Docker一键部署VPN：X-UI/Trojan/Shadowsocks容器化方案

# 一键安装脚本
curl -fsSL https://get.docker.com | bash

# 启动Docker
systemctl enable docker
systemctl start docker

# 验证安装
docker --version
docker compose version

# 防火墙设置
ufw allow 22/tcp    # SSH
ufw allow 80/tcp    # HTTP
ufw allow 443/tcp   # HTTPS
ufw allow 54321/tcp # X-UI面板
ufw enable

mkdir -p ~/xui && cd ~/xui
nano docker-compose.yml

version: '3'

services:
  xui:
    image: enwaiax/x-ui:latest
    container_name: x-ui
    restart: always
    network_mode: host
    volumes:
      - ./db:/etc/x-ui
      - ./cert:/root/cert
    environment:
      XRAY_VMESS_AEAD_FORCED: "false"
    labels:
      - "com.centurylinklabs.watchtower.enable=true"

# 启动
docker compose up -d

# 查看日志
docker logs -f x-ui

# 查看状态
docker ps

# 备份数据库
cp ~/xui/db/x-ui.db ~/backup/x-ui-$(date +%Y%m%d).db

# 恢复数据库
cp ~/backup/x-ui-20260101.db ~/xui/db/x-ui.db
docker restart x-ui

docker run -d \
  --name watchtower \
  -v /var/run/docker.sock:/var/run/docker.sock \
  containrrr/watchtower \
  --cleanup \
  --schedule "0 0 4 * * *"

version: '3'

services:
  trojan:
    image: teddysun/trojan-go:latest
    container_name: trojan-go
    restart: always
    ports:
      - "443:443"
    volumes:
      - ./config.json:/etc/trojan-go/config.json
      - ./cert:/etc/ssl/certs
    network_mode: bridge

{
  "run_type": "server",
  "local_addr": "0.0.0.0",
  "local_port": 443,
  "remote_addr": "127.0.0.1",
  "remote_port": 80,
  "password": [
    "你的密码"
  ],
  "ssl": {
    "cert": "/etc/ssl/certs/server.crt",
    "key": "/etc/ssl/certs/server.key",
    "sni": "你的域名.com"
  }
}

docker compose up -d
docker logs -f trojan-go

version: '3'

services:
  ss:
    image: shadowsocks/shadowsocks-libev:latest
    container_name: shadowsocks
    restart: always
    ports:
      - "8388:8388/tcp"
      - "8388:8388/udp"
    environment:
      - PASSWORD=你的密码
      - METHOD=aes-256-gcm
      - SERVER_PORT=8388

docker compose up -d

version: '3'

networks:
  vpn-network:
    driver: bridge

services:
  # X-UI面板
  xui:
    image: enwaiax/x-ui:latest
    container_name: x-ui
    restart: always
    network_mode: host
    volumes:
      - ./xui-db:/etc/x-ui
    depends_on:
      - trojan
      - ss

  # Trojan
  trojan:
    image: teddysun/trojan-go:latest
    container_name: trojan
    restart: always
    ports:
      - "443:443"
    volumes:
      - ./trojan-config:/etc/trojan-go
      - ./cert:/etc/ssl
    networks:
      - vpn-network

  # Shadowsocks
  ss:
    image: shadowsocks/shadowsocks-libev:latest
    container_name: ss
    restart: always
    ports:
      - "8388:8388"
    environment:
      - PASSWORD=ss-password
      - METHOD=aes-256-gcm
    networks:
      - vpn-network

  # 自动更新
  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    command: --cleanup --schedule "0 0 4 * * *"

docker compose up -d

# 查看所有容器
docker ps

# 查看资源使用
docker stats

# 查看日志
docker logs -f x-ui
docker logs -f trojan

# 停止服务
docker compose down

# 重启服务
docker compose restart

# 更新镜像
docker compose pull
docker compose up -d

# 清理无用镜像
docker image prune -a

# 查看磁盘占用
docker system df

#!/bin/bash

BACKUP_DIR=~/backup
DATE=$(date +%Y%m%d_%H%M%S)

mkdir -p $BACKUP_DIR

# 备份X-UI数据库
docker cp x-ui:/etc/x-ui/x-ui.db $BACKUP_DIR/x-ui_$DATE.db

# 备份配置文件
tar czf $BACKUP_DIR/config_$DATE.tar.gz \
  ~/xui/docker-compose.yml \
  ~/trojan/config.json

# 保留最近7天备份
find $BACKUP_DIR -name "*.db" -mtime +7 -delete
find $BACKUP_DIR -name "*.tar.gz" -mtime +7 -delete

echo "Backup completed: $DATE"

crontab -e

# 每天凌晨3点备份
0 3 * * * /bin/bash ~/backup.sh

# 查看日志
docker logs x-ui

# 检查端口占用
netstat -tlnp | grep 54321

# 检查权限
ls -la ~/xui/db

tar czf backup.tar.gz ~/xui

scp backup.tar.gz user@new-server:~

tar xzf backup.tar.gz
cd ~/xui
docker compose up -d

services:
  xui:
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
        reservations:
          cpus: '0.25'
          memory: 256M

docker volume create portainer_data

docker run -d \
  -p 9000:9000 \
  --name portainer \
  --restart always \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v portainer_data:/data \
  portainer/portainer-ce