feat: use Alpine AOT images, static SQLite and Podman host metrics [CI]

packaging/compose/agent/compose.yaml

@@ -7,7 +7,8 @@
 #     --server "$MONITOR_SERVER" --join "$MONITOR_JOIN_TOKEN" --name "$MONITOR_AGENT_NAME" --identity-dir /etc/monitor/agent-id
 #   再在 .data/agent.json 里写（fleet.identity_dir 要和上面一致）：
 #   {"fleet":{"server":"https://<backend>","identity_dir":"/etc/monitor/agent-id"},"listen":{"bind":"0.0.0.0"},"limits":{"max_total_mbps":100,"max_total_pps":10000}}
-#   docker compose up -d
+#   sudo chown -R 1654:1654 .data
+#   sudo podman compose up -d          # Linux rootful Podman；也可用 docker compose
 #
 # 更新：改 MONITOR_VERSION（或 MONITOR_IMAGE），再 docker compose pull && docker compose up -d。
 # 这种方式没有宿主机更新器：管理端的「更新」按钮对它不起作用；要自动更新请用 podman + systemd（docs/deployment.md「容器节点的运行」）。.data 不动，身份和历史都保留。
@@ -21,11 +22,20 @@ services:
     network_mode: host
     volumes:
       - ./.data:/etc/monitor
-      - /etc/os-release:/etc/os-release:ro  # 让节点读到宿主机的系统名（镜像里是 Ubuntu）
+      - /etc/os-release:/etc/os-release:ro
+      # 系统目录只读，不加 :z/:Z；SELinux 隔离在容器级别禁用。
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /:/host/root:ro
+    environment:
+      HOST_PROC: /host/proc
+      HOST_SYS: /host/sys
+      HOST_ROOT: /host/root
     read_only: true
     tmpfs:
       - /tmp:rw,noexec,nosuid,size=64m,mode=1777
     security_opt:
+      - label=disable
       - no-new-privileges:true
     cap_drop:
       - ALL

packaging/compose/probe/compose.yaml

@@ -3,7 +3,8 @@
 # 第一次使用：
 #   mkdir -p .data && sudo chown 1654:1654 .data        # 容器以 UID/GID 1654 运行，需要读写这个目录
 #   在管理端创建 Probe，下载一次性身份配置，保存为 .data/probe.json（含私钥，权限 600，不要提交到版本控制）
-#   docker compose up -d
+#   sudo chown -R 1654:1654 .data       # probe.json 的 600 权限要求文件也归容器用户所有
+#   sudo podman compose up -d          # Linux rootful Podman；也可用 docker compose
 #
 # 更新：改 MONITOR_VERSION（或 MONITOR_IMAGE），再 docker compose pull && docker compose up -d。
 # 这种方式没有宿主机更新器：管理端的「更新」按钮对它不起作用；要自动更新请用 podman + systemd（docs/deployment.md「容器节点的运行」）。.data 不动。
@@ -16,11 +17,12 @@ services:
     network_mode: host
     volumes:
       - ./.data:/etc/monitor
-      - /etc/os-release:/etc/os-release:ro  # 让节点读到宿主机的系统名（镜像里是 Ubuntu）
+      - /etc/os-release:/etc/os-release:ro
     read_only: true
     tmpfs:
       - /tmp:rw,noexec,nosuid,size=64m,mode=1777
     security_opt:
+      - label=disable
       - no-new-privileges:true
     cap_drop:
       - ALL

packaging/container/Agent.Containerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled-extra
+FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine
 
 ARG APP_VERSION=unknown
 LABEL org.opencontainers.image.title="Monitor Agent" \

packaging/container/Agent.NativeBuild.Containerfile

@@ -1,10 +1,10 @@
-FROM mcr.microsoft.com/dotnet/sdk:10.0-noble-aot AS build
+FROM mcr.microsoft.com/dotnet/sdk:10.0-alpine-aot AS build
 
 WORKDIR /src/backend
 COPY restore/backend/ ./
 # restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」
-RUN dotnet restore agent/src/Monitor.Agent -r linux-x64 -p:PublishAot=true --artifacts-path /artifacts \
-    && dotnet restore fleet/tools/fleet-enroll -r linux-x64 -p:PublishAot=true --artifacts-path /artifacts
+RUN dotnet restore agent/src/Monitor.Agent -r linux-musl-x64 -p:PublishAot=true --artifacts-path /artifacts \
+    && dotnet restore fleet/tools/fleet-enroll -r linux-musl-x64 -p:PublishAot=true --artifacts-path /artifacts
 
 COPY source/backend/ ./
 # 构建信息：CI 通过 --build-arg 传入；不传就是空（放在 restore 之后，每次构建都变的时间不会让依赖还原的缓存失效）
@@ -12,11 +12,11 @@ ARG MONITOR_TAG=
 ARG MONITOR_COMMIT=
 ARG MONITOR_BUILT_AT=
 ENV MONITOR_TAG=$MONITOR_TAG MONITOR_COMMIT=$MONITOR_COMMIT MONITOR_BUILT_AT=$MONITOR_BUILT_AT
-RUN dotnet publish agent/src/Monitor.Agent -m:3 -c Release -r linux-x64 \
+RUN dotnet publish agent/src/Monitor.Agent -m:3 -c Release -r linux-musl-x64 \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=false \
     -p:UseAppHost=true -p:StripSymbols=true \
     -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/agent \
-    && dotnet publish fleet/tools/fleet-enroll -m:3 -c Release -r linux-x64 \
+    && dotnet publish fleet/tools/fleet-enroll -m:3 -c Release -r linux-musl-x64 \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=false \
     -p:UseAppHost=true -p:StripSymbols=true \
     -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/enroll
@@ -24,7 +24,7 @@ RUN dotnet publish agent/src/Monitor.Agent -m:3 -c Release -r linux-x64 \
 RUN test -x /out/agent/monitor-agent && test -x /out/enroll/fleet-enroll \
     && test "$(stat -c%s /out/agent/monitor-agent)" -gt 2000000 && test "$(stat -c%s /out/enroll/fleet-enroll)" -gt 2000000
 
-FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled-extra
+FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine
 
 ARG APP_VERSION=main
 LABEL org.opencontainers.image.title="Monitor Agent" \

packaging/container/Backend.Containerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/dotnet/aspnet:10.0-noble-chiseled-extra
+FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine
 
 ARG APP_VERSION=unknown
 LABEL org.opencontainers.image.title="Monitor Backend" \
@@ -7,7 +7,7 @@ LABEL org.opencontainers.image.title="Monitor Backend" \
       org.opencontainers.image.version="$APP_VERSION"
 
 WORKDIR /app
-COPY --chown=1654:1654 app/ /app/
+COPY --chown=1654:1654 app/monitor-backend /app/monitor-backend
 COPY --chown=1654:1654 data/.keep /data/.keep
 
 ENV ASPNETCORE_HTTP_PORTS=8080 \
@@ -17,4 +17,4 @@ ENV ASPNETCORE_HTTP_PORTS=8080 \
 USER 1654:1654
 VOLUME ["/data"]
 EXPOSE 8080
-ENTRYPOINT ["dotnet", "/app/monitor-backend.dll"]
+ENTRYPOINT ["/app/monitor-backend"]

packaging/container/Probe.Containerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled-extra
+FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine
 
 ARG APP_VERSION=unknown
 LABEL org.opencontainers.image.title="Monitor Probe" \

packaging/container/Probe.NativeBuild.Containerfile

@@ -1,9 +1,9 @@
-FROM mcr.microsoft.com/dotnet/sdk:10.0-noble-aot AS build
+FROM mcr.microsoft.com/dotnet/sdk:10.0-alpine-aot AS build
 
 WORKDIR /src/backend
 COPY restore/backend/ ./
 # restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」
-RUN dotnet restore probe/src/Monitor.Probe -r linux-x64 -p:PublishAot=true --artifacts-path /artifacts
+RUN dotnet restore probe/src/Monitor.Probe -r linux-musl-x64 -p:PublishAot=true --artifacts-path /artifacts
 
 COPY source/backend/ ./
 # 构建信息：CI 通过 --build-arg 传入；不传就是空（放在 restore 之后，每次构建都变的时间不会让依赖还原的缓存失效）
@@ -11,7 +11,7 @@ ARG MONITOR_TAG=
 ARG MONITOR_COMMIT=
 ARG MONITOR_BUILT_AT=
 ENV MONITOR_TAG=$MONITOR_TAG MONITOR_COMMIT=$MONITOR_COMMIT MONITOR_BUILT_AT=$MONITOR_BUILT_AT
-RUN dotnet publish probe/src/Monitor.Probe -m:3 -c Release -r linux-x64 \
+RUN dotnet publish probe/src/Monitor.Probe -m:3 -c Release -r linux-musl-x64 \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=false \
     -p:UseAppHost=true -p:StripSymbols=true \
     -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/probe
@@ -19,7 +19,7 @@ RUN dotnet publish probe/src/Monitor.Probe -m:3 -c Release -r linux-x64 \
 RUN test -x /out/probe/monitor-probe \
     && test "$(stat -c%s /out/probe/monitor-probe)" -gt 2000000
 
-FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled-extra
+FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-alpine
 
 ARG APP_VERSION=main
 LABEL org.opencontainers.image.title="Monitor Probe" \

packaging/systemd/monitor-agent-container.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Monitor Agent (Podman container)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+EnvironmentFile=/etc/monitor-update/agent.image
+Restart=always
+RestartSec=5
+TimeoutStopSec=30
+ExecStartPre=-/usr/bin/podman rm -f monitor-agent
+ExecStart=/usr/bin/podman run --rm --name monitor-agent --network host --read-only --security-opt no-new-privileges --security-opt label=disable --cap-drop all --tmpfs /tmp:rw,noexec,nosuid,size=64m,mode=1777 -v /etc/os-release:/etc/os-release:ro -v /proc:/host/proc:ro -v /sys:/host/sys:ro -v /:/host/root:ro -e HOST_PROC=/host/proc -e HOST_SYS=/host/sys -e HOST_ROOT=/host/root -v /opt/monitor/etc:/etc/monitor ${IMAGE}
+ExecStop=/usr/bin/podman stop -t 20 monitor-agent
+
+[Install]
+WantedBy=multi-user.target

packaging/systemd/monitor-probe-container.service

@@ -0,0 +1,16 @@
+[Unit]
+Description=Monitor Probe (Podman container)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+EnvironmentFile=/etc/monitor-update/probe.image
+Restart=always
+RestartSec=5
+TimeoutStopSec=30
+ExecStartPre=-/usr/bin/podman rm -f monitor-probe
+ExecStart=/usr/bin/podman run --rm --name monitor-probe --network host --read-only --security-opt no-new-privileges --security-opt label=disable --cap-drop all --tmpfs /tmp:rw,noexec,nosuid,size=64m,mode=1777 -v /etc/os-release:/etc/os-release:ro -v /opt/monitor-probe/etc:/etc/monitor ${IMAGE}
+ExecStop=/usr/bin/podman stop -t 20 monitor-probe
+
+[Install]
+WantedBy=multi-user.target