🌐 English | 中文 | 한국어

HY2 SCALE runs as a single Docker container. All configuration is managed through the web UI — no config files to edit.

• Docker (any Linux host with Docker support)
• NET_ADMIN capability (for VPN protocols and routing rules)
• --network host (required for L2TP/IPsec and IKEv2)

docker run -d --name hy2scale \
  --network host --privileged \
  -v hy2scale-data:/data \
  --restart unless-stopped \
  frankoong/hy2scale:latest

Open http://<host>:5565/scale/ — default login: admin / admin.

Warning: Change the default password immediately via Settings → System.

When --network host is unavailable, run with explicit port mapping. L2TP / IKEv2 / WireGuard all work via compat mode, only the Rules engine is unavailable.

docker run -d --name hy2scale \
  --cap-add NET_ADMIN --cap-add NET_RAW \
  -p 5565:5565/tcp -p 5565:5565/udp \
  -p 500:500/udp -p 4500:4500/udp -p 1701:1701/udp -p 51820:51820/udp \
  -v hy2scale-data:/data \
  --restart unless-stopped \
  frankoong/hy2scale:latest

The version badge in the sidebar shows the auto-detected runtime mode: Normal, Bridge, Compat, or Limited — see Settings.

services:
  hy2scale:
    image: frankoong/hy2scale:latest
    container_name: hy2scale
    restart: unless-stopped
    network_mode: host
    privileged: true
    volumes:
      - hy2scale-data:/data

volumes:
  hy2scale-data:

For bridge mode:

services:
  hy2scale:
    image: frankoong/hy2scale:latest
    container_name: hy2scale
    restart: unless-stopped
    cap_add: [NET_ADMIN, NET_RAW]
    devices: ["/dev/net/tun"]
    ports:
      - "5565:5565/tcp"
      - "5565:5565/udp"
      - "500:500/udp"
      - "4500:4500/udp"
      - "1701:1701/udp"
      - "51820:51820/udp"
    volumes:
      - hy2scale-data:/data

volumes:
  hy2scale-data:

With --network host, all ports are automatically available. With port mapping, map each port individually:

docker run -d --name hy2scale \
  --cap-add NET_ADMIN \
  -p 5565:5565/tcp -p 5565:5565/udp \
  -p 1701:1701/udp \
  -p 500:500/udp -p 4500:4500/udp \
  -p 51820:51820/udp \
  -v hy2scale-data:/data \
  frankoong/hy2scale:latest

Note: L2TP and IKEv2 require --network host to function. Port mapping alone is not sufficient because IPsec ESP packets cannot be NATed by Docker.

No other environment variables are needed. All configuration is managed via the web UI and persisted in /data/config.yaml.

All state persists to the /data volume:

/data/
├── node-id          # Unique node identifier (8-char hex)
├── config.yaml      # Configuration (auto-generated, atomic writes)
└── tls/             # TLS certificates (PEM format)
    ├── default.crt
    ├── default.key
    └── default.name

Note: A self-signed TLS certificate is auto-generated on first startup.

The binary accepts these flags (usually not needed when running via Docker):

git clone https://github.com/FrankoonG/hy2scale.git
cd hy2scale
docker build -t hy2scale .

The image (~73MB) includes:

• Go binary (statically compiled)
• strongSwan 5.8.4 (compiled from source)
• xl2tpd, pppd, iptables-legacy
• Alpine 3.19 base

docker pull frankoong/hy2scale:latest
docker stop hy2scale
docker rm hy2scale
# Re-run with the same docker run command

Your configuration is preserved in the data volume.