i81b4u/byo-curl repository overview

⁠Custom-built curl

i81b4u/byo-curl is a custom curl image built primarily for experimenting with modern TLS features, HTTP/2, HTTP/3 and post-quantum cryptography.

It includes a recent curl build with OpenSSL 4.0.2 and support for features such as:

• TLS 1.3
• HTTP/2
• HTTP/3
• QUIC
• post-quantum and hybrid KEM testing
• ECH
• HTTPS RR
• DNS-over-HTTPS
• Brotli
• Zstandard
• asynchronous DNS
• Kerberos / GSS-API
• LDAP / LDAPS
• SSH / SCP / SFTP
• IDN
• WebSockets

The image is intended both as a convenient TLS/PQC test client and as an alternative curl environment when these features are not available in the curl build provided by the host operating system.

⁠Build information for latest

curl 8.22.0-i81b4u (x86_64-pc-linux-musl)
libcurl/8.22.0-i81b4u
OpenSSL/4.0.2
zlib/1.3.2
brotli/1.2.0
zstd/1.5.7
c-ares/1.34.8
libidn2/2.3.8
libpsl/0.23.3
libssh/0.12.2/openssl/zlib
nghttp2/1.70.0
ngtcp2/1.25.0
nghttp3/1.18.0
mit-krb5/1.22.2
OpenLDAP/2.7.1

Release-Date: 2026-09-09

Supported protocols:

dict file ftp ftps gopher gophers http https imap imaps
ipfs ipns ldap ldaps mqtt mqtts pop3 pop3s rtsp scp sftp
smtp smtps telnet tftp ws wss

Enabled features:

alt-svc AsynchDNS brotli ECH GSS-API HSTS HTTP2 HTTP3
HTTPS-proxy HTTPSRR IDN IPv6 Kerberos Largefile libz PSL
SPNEGO SSL threadsafe TLS-SRP UnixSockets zstd

⁠PQC testing

The OpenSSL 4.0.2 build makes the image particularly useful for experimenting with post-quantum and hybrid TLS key exchange.

For example:

docker run --rm i81b4u/byo-curl:latest \
  --silent --head --tlsv1.3 \
  --curves MLKEM1024 \
  https://www.google.com

Or using the hybrid X25519MLKEM768 group together with HTTP/3:

docker run --rm i81b4u/byo-curl:latest \
  --silent --head --tlsv1.3 \
  --curves X25519MLKEM768 \
  --http3 \
  https://www.cloudflare.com

⁠HTTP/2

docker run --rm i81b4u/byo-curl:latest \
  --silent --head --http2 \
  https://www.cloudflare.com

⁠HTTP/3

docker run --rm i81b4u/byo-curl:latest \
  --silent --head --http3 \
  https://www.cloudflare.com

HTTP/3 can of course be combined with PQC/hybrid groups as shown above.

⁠ECH

Example using ECH together with DNS-over-HTTPS:

docker run --rm i81b4u/byo-curl:latest \
  --verbose \
  --no-progress-meter \
  --tlsv1.3 \
  --ech hard \
  --doh-url https://cloudflare-dns.com/dns-query \
  https://crypto.cloudflare.com/cdn-cgi/trace

⁠Display curl version

Running the image without additional arguments displays the curl version and enabled capabilities:

docker run --rm i81b4u/byo-curl:latest

⁠Smoke tests

The runtime image contains a smoke-test script:

docker run --rm \
  --entrypoint /opt/byo-curl/bin/test-curl.sh \
  i81b4u/byo-curl:latest

⁠Interactive shell

To inspect the runtime environment:

docker run --rm -it \
  --entrypoint /bin/sh \
  i81b4u/byo-curl:latest

The custom curl installation can be found under:

/opt/byo-curl

⁠Version history

⁠8.22.0-2026091801

• Updated from alpine 3.24.1 to 3.24.2

⁠8.22.0-2026090901

• Updated OpenLDAP from 2.7.0 to 2.7.1

⁠8.22.0-2026090501

• Updated build script regarding patching OpenLDAP for OpenSSL 4 ASN1_STRING accessors

⁠8.22.0-2026090301

• Updated curl from 8.21.0 to 8.22.0

⁠8.21.0-2026082501

• Updated OpenSSL from 4.0.1 to 4.0.2

⁠8.21.0-2026081901

• Updated libpsl from 0.23.2 to 0.23.3

⁠8.21.0-2026081101

• Updated libpsl from 0.23.1 to 0.23.2

⁠8.21.0-2026080801

• Updated OpenLDAP from 2.6.14 to 2.7.0

⁠8.21.0-2026080601

• Updated OpenLDAP from 2.6.13 to 2.6.14

⁠8.21.0-2026080302

• Explicitly removed the package cache to reduce image size

⁠8.21.0-2026080301

• Updated libpsl from 0.23.0 to 0.23.1

⁠8.21.0-2026072901

• Updated libssh from 0.12.1 to 0.12.2
• Updated nghttp2 from 1.69.0 to 1.70.0
• Updated ngtcp2 from 1.24.0 to 1.25.0
• Updated nghttp3 from 1.17.0 to 1.18.0

⁠8.21.0-2026072301

• Switched the base image from Ubuntu 26.04 to Alpine 3.24.1
• Optimized the build process

⁠Related project

i81b4u/byo-nginx⁠ provides the server-side counterpart: a custom nginx image with OpenSSL 4.0.2, HTTP/3, Brotli, certificate compression and PQC-related TLS capabilities.

Together, byo-curl and byo-nginx provide a convenient client/server environment for experimenting with modern and post-quantum TLS features.

They can also be used independently as alternatives to their original counterparts where the additional functionality is useful.

Have fun!