This guide deploys a Sing-Box client with Docker for SOCKS proxy access using VLESS + Reality.

The setup prioritizes stability, security, and minimal interference with the host system, making it well suited to Arch Linux users.

1. System Requirements

  • Linux (Arch Linux recommended)
  • Root or sudo access
  • Internet access
  • A VPS with VLESS + Reality server already configured

2. Docker and Compose Installation

We use Docker and Docker Compose to isolate Sing-Box from the host system.

2.1 Docker Installation

sudo pacman -S docker

Enable Docker:

sudo systemctl enable --now docker

Add your user to the Docker group:

sudo usermod -aG docker $(whoami)

2.2 Docker Compose Installation

sudo pacman -S docker-compose

Verify:

docker-compose version

3. Project Directory

mkdir -p ~/software/sing-box/config
cd ~/software/sing-box

4. Docker Compose Configuration

Create a docker-compose.yml file:

services:
  sing-box:
    image: ghcr.io/sagernet/sing-box
    container_name: sing-box
    restart: always
    network_mode: host
    volumes:
      - ./config:/etc/sing-box
    command: run -C /etc/sing-box

Start the service:

docker-compose up -d

Check the container status:

docker ps | grep sing-box

5. Required Credentials

5.1 UUID Generation

Generate the UUID used to identify the client:

uuidgen

Example:

123e4567-e89b-12d3-a456-426614174000

5.2 Reality Key Pair Generation

Reality uses X25519 key exchange.

sing-box cert generate -t reality

Output:

Private key: xxxx
Public key:  xxxx
  • Private key → VPS server
  • Public key → client

5.2.2 OpenSSL (Alternative)

openssl genpkey -algorithm X25519 -out reality_private.key
openssl pkey -in reality_private.key -pubout -out reality_public.key

6. Sing-Box Client Configuration

Create the configuration file:

mkdir -p config
nano config/config.json

6.1 VLESS and Reality Configuration

{
  "log": {
    "level": "warning",
    "timestamp": true
  },

  "inbounds": [
    {
      "type": "socks",
      "listen": "127.0.0.1",
      "listen_port": 1080
    }
  ],

  "outbounds": [
    {
      "type": "vless",
      "server": "YOUR_VPS_IP",
      "server_port": 443,
      "uuid": "YOUR_UUID",

      "flow": "xtls-rprx-vision",

      "tls": {
        "enabled": true,
        "server_name": "www.cloudflare.com",
        "utls": {
          "enabled": true
        },
        "reality": {
          "enabled": true,
          "public_key": "YOUR_PUBLIC_KEY",
          "short_id": "8f3a7b2c9d"
        }
      }
    },

    {
      "type": "direct",
      "tag": "direct"
    }
  ],

  "route": {
    "rules": [
      {
        "protocol": "dns",
        "outbound": "direct"
      }
    ]
  }
}

6.2 Configuration Notes

  • The UUID must match the VPS configuration
  • The public key must match the Reality key generated by the server
  • short_id must be identical on both sides
  • server_name should be a valid TLS fingerprint domain

7. Service Restart

docker-compose restart

Check logs:

docker logs sing-box

8. Browser Configuration

  • SOCKS host: 127.0.0.1
  • Port: 1080
  • Enable SOCKS v5
  • Enable “Proxy DNS when using SOCKS v5”

8.2 Chromium

google-chrome --proxy-server="socks5://127.0.0.1:1080"

9. Security

  • Do not expose port 1080 to the internet
  • Always bind SOCKS to 127.0.0.1
  • Keep UUID and keys private
  • Prefer TLS + Reality over raw TCP
  • Do not modify system-wide routing unless necessary

10. Backup and Restore

10.1 Configuration Backup

mkdir -p ~/backup/sing-box
cp -r config ~/backup/sing-box/

10.2 Configuration Restore

rm -rf config
cp -r ~/backup/sing-box/config ./
docker-compose restart

11. Troubleshooting

11.1 Service Logs

docker logs sing-box

11.2 Configuration Validation

docker-compose config

11.3 Common Issues

  • Wrong UUID
  • Reality key mismatch
  • TLS server_name mismatch
  • Port 443 blocked

12. Quick Checklist

  • Docker running
  • Container started
  • UUID correct
  • Reality keys matched
  • short_id identical
  • SOCKS on 127.0.0.1:1080
  • Browser proxy enabled