chore: bump x to v0.11.0

Docker-in-Docker containers cannot reach the internet via the default
bridge network, causing 'apk add' in the Dockerfile to hang indefinitely
and e2e tests to timeout after 10 minutes.

Add BuildOptionsModifier with NetworkMode=host to all FromDockerfile
definitions so the build step uses the host's network stack. This has
no negative impact on non-DinD environments where bridge networking
already works.

Also move GostBinPath flag and init() from main_test.go to utils.go
(non-test file) so the symbol is accessible across the package.

Dockerfile

@@ -2,8 +2,10 @@ FROM --platform=$BUILDPLATFORM tonistiigi/xx:1.6.1 AS xx
 
 FROM --platform=$BUILDPLATFORM golang:1.26-alpine3.23 AS builder
 
-# add upx for binary compression
+# UPX compression disabled by default (see #863): upx --best adds ~3s startup
-RUN apk add --no-cache upx || echo "upx not found"
+# time on low-spec systems (linux/arm). Builds can opt in by uncommenting the
+# upx install line and adding upx --best to the build command below.
+# RUN apk add --no-cache upx || echo "upx not found"
 
 COPY --from=xx / /
 
@@ -21,13 +23,12 @@ COPY . .
 
 RUN cd cmd/gost && \
     xx-go build -ldflags "-s -w" && \
-    xx-verify gost && \
+    xx-verify gost
-    { upx --best gost || true; }
 
 FROM alpine:3.23
 
-# add iptables for tun/tap
+# add iptables/nftables for tun/tap
-RUN apk add --no-cache iptables
+RUN apk add --no-cache iptables nftables
 
 WORKDIR /bin/
 

go.mod

@@ -4,8 +4,9 @@ go 1.26.3
 
 require (
 	github.com/go-gost/core v0.4.1
-	github.com/go-gost/x v0.10.7
+	github.com/go-gost/x v0.11.0
 	github.com/judwhite/go-svc v1.2.1
+	github.com/moby/moby/client v0.4.0
 	github.com/stretchr/testify v1.11.1
 	github.com/testcontainers/testcontainers-go v0.42.0
 )
@@ -83,7 +84,6 @@ require (
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/go-archive v0.2.0 // indirect
 	github.com/moby/moby/api v1.54.1 // indirect
-	github.com/moby/moby/client v0.4.0 // indirect
 	github.com/moby/patternmatcher v0.6.1 // indirect
 	github.com/moby/sys/sequential v0.6.0 // indirect
 	github.com/moby/sys/user v0.4.0 // indirect
@@ -107,7 +107,7 @@ require (
 	github.com/prometheus/common v0.48.0 // indirect
 	github.com/prometheus/procfs v0.12.0 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/quic-go/quic-go v0.59.0 // indirect
+	github.com/quic-go/quic-go v0.59.1 // indirect
 	github.com/quic-go/webtransport-go v0.10.0 // indirect
 	github.com/riobard/go-bloom v0.0.0-20200614022211-cdc8013cb5b3 // indirect
 	github.com/rs/xid v1.3.0 // indirect

go.sum

@@ -95,8 +95,8 @@ github.com/go-gost/relay v0.6.0 h1:o8r0B3eTw8Rwwent+5x5Cw1g4AyNUl4hNqiyDJXkFvA=
 github.com/go-gost/relay v0.6.0/go.mod h1:Dku0f5sfjOClrZFiDmQUrYYJ4uof7rnkCUBfsl0PSAI=
 github.com/go-gost/tls-dissector v0.2.0 h1:9tE6WOzzpurATTBWn60DU4R8gibpGNY8/qVcc1SicVg=
 github.com/go-gost/tls-dissector v0.2.0/go.mod h1:/9QfdewqmHdaE362Hv5nDaSWLx3pCmtD870d6GaquXs=
-github.com/go-gost/x v0.10.7 h1:z9957XyqpAK9rCorVZkjpQbOgZ7BUNuRmIq33km3ZR8=
+github.com/go-gost/x v0.11.0 h1:fTkdKSwIfTwGtBmYA4sguWJUv4KnvqWyUNv4mr0lAlE=
-github.com/go-gost/x v0.10.7/go.mod h1:rlFAe9jHSKCEmbps70sZxiU+Wdv3zB6+Li/AqjCUQSM=
+github.com/go-gost/x v0.11.0/go.mod h1:gKZwVEQh4ebC9eLP8zv9z3TwfOuKEl1Kk0vC/BfQaUQ=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -252,8 +252,8 @@ github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k
 github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
 github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
-github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw=
+github.com/quic-go/quic-go v0.59.1 h1:0Gmua0HW1Tv7ANR7hUYwRyD0MG5OJfgvYSZasGZzBic=
-github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
+github.com/quic-go/quic-go v0.59.1/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
 github.com/quic-go/webtransport-go v0.10.0 h1:LqXXPOXuETY5Xe8ITdGisBzTYmUOy5eSj+9n4hLTjHI=
 github.com/quic-go/webtransport-go v0.10.0/go.mod h1:LeGIXr5BQKE3UsynwVBeQrU1TPrbh73MGoC6jd+V7ow=
 github.com/riobard/go-bloom v0.0.0-20200614022211-cdc8013cb5b3 h1:f/FNXud6gA3MNr8meMVVGxhp+QBTqY91tM8HjEuMjGg=

tests/e2e/main_test.go

@@ -13,12 +13,6 @@ import (
 
 var SharedNetworkName string
 
-var GostBinPath string
-
-func init() {
-	flag.StringVar(&GostBinPath, "gost-bin", "", "Path to a pre-built gost binary (skips compilation)")
-}
-
 func TestMain(m *testing.M) {
 	flag.Parse()
 	ctx := context.Background()

tests/e2e/utils.go

@@ -2,15 +2,23 @@ package e2e
 
 import (
 	"context"
+	"flag"
 	"io"
 	"os"
 	"testing"
 	"text/template"
 
+	"github.com/moby/moby/client"
 	"github.com/testcontainers/testcontainers-go"
 	"github.com/testcontainers/testcontainers-go/wait"
 )
 
+var GostBinPath string
+
+func init() {
+	flag.StringVar(&GostBinPath, "gost-bin", "", "Path to a pre-built gost binary (skips compilation)")
+}
+
 type ConfigData struct {
 	ServerAddr string
 }
@@ -70,6 +78,9 @@ func echoContainerRequest(_ context.Context, networkName string) testcontainers.
 			Repo:       "gost-e2e",
 			Tag:        "latest",
 			KeepImage:  true,
+			BuildOptionsModifier: func(opts *client.ImageBuildOptions) {
+				opts.NetworkMode = "host"
+			},
 		},
 		Networks: []string{networkName},
 		NetworkAliases: map[string][]string{
@@ -100,6 +111,9 @@ func udpEchoContainerRequest(_ context.Context, networkName string) testcontaine
 			Repo:       "gost-e2e",
 			Tag:        "latest",
 			KeepImage:  true,
+			BuildOptionsModifier: func(opts *client.ImageBuildOptions) {
+				opts.NetworkMode = "host"
+			},
 		},
 		Networks: []string{networkName},
 		NetworkAliases: map[string][]string{
@@ -134,6 +148,9 @@ func runGostContainer(ctx context.Context, networkName, yamlPath string, aliases
 			Repo:       "gost-e2e",
 			Tag:        "latest",
 			KeepImage:  true,
+			BuildOptionsModifier: func(opts *client.ImageBuildOptions) {
+				opts.NetworkMode = "host"
+			},
 		},
 		ExposedPorts: exposedPorts,
 		// interal check for udp ports will be failed