justme
e014a19554
ci/woodpecker/push/main-amd64-build Pipeline was successful
- Group docs by category with an index (docs/README.md); fix every link, code comment and the protocol conformance test that read docs/protocol.md. - access.md and security.md rewritten to what is implemented: removed the unadopted member-proof chain, roles and recovery key that do not exist, the old implementation order and the budgets; gaps now carry a status. - enrollment, deployment, api: the install flow is the static, hash-checked script with environment variables; no default admin. - README and architecture: new topology and update-flow diagrams (operator passkey, CI signing, registry feed, auth and trust modules).
41 lines
1.4 KiB
YAML
41 lines
1.4 KiB
YAML
# Docker 和 rootless/rootful Podman 共用。配置、身份和缓存保存在命名 volume 中。
|
||
# docker compose up -d / podman compose up -d（Podman 以普通用户执行即可 rootless）。
|
||
# 首次注册、配置导入和自动更新见 docs/ops/deployment.md。
|
||
services:
|
||
agent:
|
||
image: ${MOSHIRO_IMAGE:-registry.oeo.one/moshiro/moshiro-agent}:${MOSHIRO_VERSION:-0.1.1}
|
||
container_name: moshiro-agent
|
||
restart: unless-stopped
|
||
init: true
|
||
# Probe 要直连 Agent 的 7443（TCP+UDP）和 7444（TCP），用宿主网络，不做端口映射
|
||
network_mode: host
|
||
volumes:
|
||
- agent-config:/etc/moshiro
|
||
- agent-status:/etc/moshiro/update-status:ro
|
||
- /etc/os-release:/etc/os-release:ro
|
||
# 系统目录只读，不加 :z/:Z；SELinux 隔离在容器级别禁用。
|
||
- /proc:/host/proc:ro
|
||
- /sys:/host/sys:ro
|
||
- /:/host/root:ro
|
||
environment:
|
||
MOSHIRO_NETWORK_SCOPE: host
|
||
HOST_PROC: /host/proc
|
||
HOST_SYS: /host/sys
|
||
HOST_ROOT: /host/root
|
||
read_only: true
|
||
tmpfs:
|
||
- /tmp:rw,noexec,nosuid,size=64m,mode=1777
|
||
security_opt:
|
||
- label=disable
|
||
- no-new-privileges:true
|
||
cap_drop:
|
||
- ALL
|
||
# Linux ICMP 使用 ping sockets；ping_group_range 需允许容器映射后的 GID。
|
||
stop_grace_period: 20s
|
||
|
||
volumes:
|
||
agent-config:
|
||
name: moshiro-agent-config
|
||
agent-status:
|
||
name: moshiro-agent-status
|