justme
bac1c27e72
ci/woodpecker/push/main-amd64-build Pipeline was successful
podman-compose does not substitute defaults inside "environment:" (a value
like ${MOSHIRO_NAME:-} reached the node as the literal text), so the node was
enrolled with an invalid name and reported the wrong network scope. The three
compose files now read .env with env_file and only interpolate image and
network_mode; the Backend .env keys are the container's own names
(MoShiro__PublicUrl, MoShiro__ClaimCode).
- The generated .env no longer carries a comment line for MOSHIRO_NAME; the
dialog says how to choose a name instead.
- The container entrypoint prints the name it enrolls with and defaults
MOSHIRO_NETWORK_SCOPE to host (Docker Desktop sets container in .env).
- The overview and line pages say "measurement channel not established"
instead of "not connected": the agent can be reachable and pingable while
the measurement TCP/UDP path is not.
51 lines
2.1 KiB
YAML
51 lines
2.1 KiB
YAML
# MoShiro Agent（Linux，需要宿主网络）。Docker 和 rootless/rootful Podman 共用。
|
||
#
|
||
# 用法（面板「添加 Agent」会给出带好参数的 .env 内容）：
|
||
# mkdir moshiro-agent && cd moshiro-agent
|
||
# 把面板给的 .env 内容存成 .env，再下载本文件为 compose.yaml
|
||
# podman compose up -d # Docker 用 docker compose
|
||
# 更新：podman compose pull && podman compose up -d （身份和配置在命名卷里，不会动）
|
||
# 固定版本：在 .env 里写 MOSHIRO_VERSION=0.3.3；想要更严，写成 MOSHIRO_VERSION=0.3.3@sha256:<digest>。
|
||
# .env 里的 MOSHIRO_SERVER、MOSHIRO_JOIN（只在第一次启动用来注册，之后可以删掉）、MOSHIRO_GENESIS、MOSHIRO_CONTROLLERS、MOSHIRO_NAME 原样传进容器。
|
||
# 说明见 docs/ops/deployment.md。
|
||
services:
|
||
agent:
|
||
image: ${MOSHIRO_IMAGE:-registry.oeo.one/moshiro/moshiro-agent}:${MOSHIRO_VERSION:-latest}
|
||
container_name: moshiro-agent
|
||
restart: unless-stopped
|
||
init: true
|
||
# Probe 要直连 Agent 的 7443（TCP+UDP）和 7444（TCP），用宿主网络，不做端口映射
|
||
network_mode: host
|
||
volumes:
|
||
- agent-config:/etc/moshiro
|
||
- agent-status:/etc/moshiro/update-status:ro
|
||
- /etc/os-release:/etc/os-release:ro
|
||
# 系统目录只读，不加 :z/:Z；SELinux 隔离在容器级别禁用。
|
||
- /proc:/host/proc:ro
|
||
- /sys:/host/sys:ro
|
||
- /:/host/root:ro
|
||
# .env 里的变量原样传进容器（不用带默认值的变量替换：有的 compose 提供者，比如 podman-compose，不替换环境变量里的默认值）
|
||
env_file:
|
||
- .env
|
||
environment:
|
||
MOSHIRO_NETWORK_SCOPE: host
|
||
HOST_PROC: /host/proc
|
||
HOST_SYS: /host/sys
|
||
HOST_ROOT: /host/root
|
||
read_only: true
|
||
tmpfs:
|
||
- /tmp:rw,noexec,nosuid,size=64m,mode=1777
|
||
security_opt:
|
||
- label=disable
|
||
- no-new-privileges:true
|
||
cap_drop:
|
||
- ALL
|
||
# Linux ICMP 使用 ping sockets；ping_group_range 需允许容器映射后的 GID。
|
||
stop_grace_period: 20s
|
||
|
||
volumes:
|
||
agent-config:
|
||
name: moshiro-agent-config
|
||
agent-status:
|
||
name: moshiro-agent-status
|