.acme.sh/v2ray.***.com/v2ray.***.com.key -u" \
-e METHOD=aes-256-cfb \
-e PASSWORD=***** \
-v /root/.acme.sh:/root/.acme.sh \
--name=shadowsocks-libev \
--privileged=true \
-p 8388:8388/tcp \
-p 8388:8388/udp \
--restart=always \
acrisliu/shadowsocks-libev

后来加了 --privileged=true 还是不行啊，一直没权限。
Selinux也关了，.acme.sh目录权限改为了777，还是不行，求解？

Hi there,
I get this error in my docker container log. I have no idea what should i do and how should i get certs in order to map it to my container

2024/01/12 09:38:26 main: failed to parse config > main: failed to read cert > open /root/.acme.sh/sheeen.de/fullchain.cer: no such file or directory

in your readme is mentioned Remember mount your certs to container, recommend use [acme.sh](https://github.com/Acris/docker-shadowsocks-libev/blob/master/acme.sh) to issue certs. could you please help me further? but there is no script there...

best regards, Shahram

ss-libev已经更新3.3.2。希望尽快跟进新版本更新

SS-libev已经在10.31发布新版本。麻烦大佬跟进一下

https://xx.xx.com:port
显示404

will kcptun support?

我看-e ARGS后面cert和key路径直接选的脚本自动生成证书文件的存放路径，这样子脚本每60天更新过后这个docker会自动使用吗，这样子没什么问题吧？还有就是希望可以添加一下在shadowsocks-win端插件的书写方法，另外mux=0，这样子可以给一个参数设置吗，我这有个软件Quantumult X支持mux=0的ss+v2ray-plugin，无法直接用这个搭建好的。

I was using Max Lv's SSR client and v2ray plug in before, but it seems no longer working. Any recommendations for Android? Thanks!

The shadowsocksR install script outputs a QR code PNG file and an equivalent text URL like ssr://MTUuMjIyLjI... which can be imported into Android phones, for example. Is there any way to get something similar from your container?

Hi Acris,
Got error massage "WARNING: The requested image's platform (linux/amd64) does not match the detected host platform (linux/arm64/v8) and no specific platform was requested" when running on my newly created Ampere instance with ubuntu 20.04, is this mean that the docker file doesn't support arm64, could you make it support both amd64 and arm64 or more architectures? Thanks!
P.S. Running on Other amd64 instance with the same ubuntu 20.04 is normal.

P.P.S.:cupinfo
lscpu
Architecture: aarch64
CPU op-mode(s): 32-bit, 64-bit
Byte Order: Little Endian

用test-ipv6.com测试显示没有ipv6地址
已经确认我的主机拥有ipv6地址

Hi, Acris

因为家中有nas设备, 联通/移动无公网ip,自带ddns很慢,于是设置的zerotier,ipv4默认下能达到在外手机iphone/android 5G流量访问nas各种apps, chrome 访问nas/webui登录,ssh 移动客户端登录路由后台,速度可看nas中2k视频...但是最近发现,有部分设备联不通了, zerotier peers查看,planet/earth有出现relay断连的情况,因此尝试开启ipv6.
不知这个项目如何完全支持ipv6? 参考How to Set Up Shadowsocks-libev Proxy Server on CentOS/Rocky Linux 配置后, ipv6-test.com 测试全绿通过,zerotier设备恢复正常连接“direct”, 但外网变得不稳定,断线,慢. iPhone油管常常断连出现未知错误,似乎ipv6流量不过proxy或不稳定,贴出自己的设置,请有空指导下,谢谢.

设置步骤:

A.联通光猫桥接->ipv6 native/ppp拨号->lan设置statless/stateful其他默认; DG服务器按照官方文档开启ipv6支持,获得ipv6地址/网关/范围; 运行 docker compose
{
cat docker-compose.yml
services:
....
environment:
- SERVER=::0 #似乎本生已开启
- SERVER=0.0.0.0
- FAST_OPEN=true #有时logs显示无法tcp fast open连接
- DNS_IPV6=true #无用? 在args中设置 “-6”
- METHOD=aes-256-gcm
- DNS_ADDRS=dns1,dns2,dns3
- PASSWORD=mypass
- ARGS=--plugin v2ray-plugin --plugin-opts server;tls;host=mydomain.com;path=/path;cert=/root/.acme.sh/mydomain.com/fullchain.cer;key=/root/.acme.sh/mydomain.com/mydomain.com.key -u -6 --fast-open
restart: always

}

B.路由器端:
1.unbound开启两项有关ipv6设置, interface: ::0; do-ipv6: yes
2.ss config.json中,我想关键在"server" 和 “local_address”选择,尝试过各种组合,ipv4,ipv4+ipv6,ipv6+local_address ::/0; ipv4+0.0.0.0 + ipv6+::/0; 似乎单ipv4或ipv6搭配0.0.0.0要好些
3.ss-merlin.conf中, lanip 选::/0, 运行后ipset 报错, 改回0.0.0.0

C.测试结果:
1.stateless ipv6测试全绿,chrome能优先开启ipv6, 但外网不稳定
2.stateful ipv6测试有橙色项,chrome默认ipv4, 外网稍稳定些
3.部分Docker logs
2022-11-07 12:55:38 INFO: enable TCP no-delay
2022-11-07 12:55:38 INFO: using tcp fast open
2022-11-07 12:55:38 INFO: plugin "v2ray-plugin" enabled
2022-11-07 12:55:38 INFO: UDP relay enabled
2022-11-07 12:55:38 INFO: enable TCP no-delay
2022-11-07 12:55:38 INFO: initializing ciphers... aes-256-gcm
2022-11-07 12:55:38 INFO: using nameserver: 8.8.8.8,1.1.1.1
2022-11-07 12:55:38 INFO: tcp server listening at 127.0.0.1:52935
2022-11-07 12:55:38 INFO: tcp port reuse enabled
2022-11-07 12:55:38 INFO: udp server listening at 0.0.0.0:8388
2022-11-07 12:55:38 INFO: udp port reuse enabled
2022-11-07 12:55:38 INFO: udp server listening at [::0]:8388
2022-11-07 12:55:38 ERROR: [udp] getaddrinfo: Name does not resolve
2022-11-07 12:55:38 INFO: running from root user
2022/11/07 12:55:38 V2Ray 4.44.0 (V2Fly, a community-driven edition of V2Ray.) Custom (go1.17.9 linux/amd64)

其中“ERROR: [udp] getaddrinfo: Name does not resolve”这条报错说明什么? ipv6只有udp server, 无tcp server有关系吗?

D:问题
1.docker inspect 查看似乎server中有 -s ::0 和"HostIp": "::", 但ipv6/ipv6gateway无地址, 本身支持ipv6流量走ss吗?
...
"IPPrefixLen": 20,
"IPv6Gateway": "",
"GlobalIPv6Address": "",
"GlobalIPv6PrefixLen": 0,
"MacAddress": "02:42:c0:a8:70:02",
"DriverOpts": null
...
2.tcp open fast开启后,有时无法建立连接 (已开启net.ipv4.tcp_fastopen=3)

3.因为不懂, 一切都是查看可疑跟试错,请教如何规范配置支持ipv6.

When run the container on Debian 9 (Stretch), everything works fine. But if run the same container on Debian 10 (Buster), Android client cannot connect, there is no error in the container.

I also upgraded a working Debian 9 machine to 10, then the container will stop working.

Any suggestions or tips would be appreciated.

I have the config file as:

version: "3.7"
services:
  shadowsocks-libev:
    container_name: shadowsocks-libev
    image: acrisliu/shadowsocks-libev:latest
    user: root
    #...
    volumes:
      - /etc/letsencrypt/live/mysite:/root/certs:ro # !!
    #...
      - ARGS=--plugin v2ray-plugin --plugin-opts server;tls;host=mysite;path=/v2ray;cert=/root/certs/fullchain.pem;key=/root/certs/privkey.pem -u

The container has nothing in /root/certs. Run docker directly from command line also mounts an empty directory:

docker run \
-e "ARGS=--plugin v2ray-plugin --plugin-opts server;tls;host=mysite;path=/v2ray;cert=/root/certs/fullchain.pem;key=/root/certs/privkey.pem -u" \
-e PASSWORD=verysecurepassword \
-v /etc/letsencrypt/live/mysite:/root/certs \ # ??
--user root \
--name=shadowsocks-libev \
-p 8388:8388/tcp \
-p 8388:8388/udp \
acrisliu/shadowsocks-libev

But after the container's built, I can create a debug image locally and mount the volume with:

docker ps -a # read the container hash
docker commit container_hash debug/ss
docker run -it --rm --entrypoint sh -v /etc/letsencrypt/live/mysite:/mysite debug/ss

And see the cert in /mysite. How do I make it work for docker-compose.yml? I don't see any difference.

Thanks for the docker.
Can you help me set up your docker to work with the v2ray-plugin (with TLS mode and enable UDP relay)
It's not entirely clear to me how acme.sh works.

There is no way to make WhatsApp voice calls on version 5.1.7, but when using version "Shadowsocks client without AD" created by TrueNight, based on version 4.8.4 from Google Play, there are no such problems.

Im created example: v2ray-plugin with TLS mode and enable UDP relay.

I would be glad of any information to solve this ...

I want to make shadowsocks work behind an Nginx server. So I write an Nginx config file like this

Then I run shadowsocks by this

and I set my windows client like this

But It just not working. Here's nginx access log

2023/04/15 23:32:46 [Warning] [261939576] app/dispatcher: default route for tcp:127.0.0.1:0
2023/04/15 23:32:46 tcp:58.244.49.248:46460 accepted tcp:127.0.0.1:0
2023/04/15 23:32:46 [Warning] [491166614] app/dispatcher: default route for tcp:127.0.0.1:0
2023/04/15 23:32:46 tcp:58.244.49.248:46694 accepted tcp:127.0.0.1:0
2023/04/15 23:32:46 [Warning] [3778855947] app/dispatcher: default route for tcp:127.0.0.1:0
2023/04/15 23:32:46 tcp:58.244.49.248:46448 accepted tcp:127.0.0.1:0
2023/04/15 23:32:46 [Warning] [4041013619] app/dispatcher: default route for tcp:127.0.0.1:0
2023/04/15 23:32:46 tcp:58.244.49.248:46504 accepted tcp:127.0.0.1:0
2023-04-15 23:32:46 ERROR: connect: Address not available
2023-04-15 23:32:46 ERROR: connect error
2023/04/15 23:32:46 [Warning] [261939576] app/dispatcher: default route for tcp:127.0.0.1:0
2023/04/15 23:32:46 tcp:58.244.49.248:46460 accepted tcp:127.0.0.1:0
2023-04-15 23:32:46 ERROR: connect: Address not available
2023-04-15 23:32:46 ERROR: connect error
2023/04/15 23:32:46 [Warning] [3910588600] app/dispatcher: default route for tcp:127.0.0.1:0
2023/04/15 23:32:46 tcp:58.244.49.248:46442 accepted tcp:127.0.0.1:0
2023-04-15 23:32:46 ERROR: connect: Address not available
2023-04-15 23:32:46 ERROR: connect error
2023/04/15 23:32:46 tcp:58.244.49.248:46694 accepted tcp:127.0.0.1:0
2023/04/15 23:32:46 [Warning] [491166614] app/dispatcher: default route for tcp:127.0.0.1:0
2023-04-15 23:32:46 ERROR: connect: Address not available
2023-04-15 23:32:46 ERROR: connect error
2023/04/15 23:32:46 [Warning] [3068627767] app/dispatcher: default route for tcp:127.0.0.1:0
2023/04/15 23:32:46 tcp:58.244.49.248:46452 accepted tcp:127.0.0.1:0
2023-04-15 23:32:46 ERROR: connect: Address not available
2023-04-15 23:32:46 ERROR: connect error
2023-04-15 23:32:47 ERROR: connect: Address not available
2023-04-15 23:32:47 ERROR: connect error
2023/04/15 23:32:47 tcp:58.244.49.248:46448 accepted tcp:127.0.0.1:0
2023/04/15 23:32:47 [Warning] [3778855947] app/dispatcher: default route for tcp:127.0.0.1:0
2023-04-15 23:32:47 ERROR: connect: Address not available
2023-04-15 23:32:47 ERROR: connect error
2023/04/15 23:32:47 [Warning] [54860304] app/dispatcher: default route for tcp:127.0.0.1:0
2023/04/15 23:32:47 tcp:58.244.49.248:45220 accepted tcp:127.0.0.1:0
2023/04/15 23:32:47 [Warning] [4041013619] app/dispatcher: default route for tcp:127.0.0.1:0
2023/04/15 23:32:47 tcp:58.244.49.248:46504 accepted tcp:127.0.0.1:0
2023-04-15 23:32:47 ERROR: connect: Address not available
2023-04-15 23:32:47 ERROR: connect error

挂上小飞机之后手机无法使用YouTube app和google plya，执行docker logs shadowsocks-libev报了一堆ERROR: connect: Address not available，想问一下怎么看到细节的Log?

After starting your docker with quic i get the error...

connection doesn't allow setting of receive buffer size. Not a *net.UDPConn?. See https://github.com/lucas-clemente/quic-go/wiki/UDP-Receive-Buffer-Size for details.

How can I fix this?
Thanks...