AnyTLS

Docker image for anytls-go, a TLS proxy server.

Included version

• anytls-go: 0.0.13
• Go toolchain: 1.26
• Base image: alpine:3.23

Supported platforms

• linux/amd64
• linux/arm64

Tags

• latest: latest build from the default branch
• 0.0.13: current AnyTLS version build
• 0.0: major/minor tag for versioned releases

Quick start

Run with a generated password:

docker run -d \
  --name anytls \
  -p 8443:8443 \
  domizhang/anytls:latest

Read the generated password from logs:

docker logs anytls

Run with a fixed password:

docker run -d \
  --name anytls \
  -p 8443:8443 \
  -e PSK="your-secure-password" \
  domizhang/anytls:latest

Customize listener and extra arguments:

docker run -d \
  --name anytls \
  -p 9443:9443 \
  -e LISTEN_ADDR="0.0.0.0:9443" \
  -e PSK="your-secure-password" \
  domizhang/anytls:latest \
  --help

Docker Compose

services:
  anytls:
    image: domizhang/anytls:latest
    container_name: anytls
    restart: unless-stopped
    ports:
      - "8443:8443"
    environment:
      LISTEN_ADDR: 0.0.0.0:8443
      PSK: your-secure-password

Environment variables

Variable	Default	Description
LISTEN_ADDR	0.0.0.0:8443	Server listen address and port
PSK	generated	Pre-shared key. If empty, a random key is generated and printed once at startup
ARGS	empty	Deprecated compatibility option. Prefer passing extra arguments after the image name

Security notes

• Use a strong explicit PSK in production.
• The generated PSK is printed to container logs so the client can be configured. Treat logs as sensitive.
• Provided PSK values are not printed.
• Do not expose the service publicly without firewall rules or an explicit access policy.

Build locally

docker build \
  --build-arg VERSION=0.0.13 \
  -t domizhang/anytls:local .

Update policy

The anytls-go version is pinned in VERSION and Dockerfile. To update:

1. Check the upstream anytls-go releases.
2. Update the VERSION file and ARG VERSION defaults.
3. Build and test the image.
4. Tag the repository as vX.Y.Z to publish versioned tags.

License

This repository builds anytls-go from upstream source for the target platform. anytls-go is distributed under its upstream license.

CA security maintenance

Runtime package layers are rebuilt against current repository metadata, even when the application version is unchanged. CI rejects the two CA roots revoked in October 2026 by DER SHA256 and fails on an empty or unreadable trust bundle.