Skip to content

RayLimit v0.4.0-beta

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Jun 09:01
v0.4.0-beta
e6589fd

RayLimit is a Linux-native Xray speed limiter toolkit focused on practical host-side traffic control.

This public beta advances the operator-facing surface with broader runtime compatibility, more robust tc/nft handling, and a cleaner, more maintainable codebase while keeping the currently practical limiter families at the center of the release:

  • Inbound speed limiter
  • Outbound speed limiter
  • IP speed limiter

Highlights

  • Sanaei and other Xray fork support with prefix-match runtime detection for binaries such as xray-linux-amd64 and sanaei-*
  • Plain-text wire-format parsing for Xray StatsService responses, including the user>>>email>>>online format used by Sanaei and compatible forks
  • StatsUserOnline capability detection so misconfigured Sanaei runtimes surface a clear actionable diagnostic instead of silently reporting no sessions
  • Plain-text fallback parsers for tc -j and nft -j output so older or BusyBox-style builds no longer fail with invalid character 'c' looking for beginning of value
  • Idempotent re-apply behavior so upload-then-download and reapply flows no longer collide with RTNETLINK answers: File exists
  • New global runtime-binary override flags with matching environment variables:
    • --xray-binary / RAYLIMIT_XRAY_BINARY
    • --container-cli / RAYLIMIT_CONTAINER_CLI (podman and nerdctl friendly)
    • --tc-binary / RAYLIMIT_TC_BINARY
    • --nft-binary / RAYLIMIT_NFT_BINARY
  • New operational flags:
    • --log-level / RAYLIMIT_LOG_LEVEL for diagnostic verbosity
    • --skip-privilege-check / RAYLIMIT_SKIP_PRIVILEGE_CHECK for capability-based deployments
    • --skip-checksum for development installs
  • Reproducible builds via SOURCE_DATE_EPOCH and automatic SHA256SUMS verification on install and update
  • Signal-aware CLI so SIGINT and SIGTERM cancel in-flight subprocesses cleanly
  • Hardened install scripts with manifest quoting, symlink-aware writability checks, and shellcheck-enforced CI
  • Reworked and expanded documentation with Sanaei examples, troubleshooting entries for the three real-world failure modes, and an updated runtime-targeting page covering fork detection signals
  • Linux release packages for amd64 and arm64
  • Installer, updater, and uninstaller scripts
  • Makefile-based build and packaging flows

What changed in v0.4.0-beta

This release significantly broadens runtime compatibility and hardens the traffic-control lifecycle.

The discovery layer now accepts the full Xray-family binary namespace through prefix matching, so forks and OS/arch-suffixed binaries such as xray-linux-amd64, xray-darwin-arm64, sanaei, and sanaei-linux-amd64 are detected on both host and Docker runtimes. The detected binary identity is threaded through to the actual xray api invocation, so live session evidence works against forks that do not install a literal xray binary on PATH. Docker detection now also consults container labels, published API ports, and binary-derived config-path hints, and surfaces a clear NoMatches issue when containers are scanned but none match.

The Xray StatsService path now handles both JSON and plain-text wire formats defensively. Sanaei's user>>>email>>>online records and the corresponding user>>>email>>>online>>>ip online-IP lines are parsed explicitly, with email-segment verification so mis-attributed evidence is rejected rather than trusted. When StatsUserOnline is not enabled in a Sanaei config, the operator now receives a typed diagnostic naming the missing service and the config key to add, instead of a silent empty result.

The tc and nftables layers now fall back to plain-text parsing when -j JSON output is unavailable or silently ignored, removing the invalid character 'c' failure mode on older or stripped builds. Apply and reapply flows are idempotent through the mark-attachment path plus an execution-time recovery for EEXIST and EBUSY, so upload-then-download on the same device no longer tears down the upload class. A read-error field on the snapshot lets reconcile degrade gracefully instead of re-applying everything on every tick.

The operator surface gains a coherent set of global override flags and environment variables for the Xray, container CLI, tc, and nft binaries, plus a --log-level flag, a --skip-privilege-check escape hatch for CAP_NET_ADMIN deployments, and a --skip-checksum development install path. The install scripts now verify SHA256SUMS by default and support reproducible builds via SOURCE_DATE_EPOCH. The CLI is signal-aware, the privilege check probes CAP_NET_ADMIN rather than only euid == 0, log fields are quoted to prevent log-forging, and shellcheck is enforced in CI.

The codebase has been cleaned of dead infrastructure: the unused control-loop, restart-recovery, garbage-collection, and runtime-evidence churn clusters have been removed, stale phase references and aspirational daemon comments have been eliminated, and formatting and error-wrapping style are now uniform across internal/tc, internal/discovery, and internal/cli. Wallet and donation content has been removed from the repository and documentation.

This release also continues the cleanup and unification work across CLI behavior, reporting, managed-state handling, and documentation so the operator surface is more consistent and easier to reason about.

Installation

Documentation:
https://pdyrust.github.io/RayLimit/

Repository:
https://github.com/PdYrust/RayLimit

Telegram:
https://t.me/PdYrust

Release assets

This release provides Linux package archives and SHA256 checksum files for the supported architectures.

Beta status

RayLimit is currently released as a public beta. The supported limiter families in this release are actively maintained and documented, and the project continues to evolve toward a cleaner and more practical operator experience.

Assets 6
Loading