[{"_1":2,"_178":-5,"_179":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_153":154},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_91":-5,"_92":93,"_146":-5,"_147":11,"_148":17,"_149":11,"_150":-5,"_151":152},"canonicalUrl","https://hub.docker.com/r/ulfrasark/turnable-hy2/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","ulfrasark","reponame","turnable-hy2","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_46":47,"_49":50,"_51":52,"_53":11,"_54":55,"_56":57,"_58":59,"_39":31,"_28":29,"_61":62,"_63":-5,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":65,"_72":73,"_74":11,"_75":29,"_76":77,"_82":11,"_83":84,"_88":29,"_89":90},"categories",[38,43],{"_39":40,"_41":42},"name","Networking","slug","networking",{"_39":44,"_41":45},"Security","security","content_types",[48],"image","date_registered","2026-08-30T05:37:16.83496Z","description","All-in-one VK-call tunnel + Hysteria2 for MikroTik ROS v7.24+ containers (x86_64 / arm64 / armv7). ","is_private","last_updated","2026-08-30T05:37:21.763672Z","last_modified","2026-08-30T06:02:39.375383Z","media_types",[60],"application/vnd.oci.image.index.v1+json","pull_count",180,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# ulfrasark/turnable-hy2\n\nAll-in-one VK-call tunnel for MikroTik RouterOS containers (x86_64 / arm64 / armv7).\n\nTunnels traffic through a VK video call's TURN relay — disguised as call media (SRTP) — and terminates it on a Hysteria2 backend bundled in the same container (sing-box). Pairs with the WireTurn Android client. From inside Russia the transport looks like an ordinary VK call; the exit is your VPS.\n\nBuilt from source. Config-file driven: drop a `*.json` in the mount and the container brings up a Turnable server, a sing-box Hysteria2 backend, and auto-emits the client URLs.\n\n---\n\n## Image size\n| Layer | Size |\n|-------|------|\n| Compressed (Docker Hub) | ~35 MB |\n| Unpacked (on device) | ~75 MB |\n\nMulti-stage build — Turnable + sing-box binaries on Alpine, no Go toolchain in the final image. Multi-arch: amd64 / arm64 / armv7.\n\n---\n\n## Why this exists (vs bare upstream Turnable)\n\nVanilla Turnable is only a transport — it relays to a backend you host and route to separately, which on RouterOS means cross-container routing, UDP return-path asymmetry, and a second service to babysit. This image folds the whole chain into one container.\n\n| Area | Bare upstream | This image |\n|------|---------------|------------|\n| Backend | You run + route to s-ui/3x-ui | sing-box Hysteria2 built in, route to 127.0.0.1 |\n| proto | Docs default dtls | Forced to srtp — VK relay only forwards call media; dtls never completes |\n| Keys | Manual, drift on restart | Persistent, client pub_key always matches server priv_key |\n| UUIDs / password / cert | Hand-written | Auto-generated and persisted |\n| TLS pin | none | Emits both pinSHA256 and pinnedPeerCertSha256 (WireTurn's Xray needs hex) |\n| Call presence | Keep a client connected | Periodic anchor joins every 30 min, leaves cleanly |\n| Crash handling | none | Turnable, sing-box, anchor self-restart in-container |\n\n---\n\n## MikroTik settings\n/interface/veth add name=veth-tb address=172.16.182.2/24 gateway=172.16.182.1
\n/ip/address add address=172.16.182.1/24 interface=veth-tb
\n/ip/firewall/nat/add chain=srcnat src-address=172.16.182.0/24 action=masquerade comment=\"turnable out\"
\n/ip/firewall/nat/add chain=dstnat protocol=udp dst-port=56000 action=dst-nat to-addresses=172.16.182.2 to-ports=56000 comment=\"turnable listen\"\n\nOnly 56000/udp is forwarded in. The Hy2 backend listens on 127.0.0.1 inside the container and is never exposed.\n\n---\n\n## Mount for config + persistent keys\n/container/mounts/add name=tb_config src=/usb1/turnable-confs dst=/etc/turnable\n\nHolds your `*.json` config, plus auto-created `.keys/` (ML-KEM keys + Hy2 cert), `clients/` (the generated URLs), and `singbox.log`. Without this mount the keys regenerate on every restart and old client links break.\n\n---\n\n## Install container\n/container/add
\nremote-image=ulfrasark/turnable-hy2:latest
\ninterface=veth-tb
\nmounts=tb_config
\nroot-dir=/usb1/turnable
\ndns=8.8.8.8
\nstart-on-boot=yes
\nrestart-policy=on-failure
\nrestart-interval=60s
\nlogging=yes\n\n> RouterOS caches images by name:tag. When updating, use a NEW tag AND a NEW root-dir, or the old layer is reused.\n\n---\n\n## Start\n/container/start [find interface=veth-tb]\n\n---\n\n## Check logs\n/log print where topics~\"container\"\n\nOn startup the container prints the client links. Hand out two per user, both from the mount's `clients/` dir:
\nturnable://... (transport via VK)
\nhysteria2://... (proxy)\n\n---\n\n## Config files (place in the mount dir)\n\n| File | Purpose |\n|------|---------|\n| server.json | Turnable server config (an example below, renamed) |\n| hysteria2.json | Built-in Hy2 backend fields |\n| config.shared-one-cred.example.json | One credential, everyone shares it |\n| config.5users-own-creds.example.json | 5 users, own creds each, revocable individually |\n| config.vless.example.json | VLESS-over-TCP backend variant |\n\n---\n\n## hysteria2.json fields\n\n```json\n{\n \"listen_port\": 2443,\n \"password\": \"PUT_PASSWORD_OR_LEAVE\",\n \"sni\": \"max.ru\",\n \"obfs_password\": \"\",\n \"up_mbps\": 0,\n \"down_mbps\": 0\n}\n```\n\nlisten_port must equal the Turnable route port. Leave password as PUT_* to auto-generate. up/down_mbps 0 = no brutal (a single VK allocation is already capped to ~2 Mbit flat, so shaping is usually pointless).\n\n---\n\n## Minimal server config (shared model)\n\n```json\n{\n \"servers\": {\n \"vk\": {\n \"type\": \"relay\",\n \"provider\": \"prov\",\n \"platform_id\": \"vk.com\",\n \"call_id\": \"PUT_VK_CALL_ID\",\n \"public_ip\": \"PUT_YOUR_VPS_IP\",\n \"listen_addr\": \"0.0.0.0:56000\",\n \"proto\": \"srtp\",\n \"pub_key\": \"\",\n \"priv_key\": \"\"\n }\n },\n \"providers\": {\n \"prov\": {\n \"type\": \"raw\",\n \"routes\": [\n { \"id\": \"shared\", \"address\": \"127.0.0.1\", \"port\": 2443, \"socket\": \"udp\", \"transport\": \"none\" }\n ],\n \"users\": [\n { \"uuid\": \"PUT_SHARED_UUID_OR_LEAVE\", \"allowed_routes\": [\"shared\"], \"type\": \"relay\", \"peers\": 1 }\n ]\n }\n }\n}\n```\n\nFill call_id (from a VK call link) and public_ip. Leave keys / UUID / password empty — they auto-generate and persist. The route port must match hysteria2.json.\n\n---\n\n## Port forwarding\n\n| Port | Protocol | Required |\n|------|----------|----------|\n| 56000 | UDP | Always (Turnable listener; VK relay connects here) |\n\n---\n\n## Bandwidth and antifraud\n\n| Peers | Throughput | Note |\n|-------|-----------|------|\n| 1 | ~2 Mbit flat | One allocation, VK policer, no sawtooth. Quiet. |\n| 2 | ~3 Mbit | Floats; 2 participants in the call |\n| 4 | ~5 Mbit | Floats more; 4 participants — higher antifraud signal |\n\nKeep peers=1 for quiet long-term use; raise only for short bursts. Each peer is another \"participant\" VK's antifraud can see.\n\n---\n\n## How it works\n\nphone Xray (Hy2, pinned) -> Turnable client -> VK TURN relay (SRTP) -> Turnable server :56000 -> route 127.0.0.1:2443 -> sing-box Hysteria2 -> internet\n\nThe client briefly joins the VK call to get TURN credentials, then leaves the room while the allocation stays live — traffic rides the allocation, not a visible participant, which keeps antifraud quiet.\n\n---\n\n## Environment variables\n\n| Key | Default | Purpose |\n|-----|---------|---------|\n| TURNABLE_ANCHOR_MODE | periodic | periodic = brief visits, off = none |\n| TURNABLE_ANCHOR_INTERVAL | 1800 | seconds between visits |\n| TURNABLE_ANCHOR_HOLD | 20 | seconds held per visit |\n\n---\n\n## Credits\n\nTransport: [TheAirBlow/Turnable](https://github.com/TheAirBlow/Turnable)
\nProxy core: [SagerNet/sing-box](https://github.com/SagerNet/sing-box)
\nClient: [WireTurn](https://github.com/spkprsnts/WireTurn)\n\nThis image packages and wires them together for RouterOS; all protocol credit is theirs.\n\n---\n\n## GitHub\n\nSource and Dockerfile: coming soon","has_starred","hub_user","immutable_tags_settings",{"_78":11,"_79":80},"enabled","rules",[81],".*","is_automated","permissions",{"_85":17,"_86":11,"_87":11},"read","write","admin","user","storage_size",74181087,"orgData","recentTags",[94],{"_95":48,"_96":97,"_98":99,"_100":101,"_102":103,"_104":105,"_54":135,"_136":97,"_137":29,"_138":60,"_39":139,"_140":141,"_142":125,"_143":135,"_144":69,"_145":17},"content_type","creator",25201151,"digest","sha256:675ac99eb44c2f4c515b398351bf6b754373ad14779cdc4d59cd40a8957b11b9","full_size",25801928,"id",1288865722,"images",[106,122,128],{"_107":108,"_98":109,"_110":111,"_112":113,"_114":115,"_116":117,"_118":111,"_119":-5,"_120":101,"_66":69,"_121":-5},"architecture","amd64","sha256:b7838a423ae5d51acd62d8765f83b8b8d40666f616a4a439cb1ceb7f4ba05119","features","","last_pulled","2026-09-17T19:21:47.953206729Z","last_pushed","2026-08-30T05:37:18.684332966Z","os","linux","os_features","os_version","size","variant",{"_107":123,"_98":124,"_110":111,"_112":125,"_114":126,"_116":117,"_118":111,"_119":-5,"_120":127,"_66":69,"_121":-5},"arm64","sha256:f3eec0eaab2d8ca5d0359d6acff8987b6cd3aab344517606f086a83a46554249","2026-09-17T19:21:48.02582373Z","2026-08-30T05:37:19.40479705Z",24650600,{"_107":129,"_98":130,"_110":111,"_112":131,"_114":132,"_116":117,"_118":111,"_119":-5,"_120":133,"_66":69,"_121":134},"arm","sha256:9430e8f5e348c1c0121857f8f7fa0a5089f27447d1f75dc179e6468ce5dee6ef","2026-09-17T19:21:47.967523374Z","2026-08-30T05:37:16.552861093Z",23719658,"v7","2026-08-30T05:37:21.11695Z","last_updater","last_updater_username","media_type","latest","repository",32308397,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":155,"_164":165,"_151":176,"_177":11},{"_36":156,"_46":159,"_49":50,"_51":52,"_53":11,"_54":55,"_56":57,"_58":160,"_39":31,"_28":29,"_61":62,"_63":-5,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":65,"_72":73,"_74":11,"_75":29,"_76":161,"_82":11,"_83":163,"_88":29,"_89":90},[157,158],{"_39":40,"_41":42},{"_39":44,"_41":45},[48],[60],{"_78":11,"_79":162},[81],{"_85":17,"_86":11,"_87":11},"tags",{"_166":67,"_167":-5,"_168":-5,"_169":170},"count","next","previous","results",[171],{"_95":48,"_96":97,"_98":99,"_100":101,"_102":103,"_104":172,"_54":135,"_136":97,"_137":29,"_138":60,"_39":139,"_140":141,"_142":125,"_143":135,"_144":69,"_145":17},[173,174,175],{"_107":108,"_98":109,"_110":111,"_112":113,"_114":115,"_116":117,"_118":111,"_119":-5,"_120":101,"_66":69,"_121":-5},{"_107":123,"_98":124,"_110":111,"_112":125,"_114":126,"_116":117,"_118":111,"_119":-5,"_120":127,"_66":69,"_121":-5},{"_107":129,"_98":130,"_110":111,"_112":131,"_114":132,"_116":117,"_118":111,"_119":-5,"_120":133,"_66":69,"_121":134},[],"canDeleteTags","actionData","errors"]

Digest	OS/ARCH	Compressed size
b7838a423ae5	linux/amd64	24.61 MB
9430e8f5e348	linux/arm/v7	22.62 MB
f3eec0eaab2d	linux/arm64	23.51 MB

ulfrasark/turnable-hy2

Tags for ulfrasark/turnable-hy2