ci: add dependency-aware main fastlane

Add Linux amd64 fast-lane OCI builds selected by project dependencies.

Co-authored-by: JustMe <mr.toing@outlook.com>

.woodpecker/gitea-release.yml

@@ -17,11 +17,27 @@ depends_on:
   - windows-release
 
 steps:
+  - name: publish-agent-probe-oci
+    image: bash
+    environment:
+      GITEA_BASE: http://127.0.0.1:3100
+      GITEA_TOKEN:
+        from_secret: gitea_token
+      ZOT_REGISTRY: registry.oeo.one
+      ZOT_USERNAME: justme
+      ZOT_SECRET:
+        from_secret: zot_secret
+    commands:
+      - bash ci/release-node-images.sh
+    depends_on: []
+
   - name: publish-gitea-release
     image: bash
     environment:
-      GITEA_BASE: http://192.168.2.162:3100
+      GITEA_BASE: http://127.0.0.1:3100
       GITEA_TOKEN:
         from_secret: gitea_token
     commands:
       - bash ci/publish-gitea-release.sh
+    depends_on:
+      - publish-agent-probe-oci

.woodpecker/linux-release.yml

@@ -19,11 +19,10 @@ steps:
     image: bash
     environment:
       NUGET_PACKAGES: /home/justme/.nuget/packages
-      ZOT_REGISTRY: 192.168.2.162:5000
-      ZOT_USERNAME:
-        from_secret: zot_username
-      ZOT_PASSWORD:
-        from_secret: zot_password
+      ZOT_REGISTRY: registry.oeo.one
+      ZOT_USERNAME: justme
+      ZOT_SECRET:
+        from_secret: zot_secret
     commands:
       - bash ci/release-linux.sh amd64 backend
     depends_on: []
@@ -32,11 +31,10 @@ steps:
     image: bash
     environment:
       NUGET_PACKAGES: /home/justme/.nuget/packages
-      ZOT_REGISTRY: 192.168.2.162:5000
-      ZOT_USERNAME:
-        from_secret: zot_username
-      ZOT_PASSWORD:
-        from_secret: zot_password
+      ZOT_REGISTRY: registry.oeo.one
+      ZOT_USERNAME: justme
+      ZOT_SECRET:
+        from_secret: zot_secret
     commands:
       - bash ci/release-linux.sh arm64 backend
     depends_on: []
@@ -44,11 +42,11 @@ steps:
   - name: backend-multiarch-index
     image: bash
     environment:
-      ZOT_REGISTRY: 192.168.2.162:5000
-      ZOT_USERNAME:
-        from_secret: zot_username
-      ZOT_PASSWORD:
-        from_secret: zot_password
+      ZOT_REGISTRY: registry.oeo.one
+      ZOT_SCHEME: https
+      ZOT_USERNAME: justme
+      ZOT_SECRET:
+        from_secret: zot_secret
     commands:
       - bash ci/index-backend-image.sh
     depends_on:

.woodpecker/main-fastlane.yml

@@ -0,0 +1,28 @@
+labels:
+  ci: domain-linux-native
+  platform: linux/amd64
+
+clone:
+  - name: git
+    image: plugin-git
+    settings:
+      lfs: false
+
+when:
+  - event: push
+    branch: main
+
+concurrency: 1
+
+steps:
+  - name: publish-affected-amd64-images
+    image: bash
+    environment:
+      NUGET_PACKAGES: /home/justme/.nuget/packages
+      ZOT_REGISTRY: registry.oeo.one
+      ZOT_USERNAME: justme
+      ZOT_SECRET:
+        from_secret: zot_secret
+    commands:
+      - bash ci/release-main-images.sh
+    depends_on: []

.woodpecker/verify.yml

@@ -9,7 +9,9 @@ clone:
       lfs: false
 
 when:
-  - event: [push, pull_request]
+  - event: pull_request
+  - event: push
+    branch: dev
 
 steps:
   - name: backend-tests

README.md

@@ -44,7 +44,7 @@ npm run build --prefix web
 
 前端产物位于 `web/display/dist/` 和 `web/admin/dist/`。NativeAOT 目标平台和 Windows 上使用 AotAnywhere 交叉构建的说明见 [`docs/deployment.md`](docs/deployment.md)。
 
-Backend 以 OCI 镜像发布，支持 Linux/amd64 与 Linux/arm64；Agent 和 Probe 发布 Linux glibc/musl x64、arm64，macOS x64/arm64，以及 Windows x64/arm64 二进制包。容器部署配置见 [`compose.yaml`](compose.yaml)，发布说明见 [`docs/deployment.md`](docs/deployment.md)。
+Backend、Agent 和 Probe 均以 OCI 镜像发布，支持 Linux/amd64 与 Linux/arm64；Agent 和 Probe 另外提供 Linux glibc/musl、macOS 与 Windows 二进制包。容器部署配置见 [`compose.yaml`](compose.yaml)，发布说明见 [`docs/deployment.md`](docs/deployment.md)。
 
 ### 本地运行
 

backend/Directory.Build.props

@@ -13,7 +13,7 @@
     <UseArtifactsOutput>true</UseArtifactsOutput>
     <ArtifactsPath>$(MSBuildThisFileDirectory)artifacts</ArtifactsPath>
     <Deterministic>true</Deterministic>
-    <Version>0.1.0</Version>
+    <Version>0.1.1</Version>
     <NuGetAudit>false</NuGetAudit>
   </PropertyGroup>
   <ItemGroup>

backend/agent/README.md

@@ -47,6 +47,8 @@ fleet-enroll --server https://<backend> --join <token> --name <agent-name> --ide
 monitor-agent --config /etc/monitor/agent.json
 ```
 
+也可使用 OCI 镜像 `registry.oeo.one/monitor/monitor-agent:<version>`，自动选择 Linux amd64 或 arm64 镜像。镜像同时包含 `fleet-enroll`；可通过 `--entrypoint /usr/local/bin/fleet-enroll` 执行首次注册。容器默认读取 `/etc/monitor/agent.json`，需要挂载配置与身份目录；建议使用宿主网络，并按 ICMP 测量需求添加 `NET_RAW` 能力。镜像以 UID/GID 1654 运行，挂载目录必须允许该用户读取配置和身份文件。
+
 不传 `--config` 时默认读取 `/etc/monitor/agent.json`。Agent 默认监听控制端口 `7443/tcp`，数据端口 `7443/udp` 和 `7444/tcp`；防火墙和面板中的节点端口配置需与本地配置一致。`reporting.host_stats` 可关闭主机状态上报；启用时只上报资源使用等汇总数据，不包含主机名、进程或 IP。
 
 ## 设计说明

backend/agent/src/Monitor.Agent/AgentApp.cs

@@ -12,7 +12,7 @@ namespace Monitor.Agent;
 /// <summary>Agent 的组装点：数据面、点对点监听、与 Backend 的链路都在这里接起来。没有全局状态，测试可以在同一进程里启动多个。</summary>
 public sealed class AgentApp : IDisposable
 {
-    public const string Version = "0.1.0";
+    public const string Version = "0.1.1";
 
     private readonly AgentConfig _config;
     private readonly LoadedNodeIdentity _identity;

backend/probe/README.md

@@ -39,6 +39,8 @@ monitor-probe --config /etc/monitor/probe.json
 
 不传 `--config` 时默认读取 `/etc/monitor/probe.json`。配置中的 `limits` 是本地硬上限，Backend 无法远程放宽；路由器等低性能设备可调低测试码率和包速率，避免 Probe 自身成为测量瓶颈。部署时可使用仓库的 `packaging/` 文件和安装脚本。
 
+也可使用 OCI 镜像 `registry.oeo.one/monitor/monitor-probe:<version>`，自动选择 Linux amd64 或 arm64 镜像。容器默认读取 `/etc/monitor/probe.json`，并在同一目录维护 `agents.json` 缓存，因此挂载目录必须允许 UID/GID 1654 读写。建议使用宿主网络，并按 ICMP 测量需求添加 `NET_RAW` 能力。
+
 ## 设计说明
 
 - Probe 只执行编译进程序的测量模块。它不认识 Backend，不落盘测量数据，也不能执行命令或自行更新。

backend/probe/src/Monitor.Probe/ProbeApp.cs

@@ -11,7 +11,7 @@ namespace Monitor.Probe;
 /// </summary>
 public sealed class ProbeApp : IDisposable
 {
-    public const string Version = "0.1.0";
+    public const string Version = "0.1.1";
 
     private readonly ConnectionEnv _env;
     private readonly Dictionary<string, Running> _connections = [];

ci/index-backend-image.sh

@@ -9,13 +9,13 @@ version="${CI_COMMIT_TAG#v}"
   exit 2
 }
 
-registry="${ZOT_REGISTRY:-192.168.2.162:5000}"
-scheme="${ZOT_SCHEME:-http}"
+registry="${ZOT_REGISTRY:-registry.oeo.one}"
+scheme="${ZOT_SCHEME:-https}"
 image="monitor/monitor-backend"
 auth_file="$(mktemp)"
 chmod 600 "$auth_file"
 trap 'rm -f "$auth_file"' EXIT
-printf 'machine %s login %s password %s\n' "${registry%%:*}" "$ZOT_USERNAME" "$ZOT_PASSWORD" > "$auth_file"
+printf 'machine %s login %s password %s\n' "${registry%%:*}" "$ZOT_USERNAME" "$ZOT_SECRET" > "$auth_file"
 
 accept='application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json, application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json'
 

ci/main-fastlane.py

@@ -0,0 +1,209 @@
+#!/usr/bin/env python3
+"""Find impacted OCI images from changed paths and stage NativeAOT contexts."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import shutil
+import subprocess
+from pathlib import Path
+from xml.etree import ElementTree
+
+
+ROOT = Path(__file__).resolve().parents[1]
+BACKEND = ROOT / "backend"
+IMAGE_ROOTS = {
+    "backend": [BACKEND / "src/Monitor.Backend/Monitor.Backend.csproj"],
+    "agent": [
+        BACKEND / "agent/src/Monitor.Agent/Monitor.Agent.csproj",
+        BACKEND / "fleet/tools/fleet-enroll/fleet-enroll.csproj",
+    ],
+    "probe": [BACKEND / "probe/src/Monitor.Probe/Monitor.Probe.csproj"],
+}
+GLOBAL_BACKEND_FILES = {
+    "Directory.Build.props",
+    "Directory.Build.targets",
+    "Directory.Packages.props",
+    "global.json",
+    "NuGet.Config",
+    "NuGet.config",
+}
+IGNORED_PARTS = {".git", ".release", "artifacts", "bin", "obj", "TestResults", "tests"}
+
+
+def read_changed_files() -> list[str]:
+    raw = os.environ.get("CI_PIPELINE_FILES")
+    if raw:
+        try:
+            value = json.loads(raw)
+            if isinstance(value, list):
+                return [str(path).replace("\\", "/") for path in value]
+        except json.JSONDecodeError:
+            return [path.strip().replace("\\", "/") for path in raw.split(",") if path.strip()]
+
+    previous = os.environ.get("CI_PREV_COMMIT_SHA")
+    try:
+        base = previous if previous else "HEAD^"
+        return subprocess.check_output(
+            ["git", "diff", "--name-only", base, "HEAD"],
+            cwd=ROOT,
+            text=True,
+        ).splitlines()
+    except (OSError, subprocess.CalledProcessError):
+        return []
+
+
+def project_graph() -> tuple[dict[Path, set[Path]], dict[Path, Path]]:
+    projects = [path.resolve() for path in BACKEND.rglob("*.csproj") if not (IGNORED_PARTS & set(path.parts))]
+    graph: dict[Path, set[Path]] = {}
+    directories: dict[Path, Path] = {}
+    for project in projects:
+        graph[project] = set()
+        directories[project.parent] = project
+        try:
+            document = ElementTree.parse(project)
+        except ElementTree.ParseError:
+            continue
+        for reference in document.iter():
+            if reference.tag.rsplit("}", 1)[-1] == "ProjectReference":
+                include = reference.attrib.get("Include")
+                if include:
+                    graph[project].add((project.parent / include.replace("\\", os.sep)).resolve())
+    return graph, directories
+
+
+def reachable_projects(graph: dict[Path, set[Path]], roots: list[Path]) -> set[Path]:
+    found: set[Path] = set()
+    pending = [path.resolve() for path in roots]
+    while pending:
+        project = pending.pop()
+        if project in found:
+            continue
+        found.add(project)
+        pending.extend(graph.get(project, ()))
+    return found
+
+
+def is_within(path: Path, directory: Path) -> bool:
+    try:
+        path.relative_to(directory)
+        return True
+    except ValueError:
+        return False
+
+
+def affected_images(changed: list[str]) -> list[str]:
+    graph, project_dirs = project_graph()
+    image_dependencies = {
+        name: reachable_projects(graph, roots) for name, roots in IMAGE_ROOTS.items()
+    }
+    selected: set[str] = set()
+
+    def select_for_project(project: Path) -> None:
+        for image, dependencies in image_dependencies.items():
+            if project in dependencies:
+                selected.add(image)
+
+    project_directories = sorted(project_dirs, key=lambda path: len(path.parts), reverse=True)
+    container_map = {
+        "packaging/container/Backend.Containerfile": "backend",
+        "packaging/container/Agent.Containerfile": "agent",
+        "packaging/container/Probe.Containerfile": "probe",
+        "packaging/container/Agent.Fastlane.Containerfile": "agent",
+        "packaging/container/Probe.Fastlane.Containerfile": "probe",
+    }
+
+    for filename in changed:
+        normalized = filename.replace("\\", "/")
+        path = (ROOT / normalized).resolve()
+        if normalized in container_map:
+            selected.add(container_map[normalized])
+            continue
+        if normalized.startswith("ci/") or normalized.startswith(".woodpecker/"):
+            if not normalized.endswith(".md"):
+                selected.update(IMAGE_ROOTS)
+            continue
+        if any(part in IGNORED_PARTS for part in Path(normalized).parts):
+            continue
+        if not normalized.startswith("backend/"):
+            continue
+        if "/README" in normalized or normalized.endswith(".md"):
+            continue
+
+        if path.name in GLOBAL_BACKEND_FILES and path.parent == BACKEND:
+            selected.update(IMAGE_ROOTS)
+            continue
+
+        matching = [directory for directory in project_directories if is_within(path, directory)]
+        if matching:
+            select_for_project(project_dirs[matching[0]])
+            continue
+
+        # A props/targets file above one or more projects affects each project
+        # below it and every image that consumes those projects.
+        descendants = [project for directory, project in project_dirs.items() if is_within(directory, path.parent)]
+        if path.suffix in {".props", ".targets"} and descendants:
+            for project in descendants:
+                select_for_project(project)
+        elif normalized.startswith("backend/agent/"):
+            selected.add("agent")
+        elif normalized.startswith("backend/probe/"):
+            selected.add("probe")
+        elif path.is_file() and path.suffix in {".cs", ".csproj", ".props", ".targets", ".json"}:
+            selected.update(IMAGE_ROOTS)
+
+    return [name for name in ("backend", "agent", "probe") if name in selected]
+
+
+def stage_context(component: str, destination: Path) -> None:
+    containerfiles = {
+        "agent": ROOT / "packaging/container/Agent.Fastlane.Containerfile",
+        "probe": ROOT / "packaging/container/Probe.Fastlane.Containerfile",
+    }
+    if component not in containerfiles:
+        raise SystemExit(f"NativeAOT context is not available for {component}")
+    if destination.exists():
+        shutil.rmtree(destination)
+    restore = destination / "restore/backend"
+    source = destination / "source/backend"
+    restore.mkdir(parents=True)
+    source.mkdir(parents=True)
+    shutil.copy2(containerfiles[component], destination / "Containerfile")
+
+    for path in BACKEND.rglob("*"):
+        if not path.is_file() or IGNORED_PARTS.intersection(path.parts):
+            continue
+        relative = path.relative_to(BACKEND)
+        if path.suffix in {".csproj", ".props", ".targets", ".slnx"} or path.name in GLOBAL_BACKEND_FILES or path.name == "packages.lock.json":
+            target = restore / relative
+            target.parent.mkdir(parents=True, exist_ok=True)
+            shutil.copy2(path, target)
+
+        target = source / relative
+        target.parent.mkdir(parents=True, exist_ok=True)
+        shutil.copy2(path, target)
+
+    (destination / "config").mkdir()
+    (destination / "config/.keep").write_text("", encoding="utf-8")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--stage", choices=("agent", "probe"))
+    parser.add_argument("--destination", type=Path)
+    args = parser.parse_args()
+
+    if args.stage:
+        if args.destination is None:
+            parser.error("--destination is required with --stage")
+        stage_context(args.stage, args.destination)
+        return
+
+    for image in affected_images(read_changed_files()):
+        print(image)
+
+
+if __name__ == "__main__":
+    main()

ci/publish-gitea-release.sh

@@ -26,7 +26,7 @@ printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$
 chmod 600 "$netrc"
 trap 'rm -rf "$tmp"' EXIT
 
-release_body="Agent and Probe builds: Linux glibc and musl (x64, arm64), macOS (x64, arm64), and Windows (x64, arm64). macOS binaries are not Developer ID signed or notarized. Backend OCI images: registry.oeo.one/monitor/monitor-backend:$version (linux/amd64 and linux/arm64)."
+release_body="Agent and Probe builds: Linux glibc and musl (x64, arm64), macOS (x64, arm64), and Windows (x64, arm64). Linux glibc Agent and Probe OCI images: registry.oeo.one/monitor/monitor-agent:$version and registry.oeo.one/monitor/monitor-probe:$version (linux/amd64 and linux/arm64). Backend OCI image: registry.oeo.one/monitor/monitor-backend:$version (linux/amd64 and linux/arm64). macOS binaries are not Developer ID signed or notarized."
 payload="$(printf '{"tag_name":"%s","target_commitish":"%s","name":"MyMonitor %s","body":"%s","draft":false,"prerelease":false}' \
   "$tag" "${CI_COMMIT_SHA:-}" "$tag" "$release_body")"
 release_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \

ci/release-linux.sh

@@ -5,11 +5,20 @@ set -euo pipefail
 arch="${1:?usage: release-linux.sh <amd64|arm64>}"
 root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 tag="${CI_COMMIT_TAG:-}"
+if [[ -n "$tag" ]]; then
   [[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
     echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
     exit 2
   }
-[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_PASSWORD:-}" ]] || {
+  version="${tag#v}"
+else
+  [[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main ]] || {
+    echo "untagged image builds are restricted to pushes on main" >&2
+    exit 2
+  }
+  version=main
+fi
+[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
   echo "Zot credentials are required" >&2; exit 2;
 }
 case "$arch" in
@@ -17,14 +26,13 @@ case "$arch" in
   *) echo "unsupported architecture: $arch" >&2; exit 2 ;;
 esac
 
-version="${tag#v}"
 project_version="$(sed -n 's#.*<Version>\(.*\)</Version>.*#\1#p' "$root/backend/Directory.Build.props" | head -1)"
-if [[ "$version" != "$project_version" ]]; then
+if [[ -n "$tag" && "$version" != "$project_version" ]]; then
   echo "tag version $version does not match project version $project_version" >&2
   exit 1
 fi
 
-registry="${ZOT_REGISTRY:-192.168.2.162:5000}"
+registry="${ZOT_REGISTRY:-registry.oeo.one}"
 image="$registry/monitor/monitor-backend"
 output="$root/.release/linux-$arch/backend"
 build_root="$root/.release/build/linux-$arch-backend"
@@ -40,11 +48,18 @@ find "$output" -type f -name '*.pdb' -delete
 cp -a "$output/." "$container_context/app/"
 : > "$container_context/data/.keep"
 
+# Woodpecker's local backend isolates HOME per workflow. Keep Buildah's image
+# store outside that temporary directory so the runtime base image is reusable
+# across releases. Separate stores avoid concurrent amd64/arm64 writers.
+buildah_home="${BUILDAH_HOME:-/home/justme/woodpecker/buildah-home/$arch}"
+mkdir -p "$buildah_home"
+export HOME="$buildah_home"
+
 export REGISTRY_AUTH_FILE="$root/.release/auth/zot-linux-$arch.json"
 mkdir -p "$(dirname "$REGISTRY_AUTH_FILE")"
 logged_in=false
 for attempt in 1 2 3 4; do
-  if buildah login --tls-verify=false --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_PASSWORD" >/dev/null; then
+  if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
     logged_in=true
     break
   fi
@@ -55,13 +70,14 @@ for attempt in 1 2 3 4; do
 done
 [[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
 local_image="localhost/monitor-backend:$version-$arch"
-buildah bud --tls-verify=false --arch "$arch" \
+buildah bud --tls-verify=true --arch "$arch" \
   --build-arg "APP_VERSION=$version" \
   -f "$root/packaging/container/Backend.Containerfile" \
-  -t "$local_image" "$container_context" >/dev/null
-pushed=false
+  -t "$local_image" "$container_context"
+push_tag() {
+  local target_tag="$1" pushed=false
   for attempt in 1 2 3; do
-  if buildah push --tls-verify=false "$local_image" "docker://$image:$version-$arch" >/dev/null; then
+    if buildah push --tls-verify=true "$local_image" "docker://$image:$target_tag"; then
       pushed=true
       break
     fi
@@ -70,5 +86,11 @@ for attempt in 1 2 3; do
       sleep 5
     fi
   done
-[[ "$pushed" == true ]] || { echo "could not push image to Zot after 3 attempts" >&2; exit 1; }
-echo "pushed Zot image $image:$version-$arch"
+  [[ "$pushed" == true ]] || { echo "could not push image to Zot after 3 attempts" >&2; return 1; }
+  echo "pushed Zot image $image:$target_tag"
+}
+
+push_tag "$version-$arch"
+if [[ -z "$tag" ]]; then
+  push_tag "$version"
+fi

ci/release-main-images.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# Build and push only the linux/amd64 OCI images affected by a main push.
+set -euo pipefail
+
+[[ "${CI_PIPELINE_EVENT:-}" == push && "${CI_COMMIT_BRANCH:-}" == main ]] || {
+  echo "fast-lane images can only be published from a push to main" >&2
+  exit 2
+}
+[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
+  echo "Zot credentials are required" >&2
+  exit 2
+}
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+registry="${ZOT_REGISTRY:-registry.oeo.one}"
+work="$root/.release/main-fastlane"
+buildah_home="/home/justme/woodpecker/buildah-home/main-fastlane"
+mkdir -p "$work" "$buildah_home"
+export HOME="$buildah_home"
+export BUILDAH_HOME="$buildah_home"
+export REGISTRY_AUTH_FILE="$work/zot-auth.json"
+
+targets="$(python3 "$root/ci/main-fastlane.py")"
+if [[ -z "$targets" ]]; then
+  echo "no runtime image changes detected; skipping container builds"
+  exit 0
+fi
+echo "affected linux/amd64 images: ${targets//$'\n'/, }"
+
+logged_in=false
+for attempt in 1 2 3 4; do
+  if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
+    logged_in=true
+    break
+  fi
+  if [[ "$attempt" -lt 4 ]]; then
+    echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
+    sleep 3
+  fi
+done
+[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
+
+publish_node_image() {
+  local component="$1" context="$work/$1" image="$registry/monitor/monitor-$1"
+  local local_image="localhost/monitor-$component:main-amd64"
+
+  python3 "$root/ci/main-fastlane.py" --stage "$component" --destination "$context"
+  buildah bud --layers --tls-verify=true --arch amd64 \
+    --build-arg APP_VERSION=main \
+    -f "$context/Containerfile" -t "$local_image" "$context"
+
+  for tag in main-amd64 main; do
+    local pushed=false
+    for attempt in 1 2 3; do
+      if buildah push --tls-verify=true "$local_image" "docker://$image:$tag"; then
+        pushed=true
+        break
+      fi
+      if [[ "$attempt" -lt 3 ]]; then
+        echo "Zot push for $component:$tag attempt $attempt failed; retrying in 5 seconds" >&2
+        sleep 5
+      fi
+    done
+    [[ "$pushed" == true ]] || { echo "could not push $component:$tag after 3 attempts" >&2; return 1; }
+    echo "pushed Zot image $image:$tag"
+  done
+}
+
+while IFS= read -r component; do
+  [[ -n "$component" ]] || continue
+  case "$component" in
+    backend) bash "$root/ci/release-linux.sh" amd64 backend ;;
+    agent|probe) publish_node_image "$component" ;;
+    *) echo "unknown affected image: $component" >&2; exit 2 ;;
+  esac
+done <<< "$targets"

ci/release-node-images.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# Publish glibc OCI images for the Linux Agent and Probe on amd64 and arm64.
+set -euo pipefail
+
+tag="${CI_COMMIT_TAG:-}"
+[[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
+  echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
+  exit 2
+}
+[[ -n "${GITEA_TOKEN:-}" ]] || { echo "GITEA_TOKEN is required" >&2; exit 2; }
+[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
+  echo "Zot credentials are required" >&2
+  exit 2
+}
+
+version="${tag#v}"
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+project_version="$(sed -n 's#.*<Version>\(.*\)</Version>.*#\1#p' "$root/backend/Directory.Build.props" | head -1)"
+if [[ "$version" != "$project_version" ]]; then
+  echo "tag version $version does not match project version $project_version" >&2
+  exit 1
+fi
+
+gitea_base="${GITEA_BASE:-http://127.0.0.1:3100}"
+gitea_base="${gitea_base%/}"
+gitea_host="${gitea_base#https://}"
+gitea_host="${gitea_host#http://}"
+gitea_host="${gitea_host%%/*}"
+gitea_host="${gitea_host%%:*}"
+registry="${ZOT_REGISTRY:-registry.oeo.one}"
+image_root="$registry/monitor"
+work="$root/.release/node-images"
+netrc="$work/netrc"
+buildah_home="/home/justme/woodpecker/buildah-home/node-images"
+mkdir -p "$buildah_home"
+export HOME="$buildah_home"
+mkdir -p "$work"
+chmod 700 "$work"
+printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$netrc"
+chmod 600 "$netrc"
+export REGISTRY_AUTH_FILE="$work/zot-auth.json"
+trap 'rm -rf "$work"' EXIT
+
+logged_in=false
+for attempt in 1 2 3 4; do
+  if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
+    logged_in=true
+    break
+  fi
+  if [[ "$attempt" -lt 4 ]]; then
+    echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
+    sleep 3
+  fi
+done
+[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
+
+build_arch_image() {
+  local component="$1" arch="$2" suffix="$3"
+  local filename="monitor-$component-v$version-linux-$suffix.tar.gz"
+  local context="$work/$component-$arch"
+  local archive="$work/$filename"
+  local containerfile="$root/packaging/container/${component^}.Containerfile"
+  local image="$image_root/monitor-$component"
+  local local_image="localhost/monitor-$component:$version-$arch"
+
+  curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
+    "$gitea_base/api/packages/justme/generic/monitor-node/$version/$filename" -o "$archive"
+  mkdir -p "$context/app" "$context/config"
+  if [[ "$component" == agent ]]; then
+    tar -xzf "$archive" -C "$work" monitor-agent fleet-enroll
+    install -m 0755 "$work/fleet-enroll" "$context/app/fleet-enroll"
+  else
+    tar -xzf "$archive" -C "$work" "monitor-$component"
+  fi
+  install -m 0755 "$work/monitor-$component" "$context/app/monitor-$component"
+  : > "$context/config/.keep"
+
+  buildah bud --tls-verify=true --arch "$arch" \
+    --build-arg "APP_VERSION=$version" \
+    -f "$containerfile" -t "$local_image" "$context" >/dev/null
+
+  local pushed=false
+  for attempt in 1 2 3; do
+    if buildah push --tls-verify=true "$local_image" "docker://$image:$version-$arch" >/dev/null; then
+      pushed=true
+      break
+    fi
+    if [[ "$attempt" -lt 3 ]]; then
+      echo "Zot push for $component/$arch attempt $attempt failed; retrying in 5 seconds" >&2
+      sleep 5
+    fi
+  done
+  [[ "$pushed" == true ]] || { echo "could not push $component/$arch image after 3 attempts" >&2; return 1; }
+  echo "pushed Zot image $image:$version-$arch"
+}
+
+publish_index() {
+  local component="$1" image="$image_root/monitor-$component"
+  local manifest="localhost/monitor-$component:$version-multiarch"
+  buildah manifest rm "$manifest" >/dev/null 2>&1 || true
+  buildah manifest create "$manifest" >/dev/null
+  buildah manifest add "$manifest" "docker://$image:$version-amd64" >/dev/null
+  buildah manifest add "$manifest" "docker://$image:$version-arm64" >/dev/null
+  buildah manifest push --all --format oci "$manifest" "docker://$image:$version" >/dev/null
+  if [[ "$version" != *-* ]]; then
+    buildah manifest push --all --format oci "$manifest" "docker://$image:latest" >/dev/null
+  fi
+  buildah manifest rm "$manifest" >/dev/null
+  echo "published multi-architecture index $image:$version"
+  if [[ "$version" != *-* ]]; then
+    echo "published multi-architecture index $image:latest"
+  fi
+}
+
+for component in agent probe; do
+  build_arch_image "$component" amd64 amd64
+  build_arch_image "$component" arm64 arm64
+  publish_index "$component"
+done

compose.yaml

@@ -1,6 +1,6 @@
 services:
   backend:
-    image: registry.oeo.one/monitor/monitor-backend:${MONITOR_VERSION:-0.1.0}
+    image: registry.oeo.one/monitor/monitor-backend:${MONITOR_VERSION:-0.1.1}
     container_name: monitor-backend
     restart: unless-stopped
     init: true

docs/deployment.md

@@ -36,7 +36,23 @@ Compose 将容器端口只绑定到宿主机 `127.0.0.1:8080`，适合由同机
 
 ## 节点二进制发布
 
-Woodpecker 在 `vMAJOR.MINOR.PATCH` tag 上，由 Windows runner 使用 AotAnywhere 并行构建 Agent/Probe 的 Linux glibc、Linux musl、macOS 和 Windows 产物。Agent 包还包含一次性注册工具 `fleet-enroll`。Linux 归档带有安装脚本和 systemd/OpenWrt 单元；Windows 产物为 `.zip`，Linux/macOS 产物为 `.tar.gz`。所有平台产物和 Backend OCI 镜像成功后，CI 会创建对应的 Gitea Release，并附上压缩包和 SHA-256 校验文件。macOS 产物目前未签名/公证。安装说明见 [`../backend/agent/README.md`](../backend/agent/README.md) 与 [`../backend/probe/README.md`](../backend/probe/README.md)。
+Woodpecker 在 `vMAJOR.MINOR.PATCH` tag 上，由 Windows runner 使用 AotAnywhere 并行构建 Agent/Probe 的 Linux glibc、Linux musl、macOS 和 Windows 产物。Agent 包还包含一次性注册工具 `fleet-enroll`。Linux 归档带有安装脚本和 systemd/OpenWrt 单元；Windows 产物为 `.zip`，Linux/macOS 产物为 `.tar.gz`。Linux glibc 的 Agent 与 Probe 二进制还会打包为 OCI 镜像，支持 `linux/amd64` 和 `linux/arm64`；musl、macOS、Windows 仍通过对应平台归档分发。所有平台产物和 OCI 镜像发布成功后，CI 会创建对应的 Gitea Release，并附上压缩包和 SHA-256 校验文件。macOS 产物目前未签名/公证。安装说明见 [`../backend/agent/README.md`](../backend/agent/README.md) 与 [`../backend/probe/README.md`](../backend/probe/README.md)。
+
+推送到 `main` 会触发 Linux/amd64 快车道。CI 根据变更文件所在项目及 `.csproj` 的传递引用，只构建受影响的 Backend、Agent 或 Probe 镜像；Agent 镜像也包含 `fleet-enroll`。例如只改 Probe 时只构建 Probe；改动 `Monitor.Protocol` 等被多个程序引用的库时，会构建所有受影响镜像。结果推送到对应镜像的 `main` 和 `main-amd64` 标签，不改写 release 版本和 `latest`。只改 Web、文档或部署配置时不会构建容器。完整多架构和跨平台构建仍由版本 tag 流水线负责。
+
+Agent 和 Probe 镜像分别发布为 `registry.oeo.one/monitor/monitor-agent:<version>` 与 `registry.oeo.one/monitor/monitor-probe:<version>`，包含 amd64、arm64 多架构索引；也可指定 `:<version>-amd64` 或 `:<version>-arm64`。稳定版本同时更新 `latest`。镜像以非 root 用户（UID/GID 1654）运行，默认读取 `/etc/monitor/agent.json` 或 `/etc/monitor/probe.json`。运行容器时挂载对应配置目录；Probe 还会在该目录写入 `agents.json`，因此目录需可由 1654 用户写入。Agent、Probe 需使用宿主网络以保持节点端口和测量流量行为，并按需添加 `NET_RAW` 能力以执行 ICMP 测量：
+
+```sh
+docker run -d --name monitor-agent --restart unless-stopped --network host \
+  --cap-add NET_RAW -v "$PWD/agent-config:/etc/monitor" \
+  registry.oeo.one/monitor/monitor-agent:<version>
+
+docker run -d --name monitor-probe --restart unless-stopped --network host \
+  --cap-add NET_RAW -v "$PWD/probe-config:/etc/monitor" \
+  registry.oeo.one/monitor/monitor-probe:<version>
+```
+
+宿主机配置目录应允许 UID/GID 1654 读写；Probe 需要写权限来更新 `agents.json`。也可通过 Docker Compose 配置相同的网络、卷和能力。
 
 实测体积（`StackTraceSupport=false`、`IlcFoldIdenticalMethodBodies=true`、`OptimizationPreference=Size`）：
 

docs/project-layout.md

@@ -253,7 +253,7 @@ Backend 允许的包：ASP.NET Core 共享框架、`Microsoft.Data.Sqlite`、`Mi
     <InvariantGlobalization>true</InvariantGlobalization>
     <UseArtifactsOutput>true</UseArtifactsOutput>
     <Deterministic>true</Deterministic>
-    <Version>0.1.0</Version>
+    <Version>0.1.1</Version>
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="Microsoft.CodeAnalysis.BannedApiAnalyzers" PrivateAssets="all" />

packaging/container/Agent.Containerfile

@@ -0,0 +1,17 @@
+FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled-extra
+
+ARG APP_VERSION=unknown
+LABEL org.opencontainers.image.title="Monitor Agent" \
+      org.opencontainers.image.description="MyMonitor node agent for Linux" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.version="$APP_VERSION"
+
+COPY --chown=1654:1654 app/monitor-agent /usr/local/bin/monitor-agent
+COPY --chown=1654:1654 app/fleet-enroll /usr/local/bin/fleet-enroll
+COPY --chown=1654:1654 config/ /etc/monitor/
+
+USER 1654:1654
+WORKDIR /etc/monitor
+VOLUME ["/etc/monitor"]
+ENTRYPOINT ["/usr/local/bin/monitor-agent"]
+CMD ["--config", "/etc/monitor/agent.json"]

packaging/container/Agent.Fastlane.Containerfile

@@ -0,0 +1,32 @@
+FROM mcr.microsoft.com/dotnet/sdk:10.0-noble-aot AS build
+
+WORKDIR /src/backend
+COPY restore/backend/ ./
+RUN dotnet restore agent/src/Monitor.Agent -r linux-x64 --artifacts-path /artifacts \
+    && dotnet restore fleet/tools/fleet-enroll -r linux-x64 --artifacts-path /artifacts
+
+COPY source/backend/ ./
+RUN dotnet publish agent/src/Monitor.Agent -m:3 -c Release -r linux-x64 \
+    --self-contained true --no-restore -p:PublishAot=true -p:StripSymbols=true \
+    -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/agent \
+    && dotnet publish fleet/tools/fleet-enroll -m:3 -c Release -r linux-x64 \
+    --self-contained true --no-restore -p:PublishAot=true -p:StripSymbols=true \
+    -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/enroll
+
+FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled-extra
+
+ARG APP_VERSION=main
+LABEL org.opencontainers.image.title="Monitor Agent" \
+      org.opencontainers.image.description="MyMonitor node agent for Linux" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.version="$APP_VERSION"
+
+COPY --chown=1654:1654 --from=build /out/agent/monitor-agent /usr/local/bin/monitor-agent
+COPY --chown=1654:1654 --from=build /out/enroll/fleet-enroll /usr/local/bin/fleet-enroll
+COPY --chown=1654:1654 config/ /etc/monitor/
+
+USER 1654:1654
+WORKDIR /etc/monitor
+VOLUME ["/etc/monitor"]
+ENTRYPOINT ["/usr/local/bin/monitor-agent"]
+CMD ["--config", "/etc/monitor/agent.json"]

packaging/container/Probe.Containerfile

@@ -0,0 +1,16 @@
+FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled-extra
+
+ARG APP_VERSION=unknown
+LABEL org.opencontainers.image.title="Monitor Probe" \
+      org.opencontainers.image.description="MyMonitor network measurement probe for Linux" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.version="$APP_VERSION"
+
+COPY --chown=1654:1654 app/monitor-probe /usr/local/bin/monitor-probe
+COPY --chown=1654:1654 config/ /etc/monitor/
+
+USER 1654:1654
+WORKDIR /etc/monitor
+VOLUME ["/etc/monitor"]
+ENTRYPOINT ["/usr/local/bin/monitor-probe"]
+CMD ["--config", "/etc/monitor/probe.json"]

packaging/container/Probe.Fastlane.Containerfile

@@ -0,0 +1,27 @@
+FROM mcr.microsoft.com/dotnet/sdk:10.0-noble-aot AS build
+
+WORKDIR /src/backend
+COPY restore/backend/ ./
+RUN dotnet restore probe/src/Monitor.Probe -r linux-x64 --artifacts-path /artifacts
+
+COPY source/backend/ ./
+RUN dotnet publish probe/src/Monitor.Probe -m:3 -c Release -r linux-x64 \
+    --self-contained true --no-restore -p:PublishAot=true -p:StripSymbols=true \
+    -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/probe
+
+FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled-extra
+
+ARG APP_VERSION=main
+LABEL org.opencontainers.image.title="Monitor Probe" \
+      org.opencontainers.image.description="MyMonitor network measurement probe for Linux" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.version="$APP_VERSION"
+
+COPY --chown=1654:1654 --from=build /out/probe/monitor-probe /usr/local/bin/monitor-probe
+COPY --chown=1654:1654 config/ /etc/monitor/
+
+USER 1654:1654
+WORKDIR /etc/monitor
+VOLUME ["/etc/monitor"]
+ENTRYPOINT ["/usr/local/bin/monitor-probe"]
+CMD ["--config", "/etc/monitor/probe.json"]