mirror of
https://github.com/fscarmen/sing-box.git
synced 2026-08-10 17:55:16 +08:00
fscarmen
adcaf813fc
This commit improves the security posture for Shadowrocket, Clash, and sing-box clients by implementing certificate fingerprint validation instead of the less secure certificate skipping approach. Key changes: - Shadowrocket: Replaced insecure TLS validation with HPKP-based certificate fingerprint verification - Clash: Updated configuration to use certificate fingerprints instead of skip-cert-verify flags - sing-box: Implemented certificate_public_key_sha256 verification for enhanced TLS security This change ensures that only connections with verified server certificates are accepted, significantly reducing the risk of man-in-the-middle attacks while maintaining compatibility with self-signed certificates.
19 lines
447 B
Docker
19 lines
447 B
Docker
# 使用 Alpine 镜像
|
|
FROM alpine:latest
|
|
ARG TARGETARCH
|
|
ENV ARCH=$TARGETARCH
|
|
|
|
# 设置工作目录
|
|
WORKDIR /sing-box
|
|
|
|
# 复制初始化脚本
|
|
COPY docker_init.sh /sing-box/init.sh
|
|
|
|
# 安装依赖并生成证书
|
|
RUN set -ex &&\
|
|
apk add --no-cache supervisor wget nginx bash openssl &&\
|
|
mkdir -p /sing-box/cert /sing-box/conf /sing-box/subscribe /sing-box/logs &&\
|
|
chmod +x /sing-box/init.sh &&\
|
|
rm -rf /var/cache/apk/*
|
|
|
|
CMD [ "./init.sh" ] |