roentbox

The CI image roentgenogram builds and tests in.

It is a Rust image plus the three things that project needs on top:

• cmake and a C toolchain, for aws-lc-sys (a transitive dependency of rustls)
• git, because the patched rustls is a git dependency
• an xray binary at /usr/local/bin/xray, copied out of XTLS' own published image, which the interop tests run as a reference server and reach through $XRAY_BIN

protoc is not installed and is not needed: the gRPC transport compiles its .proto with protox, in pure Rust.

Building locally

podman build -t roentbox .
podman run --rm roentbox xray version

Pinning

The Rust and xray versions are build arguments, so a bump is a one line change:

podman build --build-arg XRAY_VERSION=26.7.28 \
  --build-arg XRAY_SHA256_amd64=<sha256 of Xray-linux-64.zip> \
  --build-arg XRAY_SHA256_arm64=<sha256 of Xray-linux-arm64-v8a.zip> \
  -t roentbox .

xray comes from the GitHub release archive, whose digests are published beside it as Xray-linux-64.zip.dgst. The ghcr.io/xtls/xray-core image is not used: it stopped being rebuilt in March 2026, and the interop tests need a release past 26.7.11, where XHTTP stopped forcing a trailing / onto its path.

Keeping the pin close to the xray the interop tests were written against is the point: when it moves, those tests are what tell you whether anything drifted.