## 修的是什么
线上部署卡死过一次:daocloud 加速源返回 502 Bad Gateway,整轮构建在 load metadata
阶段就失败,而服务器 daemon.json 里另外两个 registry-mirrors 完全帮不上忙。
原因是**显式写死的 registry 会绕过 daemon.json 的 registry-mirrors**:
Dockerfile 里 `FROM docker.m.daocloud.io/library/node:...` 属于显式指定 registry,
镜像列表对它就失效了,于是这个源成了构建的单点故障。
## 修法
1. 四个 Dockerfile(backend / frontend / backend-dev / dev-caddy)的 `FROM` 改用
`${BASE_REGISTRY}`(registry 前缀语义),默认值 docker.m.daocloud.io 保持不变;
2. docker-compose.yml / docker-compose.dev.yml 的 `build.args` 接上
`${BASE_REGISTRY:-docker.m.daocloud.io}`,并把 postgres / minio / node / caddy
这几处 `image:` 也改成同一变量,整套编排只有一个换源开关;
3. 部署脚本:新增 resolve_base_registry()(读 .env 的 BASE_REGISTRY,缺省同 compose),
--dry-run 的基础镜像 digest 预检沿用同一变量;
新增 ensure_dockerfile_base_images(),在 pull_base_images 阶段把 Dockerfile 里
`FROM` 用到的基础镜像提前补齐 —— 这类镜像不归 `docker compose pull` 管,
本地缺失要拖到构建阶段才报错,且报错信息晦涩,看不出来是"源挂了"还是"代码写错了";
现在缺失时明确提示并给出换源/离线搬运两条排障路径;
4. .env.server.example 增加 BASE_REGISTRY 说明(推荐多源容灾时设 docker.io,
走 daemon 的 registry-mirrors 列表自动故障转移)。
## 验证
- docker compose config:默认值下所有镜像引用与改动前逐字一致(不会触发重新下载);
BASE_REGISTRY=docker.1panel.live / docker.io 时全部引用正确替换;
- docker buildx build --call=check -f deploy/docker/backend.Dockerfile:Check complete, no warnings;
- deploy/ubuntu-deploy.sh bash -n 通过;
- 生产实测:预拉三个基础镜像后,buildkit 解析基础镜像 1s 命中本地镜像、不再访问远端。
177 lines
6.0 KiB
YAML
177 lines
6.0 KiB
YAML
x-json-log-rotation: &json-log-rotation
|
|
driver: json-file
|
|
options:
|
|
max-size: "20m"
|
|
max-file: "5"
|
|
|
|
services:
|
|
postgres:
|
|
image: ${BASE_REGISTRY:-docker.m.daocloud.io}/library/postgres:16-bookworm
|
|
command:
|
|
[
|
|
"postgres",
|
|
"-c",
|
|
"shared_preload_libraries=pg_stat_statements",
|
|
"-c",
|
|
"pg_stat_statements.track=all",
|
|
"-c",
|
|
"log_min_duration_statement=${POSTGRES_LOG_MIN_DURATION_STATEMENT_MS:-500}",
|
|
"-c",
|
|
"shared_buffers=${POSTGRES_SHARED_BUFFERS:-384MB}",
|
|
"-c",
|
|
"effective_cache_size=${POSTGRES_EFFECTIVE_CACHE_SIZE:-4GB}",
|
|
"-c",
|
|
"work_mem=${POSTGRES_WORK_MEM:-16MB}",
|
|
"-c",
|
|
"maintenance_work_mem=${POSTGRES_MAINTENANCE_WORK_MEM:-256MB}",
|
|
]
|
|
restart: unless-stopped
|
|
mem_limit: ${POSTGRES_MEM_LIMIT:-1.5g}
|
|
cpus: ${POSTGRES_CPUS:-2}
|
|
shm_size: 512mb
|
|
stop_grace_period: 60s
|
|
logging: *json-log-rotation
|
|
environment:
|
|
TZ: ${TZ:-Asia/Shanghai}
|
|
POSTGRES_DB: ${POSTGRES_DB:-order_site}
|
|
POSTGRES_USER: ${POSTGRES_USER:-postgres}
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
|
|
ports:
|
|
- "${POSTGRES_PORT:-5432}:5432"
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD-SHELL",
|
|
"pg_isready -U ${POSTGRES_USER:-postgres} -d ${POSTGRES_DB:-order_site}",
|
|
]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 20
|
|
volumes:
|
|
- postgres_dev_data:/var/lib/postgresql/data
|
|
|
|
minio:
|
|
image: ${BASE_REGISTRY:-docker.m.daocloud.io}/minio/minio:latest
|
|
restart: unless-stopped
|
|
logging: *json-log-rotation
|
|
command: server /data --address ":9000" --console-address ":9001"
|
|
environment:
|
|
TZ: ${TZ:-Asia/Shanghai}
|
|
MINIO_ROOT_USER: ${STORAGE_ACCESS_KEY_ID:-minioadmin}
|
|
MINIO_ROOT_PASSWORD: ${STORAGE_SECRET_ACCESS_KEY:-minioadmin}
|
|
ports:
|
|
- "${MINIO_API_PORT:-19000}:9000"
|
|
- "${MINIO_CONSOLE_PORT:-19001}:9001"
|
|
volumes:
|
|
- minio_dev_data:/data
|
|
|
|
backend:
|
|
build:
|
|
context: .
|
|
dockerfile: deploy/docker/backend-dev.Dockerfile
|
|
args:
|
|
# 基础镜像源(registry 前缀),与生产 compose 同一套语义。
|
|
BASE_REGISTRY: ${BASE_REGISTRY:-docker.m.daocloud.io}
|
|
DEBIAN_MIRROR: ${DEBIAN_MIRROR:-mirrors.aliyun.com}
|
|
NPM_REGISTRY: ${NPM_REGISTRY:-https://registry.npmmirror.com}
|
|
restart: unless-stopped
|
|
env_file:
|
|
- .env
|
|
command: >-
|
|
sh /app/scripts/start-dev-container.sh
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
minio:
|
|
condition: service_started
|
|
healthcheck:
|
|
test:
|
|
["CMD-SHELL", "curl -fsS http://127.0.0.1:3000/health/ready || exit 1"]
|
|
interval: 5s
|
|
timeout: 5s
|
|
retries: 20
|
|
start_period: 20s
|
|
environment:
|
|
TZ: ${TZ:-Asia/Shanghai}
|
|
PORT: ${BACKEND_PORT:-3000}
|
|
HTTP_TRUST_PROXY: ${HTTP_TRUST_PROXY:-1}
|
|
DATABASE_URL: ${DATABASE_URL:-postgres://postgres:postgres@postgres:5432/order_site}
|
|
DATABASE_SSL: ${DATABASE_SSL:-false}
|
|
DATABASE_MAX_CONNECTIONS: ${DATABASE_MAX_CONNECTIONS:-10}
|
|
DATA_ROOT: /app/data
|
|
LOG_RETENTION_DAYS: ${LOG_RETENTION_DAYS:-30}
|
|
LOG_MAX_FILE_SIZE_MB: ${LOG_MAX_FILE_SIZE_MB:-20}
|
|
LOG_MAX_FILES: ${LOG_MAX_FILES:-5}
|
|
CLAIM_BASE_URL: ${CLAIM_BASE_URL:-http://localhost/#/claim}
|
|
STORAGE_MODE: ${STORAGE_MODE:-minio}
|
|
STORAGE_ENDPOINT: ${STORAGE_ENDPOINT:-http://minio:9000}
|
|
STORAGE_BUCKET: ${STORAGE_BUCKET:-order-site}
|
|
STORAGE_ACCESS_KEY_ID: ${STORAGE_ACCESS_KEY_ID:-minioadmin}
|
|
STORAGE_SECRET_ACCESS_KEY: ${STORAGE_SECRET_ACCESS_KEY:-minioadmin}
|
|
STORAGE_REGION: ${STORAGE_REGION:-us-east-1}
|
|
STORAGE_MAX_UPLOAD_SIZE_MB: ${STORAGE_MAX_UPLOAD_SIZE_MB:-10}
|
|
STORAGE_OSS_ENDPOINT: ${STORAGE_OSS_ENDPOINT:-}
|
|
STORAGE_OSS_BUCKET: ${STORAGE_OSS_BUCKET:-}
|
|
STORAGE_OSS_ACCESS_KEY_ID: ${STORAGE_OSS_ACCESS_KEY_ID:-}
|
|
STORAGE_OSS_SECRET_ACCESS_KEY: ${STORAGE_OSS_SECRET_ACCESS_KEY:-}
|
|
STORAGE_OSS_REGION: ${STORAGE_OSS_REGION:-oss-cn-hangzhou}
|
|
WORKSPACE_ROOT: /workspace
|
|
# ADMIN_* 仅走 env_file,避免 JSON 经 ${} 注入时被 YAML 破坏
|
|
KUASHOU_INDUSTRY_RATE_LIMIT_MAX: ${KUASHOU_INDUSTRY_RATE_LIMIT_MAX:-120}
|
|
logging: *json-log-rotation
|
|
volumes:
|
|
- ./apps/backend:/app
|
|
- ./.prettierrc.json:/.prettierrc.json:ro
|
|
- ./.prettierignore:/.prettierignore:ro
|
|
- ./.env.server.example:/workspace/.env.server.example:ro
|
|
- ./.env.mac-docker.example:/workspace/.env.mac-docker.example:ro
|
|
- ./docker-compose.yml:/workspace/docker-compose.yml:ro
|
|
- ./docker-compose.dev.yml:/workspace/docker-compose.dev.yml:ro
|
|
- backend_node_modules:/app/node_modules
|
|
- ./apps/backend/data:/app/data
|
|
|
|
frontend:
|
|
image: ${BASE_REGISTRY:-docker.m.daocloud.io}/library/node:22-bookworm-slim
|
|
working_dir: /app
|
|
restart: unless-stopped
|
|
logging: *json-log-rotation
|
|
command: >-
|
|
sh -lc
|
|
"npm install --no-fund --no-audit;
|
|
npm run dev -- --host 0.0.0.0 --port 5173"
|
|
environment:
|
|
TZ: ${TZ:-Asia/Shanghai}
|
|
CHOKIDAR_USEPOLLING: "true"
|
|
NPM_CONFIG_REGISTRY: https://registry.npmmirror.com
|
|
VITE_API_TARGET: http://backend:3000
|
|
VITE_ALLOWED_HOSTS: ${VITE_ALLOWED_HOSTS:-localhost,127.0.0.1}
|
|
VITE_WORKER_SITE_URL: ${WORKER_SITE_ADDR:-http://worker.localhost}
|
|
volumes:
|
|
- ./apps/frontend:/app
|
|
- ./.prettierrc.json:/.prettierrc.json:ro
|
|
- ./.prettierignore:/.prettierignore:ro
|
|
- frontend_node_modules:/app/node_modules
|
|
|
|
web:
|
|
image: ${BASE_REGISTRY:-docker.m.daocloud.io}/library/caddy:2-alpine
|
|
restart: unless-stopped
|
|
logging: *json-log-rotation
|
|
depends_on:
|
|
backend:
|
|
condition: service_healthy
|
|
frontend:
|
|
condition: service_started
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
environment:
|
|
TZ: ${TZ:-Asia/Shanghai}
|
|
volumes:
|
|
- ./deploy/caddy/Caddyfile.dev:/etc/caddy/Caddyfile:ro
|
|
|
|
volumes:
|
|
postgres_dev_data:
|
|
minio_dev_data:
|
|
backend_node_modules:
|
|
frontend_node_modules:
|