Initial: minimal sub-to-SOCKS container

- Python entrypoint fetches subscription URL, picks VLESS node,
  generates sing-box JSON config on the fly, then execs sing-box.

Required env var: SUB_URL
Optional: SOCKS_PORT, SOCKS_USER/PASS, DNS_SERVER, PICK_STRATEGY, LOG_LEVEL

Dockerfile

@@ -0,0 +1,10 @@
+# ========== Stage 1: extract sing-box binary ==========
+FROM ghcr.io/sagernet/sing-box:latest AS sb-bin
+# ========== Stage 2: slim Python runtime + entrypoint.py ==========
+FROM python:3.13-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*
+COPY --from=sb-bin /usr/local/bin/sing-box /usr/local/bin/sing-box
+RUN chmod +x /usr/local/bin/sing-box
+WORKDIR /src
+COPY entrypoint.py .
+ENTRYPOINT ["python3", "entrypoint.py"]