Case: Launching and Registering an MTProto Proxy in 5 Minutes Using Docker

Link to check how the installed Telemt works

Update: September 2026

Before deploying the official image, note its status:

• The image is hardly updated. The tag telegrammessenger/proxy:latest (aka 1.4) was last published on February 28, 2020. In April 2026 a 2.0beta tag appeared in the repository, but it is not documented in the image documentation, and relying on it in production is risky.
• Fake TLS (secret with prefix ee) is not documented in the official image. The image is configured only with the SECRET, SECRET_COUNT, TAG and WORKERS variables. It does not offer masquerading as a TLS connection to a third-party domain.
• The dd mode (random packet alignment) is enabled on the client side — by the dd prefix in the link. The secret is passed to the server without the prefix.

Therefore for a new proxy we recommend Telemt — an MTProxy server in Rust that supports Fake TLS, is regularly updated, and runs in Docker on port 443:

• Telemt: installing MTProxy in Docker on port 443 with Fake TLS
• Telemt: web proxy for Telegram (WEB mode)

The official image is still suitable for quick checks and simple scenarios. Below — how to run it correctly.

Task

Run your own MTProto proxy, register it in Telegram to see statistics, and optionally link a sponsor channel to it.

Solution: Docker and the official image

• Docker runs the proxy in an isolated container without installing dependencies on the server. All configuration is described in a single docker-compose.yml file.
• telegrammessenger/proxy — image from the Telegram team. It implements the MTProto protocol and can accept up to 16 secrets simultaneously.

docker-compose.yml configuration

services:
  mtproto:
    image: telegrammessenger/proxy:1.4
    container_name: mtproto
    restart: unless-stopped
    ports:
      - "443:443/tcp"
    environment:
      # 16 bytes in hexadecimal, lowercase: exactly 32 characters, without the dd prefix
      - SECRET=0123456789abcdef0123456789abcdef
      # Tag from @MTProxybot — add after registration
      # - TAG=your_tag
    volumes:
      - proxy-config:/data

volumes:
  proxy-config:

What matters

1. Image. Tag 1.4 is the same as latest; specifying the version protects against unexpected swaps.

2. Restart. restart: unless-stopped brings the proxy up after a crash or server reboot.

3. Port 443. The standard HTTPS port is less often blocked by provider networks. If you map a different external port to the container, use that same port in the client link.

4. SECRET. Exactly 16 bytes in hexadecimal — 32 characters. Generate:

   bash Copy

   head -c 16 /dev/urandom | xxd -ps

   If the SECRET variable is not set, the image will generate the secret itself and show it in the logs: docker compose logs mtproto. Multiple secrets can be listed separated by commas.

5. Volume proxy-config. Preserves the generated secret and settings between restarts.

Start and connection link

1. Save the configuration as docker-compose.yml and start the proxy:

   bash Copy

   docker compose up -d

2. Form the link. To have the client enable random packet alignment mode, add the dd prefix to the secret — only in the link, not in SECRET:

   Copy

   tg://proxy?server=YOUR_IP&port=443&secret=ddYOUR_SECRET

   For example:

   Copy

   tg://proxy?server=203.0.113.10&port=443&secret=dd0123456789abcdef0123456789abcdef

   When opening the link, Telegram will offer to add the proxy.

3. Update the image — as new versions are released (rarely):

   bash Copy

   docker compose pull && docker compose up -d

Registering the proxy via the bot

Registration provides connection statistics and the ability to show a sponsor channel to users.

1. Open the official bot @MTProxybot in Telegram and send the command /newproxy.

2. Send the server address and port, for example 203.0.113.10:443.

3. Send the secret — the same 32-character key as in SECRET, without the dd prefix.

4. The bot will register the proxy and issue a tag.

5. Add the tag to docker-compose.yml (the TAG= line) and restart the container:

   bash Copy

   docker compose up -d

   The tag is not saved in the volume: the image takes it only from the environment variable at each start.

After that, statistics and sponsor channel binding are available in the bot: users of your proxy will see a link to the channel at the top of their chat list.

Summary

• The official image runs in minutes, but is hardly developed and does not document Fake TLS.
• The secret is 32 hexadecimal characters; dd is added only in the client link.
• The tag from @MTProxybot is passed via the TAG environment variable at each start.
• For a working proxy with Fake TLS and up-to-date updates — Telemt.

Link to check how the installed Telemt works