Qeli in a MikroTik container
RouterOS runs the OCI image through its built-in container runtime. Support depends on the model, CPU architecture and /dev/net/tun availability inside the container.
Check the model and architecture
Identify the RouterOS architecture: modern devices are usually arm64, older ARM boards use arm/v7, while CHR and x86 use amd64. Export a single-architecture Docker archive with provenance and SBOM disabled, or RouterOS may report could not load next layer.
$ docker buildx build --platform linux/arm64 \
--provenance=false --sbom=false \
-f release/docker/Dockerfile -t qeli:0.8.0-arm64 \
-o type=docker,dest=qeli-arm64.tar .Enable containers
Container mode is enabled once and requires physical confirmation plus a reboot. After uploading the image tar, create a veth and persistent mounts for /etc/qeli and /var/lib/qeli, then add the container with the server or client role.
/system/device-mode/update container=yes
/interface/veth/add name=veth-qeli address=172.18.0.2/24 gateway=172.18.0.1
/container/mounts/add name=qeli-etc src=disk1/qeli/etc dst=/etc/qeli
/container/mounts/add name=qeli-lib src=disk1/qeli/lib dst=/var/lib/qeli
/container/add file=qeli-arm64.tar interface=veth-qeli \
root-dir=disk1/qeli/root mounts=qeli-etc,qeli-lib \
cmd="server" start-on-boot=yesConfigure routing
For remote-subnet access, add precise RouterOS routes through the container veth and provide a return route on the other side. NAT is unnecessary when both sides know the routes; preserving source addresses also makes access rules clearer. Keep NAT for full-tunnel internet egress or when a return route cannot be added.
/ip/route/add dst-address=192.168.50.0/24 gateway=172.19.0.2. Replace the destination and gateway with the actual remote subnet and client-container veth address.Check TUN before configuring the network
Availability of /dev/net/tun inside a RouterOS container depends on the version and board, and RouterOS has no Docker-style --device option. If the profile fails with No such file or directory, run Qeli on a small Linux host behind the MikroTik and route or forward traffic to it.