justme
83e5120377
Namespaces, assemblies, projects and directories, the solution, binaries, images, systemd units, config paths, environment variables, protocol method names, the media type and the raw chunk magic all move to MoShiro/moshiro. Existing data and deployments are not compatible and must be recreated. Also fix the architecture tests after the solution layout change and make the update tests independent of their order.
42 lines
1.3 KiB
YAML
42 lines
1.3 KiB
YAML
# Docker 和 rootless/rootful Podman 共用。配置、身份和缓存保存在命名 volume 中。
|
||
# docker compose up -d / podman compose up -d（Podman 以普通用户执行即可 rootless）。
|
||
# 首次注册、配置导入和自动更新见 docs/deployment.md。
|
||
services:
|
||
agent:
|
||
image: ${MOSHIRO_IMAGE:-registry.oeo.one/moshiro/moshiro-agent}:${MOSHIRO_VERSION:-0.1.1}
|
||
container_name: moshiro-agent
|
||
restart: unless-stopped
|
||
init: true
|
||
# Probe 要直连 Agent 的 7443（TCP+UDP）和 7444（TCP），用宿主网络，不做端口映射
|
||
network_mode: host
|
||
volumes:
|
||
- agent-config:/etc/moshiro
|
||
- agent-status:/etc/moshiro/update-status:ro
|
||
- /etc/os-release:/etc/os-release:ro
|
||
# 系统目录只读，不加 :z/:Z；SELinux 隔离在容器级别禁用。
|
||
- /proc:/host/proc:ro
|
||
- /sys:/host/sys:ro
|
||
- /:/host/root:ro
|
||
environment:
|
||
HOST_PROC: /host/proc
|
||
HOST_SYS: /host/sys
|
||
HOST_ROOT: /host/root
|
||
read_only: true
|
||
tmpfs:
|
||
- /tmp:rw,noexec,nosuid,size=64m,mode=1777
|
||
security_opt:
|
||
- label=disable
|
||
- no-new-privileges:true
|
||
cap_drop:
|
||
- ALL
|
||
# 要做 ICMP 测量时打开：
|
||
# cap_add:
|
||
# - NET_RAW
|
||
stop_grace_period: 20s
|
||
|
||
volumes:
|
||
agent-config:
|
||
name: moshiro-agent-config
|
||
agent-status:
|
||
name: moshiro-agent-status
|