RouterOS containers and apps

Containers run Linux (OCI/Docker) images on arm, arm64 and x86 RouterOS devices with the container package. Images come from Docker Hub, GHCR, Quay or a tar archive. Security first: container mode is disabled by default and needs physical access to enable. Once on, containers can be added and started remotely, and a malicious or exploited image can leave a backdoor even after the container is removed (a compromised bootloader may survive Netinstall). The router is only as secure as what runs in it: use images you trust, keep the router locked down, and say so to the user before enabling it.

Prerequisites

• Package container installed (routeros-install-upgrade), architecture arm, arm64 or x86. hEX Refresh (EN7562CT CPU) can run only arm32v5 images.
• /system/device-mode/update container=yes, then confirm by pressing the reset or mode button (or cold power cycle) within the time limit (routeros-system-utilities). Without confirmation nothing changes.
• External storage with at least 100 MB/s sequential and 10 K random IOPS is recommended; put root-dir, tmpdir and volumes on it, not on internal flash (routeros-storage; /disk/test measures speed). 16 MB SPI flash boards should use prebuilt images from USB.
• A DNS server in /ip/dns or the container's dns setting; a container without any DNS does not start.

Network and first container (Pi-hole pattern)