A control plane for a complicated proxy core
Xray-core is powerful because it combines many proxy protocols, transports, security layers, and routing options. The same range makes its JSON configuration intimidating. 3X-UI puts a web interface around that core and adds the operational pieces needed when more than one client uses it: traffic accounting, quotas, expiration dates, IP limits, share links, QR codes, subscription feeds, and online status.
Protocol coverage is broad. The README lists VLESS, VMess, Trojan, Shadowsocks, WireGuard, Hysteria2, HTTP, mixed SOCKS, tunnel, TUN, and other inbound types. Transports include raw TCP, WebSocket, gRPC, HTTPUpgrade, XHTTP, and mKCP, with TLS, XTLS, and REALITY options. Routing can use custom outbounds and proxy chains. A Telegram bot, REST API, Swagger page, and multi-node management extend the panel beyond a visual configuration editor.
That breadth is genuinely useful for an experienced operator. A person can create a client, cap traffic, set an expiry, and provide a subscription without manually keeping several configuration fragments consistent. It is also the central caution: the panel makes settings reachable, not automatically correct. Incompatible combinations, weak exposure, or a bad route can still break connectivity or privacy.
The quick start is only the server bootstrap
The headline install is one shell command that downloads and runs install.sh. It supports many Linux distributions and architectures, generates a random username, password, and panel path, and exposes a command-line menu for service state, credentials, certificates, and other maintenance. An unattended route writes generated results to /etc/x-ui/install-result.env, making cloud-init practical.
Convenience should not replace inspection. This is an administrative script changing a network-facing server, so download it, read it, and pass a specific stable tag rather than blindly executing the rolling main branch. The dev-latest option is explicitly a per-commit prerelease and does not belong on a server you rely on. Retrieve the generated credentials through a secure channel, move secrets out of casual shell history, and restrict the panel itself by firewall or private network.
A usable deployment still needs a domain, valid certificates, intentional open ports, DNS, and client testing. Subscription URLs are credentials and should be treated that way. Back up the database, configuration, certificates, and any added assets, then verify restoration before an upgrade. Version 3.6.0 improved online SQLite snapshots, but a snapshot is useful only if it is copied away from the server and can be restored.
Docker needs meaningful privileges
The container route is not an unprivileged web app. The image bundles Fail2ban for enforcing per-client IP limits through iptables. Docker therefore needs NET_ADMIN, while the provided invocation also adds NET_RAW. Without the capability, bans can be logged without being applied. That failure mode is easy to miss if the dashboard appears healthy. Test enforcement from a separate client rather than assuming a log entry changed the host firewall.
Those privileges raise the consequence of a panel compromise. Use a dedicated host or tightly constrained virtual machine, keep the administration route off public indexes, enable strong TLS, and apply updates deliberately. Version 3.6.0 tightened important surfaces: the OpenAPI description now requires an authenticated session, node API tokens are write-only through the API, production source maps were removed, and stock freedom routes gained a private-range block. The fact that these changes were needed is also a reminder that this is security-sensitive software.
Multi-node secrets need particular care. An open pull request says the bearer token used by the panel to control each node is currently stored in plaintext, so a copied database or backup can expose every node credential. Another open fix describes partial validation of certificate bundles during mTLS certificate rotation and notes that an invalid bundle can fall back to bearer-token authentication. These proposals may improve the design, but they are not released guarantees. Protect database copies, rotate tokens after suspected exposure, and test certificate rotation on a disposable node.
Client portability has sharp edges
3X-UI generates raw links plus subscription formats for different clients, but not every Xray feature maps to a portable standard. One open report demonstrates Shadowsocks with Xray-native TLS producing an ss:// URL whose nonstandard TLS query values are ignored by v2rayNG and even discarded by 3X-UI's own importer. The client then attempts plain Shadowsocks against a TLS endpoint and fails. The practical lesson is to test each protocol and target app, not just confirm that a link was generated.
Multi-node aggregation is also moving. A current report says subscription ID uniqueness prevents combining separately synchronized node clients under one subscription, even though the subscription service can read multiple matches. Client export and import has a related limit: a user asking how to move panels reports that traffic usage is not included. Treat the database backup as the route for faithful recovery and UI export as configuration portability until proven otherwise.
The latest release absorbed an Xray-core breaking change to XMC masks, repaired legacy database values, and included dozens of subscription, client, routing, and lifecycle fixes. Pin both the panel and client apps and stage changes with real connection tests.
Excellent activity, with an explicit ceiling
Version 3.6.0 arrived July 30, 2026, and the repository was pushed August 6. Pull requests were actively updated August 8. GitHub's open count of 122 includes issues and pull requests, and the newest queue contains security hardening, migration integrity, database consistency, performance, and protocol work. Community activity is a clear strength. English is the default README, with translated READMEs and a panel offered in 13 languages.
The decisive limitation comes directly from the maintainers: 3X-UI is intended for personal use only, with an explicit request not to use it in production. Take that boundary seriously. The panel is a strong convenience layer for a knowledgeable individual, not a vendor-backed control plane with a production assurance promise. For that personal scope, it is easy to understand the appeal. For a commercial service, regulated environment, or deployment where compromise affects many customers, choose a system whose stated support model matches the job.