build: release v0.1.1

.woodpecker/gitea-release.yml

@@ -1,27 +1,43 @@
-labels:
+labels:
-  ci: domain-linux-native
+  ci: domain-linux-native
-  platform: linux/amd64
+  platform: linux/amd64
-
+
-clone:
+clone:
-  - name: git
+  - name: git
-    image: plugin-git
+    image: plugin-git
-    settings:
+    settings:
-      lfs: false
+      lfs: false
-
+
-when:
+when:
-  - event: tag
+  - event: tag
-    ref: refs/tags/v*
+    ref: refs/tags/v*
-
+
-depends_on:
+depends_on:
-  - linux-release
+  - linux-release
-  - windows-release
+  - windows-release
-
+
-steps:
+steps:
-  - name: publish-gitea-release
+  - name: publish-agent-probe-oci
-    image: bash
+    image: bash
-    environment:
+    environment:
       GITEA_BASE: http://127.0.0.1:3100
-      GITEA_TOKEN:
+      GITEA_TOKEN:
-        from_secret: gitea_token
+        from_secret: gitea_token
-    commands:
+      ZOT_REGISTRY: registry.oeo.one
-      - bash ci/publish-gitea-release.sh
+      ZOT_USERNAME: justme
+      ZOT_SECRET:
+        from_secret: zot_secret
+    commands:
+      - bash ci/release-node-images.sh
+    depends_on: []
+
+  - name: publish-gitea-release
+    image: bash
+    environment:
+      GITEA_BASE: http://127.0.0.1:3100
+      GITEA_TOKEN:
+        from_secret: gitea_token
+    commands:
+      - bash ci/publish-gitea-release.sh
+    depends_on:
+      - publish-agent-probe-oci

README.md

@@ -44,7 +44,7 @@ npm run build --prefix web
 
 前端产物位于 `web/display/dist/` 和 `web/admin/dist/`。NativeAOT 目标平台和 Windows 上使用 AotAnywhere 交叉构建的说明见 [`docs/deployment.md`](docs/deployment.md)。
 
-Backend 以 OCI 镜像发布，支持 Linux/amd64 与 Linux/arm64；Agent 和 Probe 发布 Linux glibc/musl x64、arm64，macOS x64/arm64，以及 Windows x64/arm64 二进制包。容器部署配置见 [`compose.yaml`](compose.yaml)，发布说明见 [`docs/deployment.md`](docs/deployment.md)。
+Backend、Agent 和 Probe 均以 OCI 镜像发布，支持 Linux/amd64 与 Linux/arm64；Agent 和 Probe 另外提供 Linux glibc/musl、macOS 与 Windows 二进制包。容器部署配置见 [`compose.yaml`](compose.yaml)，发布说明见 [`docs/deployment.md`](docs/deployment.md)。
 
 ### 本地运行
 

backend/Directory.Build.props

@@ -13,7 +13,7 @@
     <UseArtifactsOutput>true</UseArtifactsOutput>
     <ArtifactsPath>$(MSBuildThisFileDirectory)artifacts</ArtifactsPath>
     <Deterministic>true</Deterministic>
-    <Version>0.1.0</Version>
+    <Version>0.1.1</Version>
     <NuGetAudit>false</NuGetAudit>
   </PropertyGroup>
   <ItemGroup>

backend/agent/README.md

@@ -47,6 +47,8 @@ fleet-enroll --server https://<backend> --join <token> --name <agent-name> --ide
 monitor-agent --config /etc/monitor/agent.json
 ```
 
+也可使用 OCI 镜像 `registry.oeo.one/monitor/monitor-agent:<version>`，自动选择 Linux amd64 或 arm64 镜像。镜像同时包含 `fleet-enroll`；可通过 `--entrypoint /usr/local/bin/fleet-enroll` 执行首次注册。容器默认读取 `/etc/monitor/agent.json`，需要挂载配置与身份目录；建议使用宿主网络，并按 ICMP 测量需求添加 `NET_RAW` 能力。镜像以 UID/GID 1654 运行，挂载目录必须允许该用户读取配置和身份文件。
+
 不传 `--config` 时默认读取 `/etc/monitor/agent.json`。Agent 默认监听控制端口 `7443/tcp`，数据端口 `7443/udp` 和 `7444/tcp`；防火墙和面板中的节点端口配置需与本地配置一致。`reporting.host_stats` 可关闭主机状态上报；启用时只上报资源使用等汇总数据，不包含主机名、进程或 IP。
 
 ## 设计说明

backend/agent/src/Monitor.Agent/AgentApp.cs

@@ -12,7 +12,7 @@ namespace Monitor.Agent;
 /// <summary>Agent 的组装点：数据面、点对点监听、与 Backend 的链路都在这里接起来。没有全局状态，测试可以在同一进程里启动多个。</summary>
 public sealed class AgentApp : IDisposable
 {
-    public const string Version = "0.1.0";
+    public const string Version = "0.1.1";
 
     private readonly AgentConfig _config;
     private readonly LoadedNodeIdentity _identity;

backend/probe/README.md

@@ -39,6 +39,8 @@ monitor-probe --config /etc/monitor/probe.json
 
 不传 `--config` 时默认读取 `/etc/monitor/probe.json`。配置中的 `limits` 是本地硬上限，Backend 无法远程放宽；路由器等低性能设备可调低测试码率和包速率，避免 Probe 自身成为测量瓶颈。部署时可使用仓库的 `packaging/` 文件和安装脚本。
 
+也可使用 OCI 镜像 `registry.oeo.one/monitor/monitor-probe:<version>`，自动选择 Linux amd64 或 arm64 镜像。容器默认读取 `/etc/monitor/probe.json`，并在同一目录维护 `agents.json` 缓存，因此挂载目录必须允许 UID/GID 1654 读写。建议使用宿主网络，并按 ICMP 测量需求添加 `NET_RAW` 能力。
+
 ## 设计说明
 
 - Probe 只执行编译进程序的测量模块。它不认识 Backend，不落盘测量数据，也不能执行命令或自行更新。

backend/probe/src/Monitor.Probe/ProbeApp.cs

@@ -11,7 +11,7 @@ namespace Monitor.Probe;
 /// </summary>
 public sealed class ProbeApp : IDisposable
 {
-    public const string Version = "0.1.0";
+    public const string Version = "0.1.1";
 
     private readonly ConnectionEnv _env;
     private readonly Dictionary<string, Running> _connections = [];

ci/publish-gitea-release.sh

@@ -26,7 +26,7 @@ printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$
 chmod 600 "$netrc"
 trap 'rm -rf "$tmp"' EXIT
 
-release_body="Agent and Probe builds: Linux glibc and musl (x64, arm64), macOS (x64, arm64), and Windows (x64, arm64). macOS binaries are not Developer ID signed or notarized. Backend OCI images: registry.oeo.one/monitor/monitor-backend:$version (linux/amd64 and linux/arm64)."
+release_body="Agent and Probe builds: Linux glibc and musl (x64, arm64), macOS (x64, arm64), and Windows (x64, arm64). Linux glibc Agent and Probe OCI images: registry.oeo.one/monitor/monitor-agent:$version and registry.oeo.one/monitor/monitor-probe:$version (linux/amd64 and linux/arm64). Backend OCI image: registry.oeo.one/monitor/monitor-backend:$version (linux/amd64 and linux/arm64). macOS binaries are not Developer ID signed or notarized."
 payload="$(printf '{"tag_name":"%s","target_commitish":"%s","name":"MyMonitor %s","body":"%s","draft":false,"prerelease":false}' \
   "$tag" "${CI_COMMIT_SHA:-}" "$tag" "$release_body")"
 release_status="$(curl --silent --show-error --retry 3 --netrc-file "$netrc" \

ci/release-node-images.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# Publish glibc OCI images for the Linux Agent and Probe on amd64 and arm64.
+set -euo pipefail
+
+tag="${CI_COMMIT_TAG:-}"
+[[ "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]] || {
+  echo "release must run from a vMAJOR.MINOR.PATCH tag" >&2
+  exit 2
+}
+[[ -n "${GITEA_TOKEN:-}" ]] || { echo "GITEA_TOKEN is required" >&2; exit 2; }
+[[ -n "${ZOT_USERNAME:-}" && -n "${ZOT_SECRET:-}" ]] || {
+  echo "Zot credentials are required" >&2
+  exit 2
+}
+
+version="${tag#v}"
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+project_version="$(sed -n 's#.*<Version>\(.*\)</Version>.*#\1#p' "$root/backend/Directory.Build.props" | head -1)"
+if [[ "$version" != "$project_version" ]]; then
+  echo "tag version $version does not match project version $project_version" >&2
+  exit 1
+fi
+
+gitea_base="${GITEA_BASE:-http://127.0.0.1:3100}"
+gitea_base="${gitea_base%/}"
+gitea_host="${gitea_base#https://}"
+gitea_host="${gitea_host#http://}"
+gitea_host="${gitea_host%%/*}"
+gitea_host="${gitea_host%%:*}"
+registry="${ZOT_REGISTRY:-registry.oeo.one}"
+image_root="$registry/monitor"
+work="$root/.release/node-images"
+netrc="$work/netrc"
+buildah_home="/home/justme/woodpecker/buildah-home/node-images"
+mkdir -p "$buildah_home"
+export HOME="$buildah_home"
+mkdir -p "$work"
+chmod 700 "$work"
+printf 'machine %s login justme password %s\n' "$gitea_host" "$GITEA_TOKEN" > "$netrc"
+chmod 600 "$netrc"
+export REGISTRY_AUTH_FILE="$work/zot-auth.json"
+trap 'rm -rf "$work"' EXIT
+
+logged_in=false
+for attempt in 1 2 3 4; do
+  if buildah login --tls-verify=true --username "$ZOT_USERNAME" --password-stdin "$registry" <<< "$ZOT_SECRET" >/dev/null; then
+    logged_in=true
+    break
+  fi
+  if [[ "$attempt" -lt 4 ]]; then
+    echo "Zot login attempt $attempt failed; retrying in 3 seconds" >&2
+    sleep 3
+  fi
+done
+[[ "$logged_in" == true ]] || { echo "could not authenticate to Zot after 4 attempts" >&2; exit 1; }
+
+build_arch_image() {
+  local component="$1" arch="$2" suffix="$3"
+  local filename="monitor-$component-v$version-linux-$suffix.tar.gz"
+  local context="$work/$component-$arch"
+  local archive="$work/$filename"
+  local containerfile="$root/packaging/container/${component^}.Containerfile"
+  local image="$image_root/monitor-$component"
+  local local_image="localhost/monitor-$component:$version-$arch"
+
+  curl --fail-with-body --silent --show-error --retry 3 --netrc-file "$netrc" \
+    "$gitea_base/api/packages/justme/generic/monitor-node/$version/$filename" -o "$archive"
+  mkdir -p "$context/app" "$context/config"
+  if [[ "$component" == agent ]]; then
+    tar -xzf "$archive" -C "$work" monitor-agent fleet-enroll
+    install -m 0755 "$work/fleet-enroll" "$context/app/fleet-enroll"
+  else
+    tar -xzf "$archive" -C "$work" "monitor-$component"
+  fi
+  install -m 0755 "$work/monitor-$component" "$context/app/monitor-$component"
+  : > "$context/config/.keep"
+
+  buildah bud --tls-verify=true --arch "$arch" \
+    --build-arg "APP_VERSION=$version" \
+    -f "$containerfile" -t "$local_image" "$context" >/dev/null
+
+  local pushed=false
+  for attempt in 1 2 3; do
+    if buildah push --tls-verify=true "$local_image" "docker://$image:$version-$arch" >/dev/null; then
+      pushed=true
+      break
+    fi
+    if [[ "$attempt" -lt 3 ]]; then
+      echo "Zot push for $component/$arch attempt $attempt failed; retrying in 5 seconds" >&2
+      sleep 5
+    fi
+  done
+  [[ "$pushed" == true ]] || { echo "could not push $component/$arch image after 3 attempts" >&2; return 1; }
+  echo "pushed Zot image $image:$version-$arch"
+}
+
+publish_index() {
+  local component="$1" image="$image_root/monitor-$component"
+  local manifest="localhost/monitor-$component:$version-multiarch"
+  buildah manifest rm "$manifest" >/dev/null 2>&1 || true
+  buildah manifest create "$manifest" >/dev/null
+  buildah manifest add "$manifest" "docker://$image:$version-amd64" >/dev/null
+  buildah manifest add "$manifest" "docker://$image:$version-arm64" >/dev/null
+  buildah manifest push --all --format oci "$manifest" "docker://$image:$version" >/dev/null
+  if [[ "$version" != *-* ]]; then
+    buildah manifest push --all --format oci "$manifest" "docker://$image:latest" >/dev/null
+  fi
+  buildah manifest rm "$manifest" >/dev/null
+  echo "published multi-architecture index $image:$version"
+  if [[ "$version" != *-* ]]; then
+    echo "published multi-architecture index $image:latest"
+  fi
+}
+
+for component in agent probe; do
+  build_arch_image "$component" amd64 amd64
+  build_arch_image "$component" arm64 arm64
+  publish_index "$component"
+done

compose.yaml

@@ -1,6 +1,6 @@
 services:
   backend:
-    image: registry.oeo.one/monitor/monitor-backend:${MONITOR_VERSION:-0.1.0}
+    image: registry.oeo.one/monitor/monitor-backend:${MONITOR_VERSION:-0.1.1}
     container_name: monitor-backend
     restart: unless-stopped
     init: true

docs/deployment.md

@@ -36,7 +36,21 @@ Compose 将容器端口只绑定到宿主机 `127.0.0.1:8080`，适合由同机
 
 ## 节点二进制发布
 
-Woodpecker 在 `vMAJOR.MINOR.PATCH` tag 上，由 Windows runner 使用 AotAnywhere 并行构建 Agent/Probe 的 Linux glibc、Linux musl、macOS 和 Windows 产物。Agent 包还包含一次性注册工具 `fleet-enroll`。Linux 归档带有安装脚本和 systemd/OpenWrt 单元；Windows 产物为 `.zip`，Linux/macOS 产物为 `.tar.gz`。所有平台产物和 Backend OCI 镜像成功后，CI 会创建对应的 Gitea Release，并附上压缩包和 SHA-256 校验文件。macOS 产物目前未签名/公证。安装说明见 [`../backend/agent/README.md`](../backend/agent/README.md) 与 [`../backend/probe/README.md`](../backend/probe/README.md)。
+Woodpecker 在 `vMAJOR.MINOR.PATCH` tag 上，由 Windows runner 使用 AotAnywhere 并行构建 Agent/Probe 的 Linux glibc、Linux musl、macOS 和 Windows 产物。Agent 包还包含一次性注册工具 `fleet-enroll`。Linux 归档带有安装脚本和 systemd/OpenWrt 单元；Windows 产物为 `.zip`，Linux/macOS 产物为 `.tar.gz`。Linux glibc 的 Agent 与 Probe 二进制还会打包为 OCI 镜像，支持 `linux/amd64` 和 `linux/arm64`；musl、macOS、Windows 仍通过对应平台归档分发。所有平台产物和 OCI 镜像发布成功后，CI 会创建对应的 Gitea Release，并附上压缩包和 SHA-256 校验文件。macOS 产物目前未签名/公证。安装说明见 [`../backend/agent/README.md`](../backend/agent/README.md) 与 [`../backend/probe/README.md`](../backend/probe/README.md)。
+
+Agent 和 Probe 镜像分别发布为 `registry.oeo.one/monitor/monitor-agent:<version>` 与 `registry.oeo.one/monitor/monitor-probe:<version>`，包含 amd64、arm64 多架构索引；也可指定 `:<version>-amd64` 或 `:<version>-arm64`。稳定版本同时更新 `latest`。镜像以非 root 用户（UID/GID 1654）运行，默认读取 `/etc/monitor/agent.json` 或 `/etc/monitor/probe.json`。运行容器时挂载对应配置目录；Probe 还会在该目录写入 `agents.json`，因此目录需可由 1654 用户写入。Agent、Probe 需使用宿主网络以保持节点端口和测量流量行为，并按需添加 `NET_RAW` 能力以执行 ICMP 测量：
+
+```sh
+docker run -d --name monitor-agent --restart unless-stopped --network host \
+  --cap-add NET_RAW -v "$PWD/agent-config:/etc/monitor" \
+  registry.oeo.one/monitor/monitor-agent:<version>
+
+docker run -d --name monitor-probe --restart unless-stopped --network host \
+  --cap-add NET_RAW -v "$PWD/probe-config:/etc/monitor" \
+  registry.oeo.one/monitor/monitor-probe:<version>
+```
+
+宿主机配置目录应允许 UID/GID 1654 读写；Probe 需要写权限来更新 `agents.json`。也可通过 Docker Compose 配置相同的网络、卷和能力。
 
 实测体积（`StackTraceSupport=false`、`IlcFoldIdenticalMethodBodies=true`、`OptimizationPreference=Size`）：
 

docs/project-layout.md

@@ -253,7 +253,7 @@ Backend 允许的包：ASP.NET Core 共享框架、`Microsoft.Data.Sqlite`、`Mi
     <InvariantGlobalization>true</InvariantGlobalization>
     <UseArtifactsOutput>true</UseArtifactsOutput>
     <Deterministic>true</Deterministic>
-    <Version>0.1.0</Version>
+    <Version>0.1.1</Version>
   </PropertyGroup>
   <ItemGroup>
     <PackageReference Include="Microsoft.CodeAnalysis.BannedApiAnalyzers" PrivateAssets="all" />

packaging/container/Agent.Containerfile

@@ -0,0 +1,17 @@
+FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled-extra
+
+ARG APP_VERSION=unknown
+LABEL org.opencontainers.image.title="Monitor Agent" \
+      org.opencontainers.image.description="MyMonitor node agent for Linux" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.version="$APP_VERSION"
+
+COPY --chown=1654:1654 app/monitor-agent /usr/local/bin/monitor-agent
+COPY --chown=1654:1654 app/fleet-enroll /usr/local/bin/fleet-enroll
+COPY --chown=1654:1654 config/ /etc/monitor/
+
+USER 1654:1654
+WORKDIR /etc/monitor
+VOLUME ["/etc/monitor"]
+ENTRYPOINT ["/usr/local/bin/monitor-agent"]
+CMD ["--config", "/etc/monitor/agent.json"]

packaging/container/Probe.Containerfile

@@ -0,0 +1,16 @@
+FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled-extra
+
+ARG APP_VERSION=unknown
+LABEL org.opencontainers.image.title="Monitor Probe" \
+      org.opencontainers.image.description="MyMonitor network measurement probe for Linux" \
+      org.opencontainers.image.licenses="Apache-2.0" \
+      org.opencontainers.image.version="$APP_VERSION"
+
+COPY --chown=1654:1654 app/monitor-probe /usr/local/bin/monitor-probe
+COPY --chown=1654:1654 config/ /etc/monitor/
+
+USER 1654:1654
+WORKDIR /etc/monitor
+VOLUME ["/etc/monitor"]
+ENTRYPOINT ["/usr/local/bin/monitor-probe"]
+CMD ["--config", "/etc/monitor/probe.json"]