opsx
0936234623
- docker compose up -d 直接启动:entrypoint 在未显式提供密钥时自动生成随机 JWT_SECRET/ENCRYPTION_KEY 并持久化到数据卷 .secrets.env(0600,重启不变), 显式环境变量优先(单显式不被持久化文件覆盖,四场景实测);compose 去掉 :? 强制 - build.sh --dist / make dist:linux amd64 + arm64 两个 tar.gz(二进制+docs+homepage+README), 实测 15M/13M;安装文档重写为三方式(kubernetes/install.sh 一键、compose 一条命令、release 包) - README 快速开始同步
114 lines
3.1 KiB
YAML
114 lines
3.1 KiB
YAML
# ============================================================
|
|
# lokistack - Development Docker Compose Configuration
|
|
# ============================================================
|
|
# P0 Fixes:
|
|
# - Non-root kubeconfig mount (/home/lokistack/.kube)
|
|
# - Healthcheck for orchestration visibility
|
|
# - Resource limits to prevent noisy-neighbor
|
|
# - security_opt: no-new-privileges
|
|
# - Log rotation (json-file driver)
|
|
# - Named volumes instead of bind mounts
|
|
# P1 Fixes:
|
|
# - Restart policy optimization
|
|
# - Network isolation
|
|
# ============================================================
|
|
|
|
services:
|
|
lokistack:
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
args:
|
|
TARGETARCH: ${TARGETARCH:-amd64}
|
|
image: lghost/lokistack:latest
|
|
container_name: lokistack
|
|
hostname: lokistack
|
|
|
|
# ---- P0: Security options ----
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- ALL
|
|
cap_add:
|
|
# Required for healthcheck (wget) and runtime operations
|
|
- NET_BIND_SERVICE
|
|
# Required for file operations in /app/data
|
|
- CHOWN
|
|
- SETGID
|
|
- SETUID
|
|
read_only: false # Dev mode needs writable /app/data
|
|
|
|
ports:
|
|
- "${SERVER_PORT:-8080}:8080"
|
|
|
|
# ---- P0: Named volumes for data persistence ----
|
|
volumes:
|
|
- lokistack-data:/app/data
|
|
# P0: Mount kubeconfig to non-root user directory
|
|
- ${KUBECONFIG_PATH:-${HOME}/.kube}:/home/lokistack/.kube:ro
|
|
# SSH keys for host-based deployments
|
|
- ${SSH_KEY_PATH:-${HOME}/.ssh}:/home/lokistack/.ssh:ro
|
|
|
|
# ---- P0: Environment variables (no default secrets) ----
|
|
environment:
|
|
- SERVER_PORT=8080
|
|
- DATA_DIR=/app/data
|
|
# 密钥零输入启动:不设置时 entrypoint 自动生成随机密钥并持久化到数据卷
|
|
# ($DATA_DIR/.secrets.env);需要固定密钥时在 .env / 环境变量里显式提供。
|
|
- "JWT_SECRET=${JWT_SECRET:-}"
|
|
- "ENCRYPTION_KEY=${ENCRYPTION_KEY:-}"
|
|
# KUBECONFIG points to non-root user's .kube directory
|
|
- KUBECONFIG=/home/lokistack/.kube/config
|
|
|
|
# ---- P0: Healthcheck ----
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost:8080/index.html"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 3
|
|
start_period: 15s
|
|
|
|
# ---- P0: Resource limits ----
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
cpus: '2.0'
|
|
memory: 512M
|
|
pids: 100
|
|
reservations:
|
|
cpus: '0.25'
|
|
memory: 64M
|
|
|
|
# ---- P0: Log rotation ----
|
|
logging:
|
|
driver: "json-file"
|
|
options:
|
|
max-size: "50m"
|
|
max-file: "5"
|
|
labels: "service,image"
|
|
env: "SERVER_PORT,DATA_DIR"
|
|
|
|
# ---- P1: Restart policy ----
|
|
restart: unless-stopped
|
|
stop_grace_period: 15s
|
|
|
|
networks:
|
|
- lokistack-net
|
|
|
|
# ---- Named volumes ----
|
|
volumes:
|
|
lokistack-data:
|
|
driver: local
|
|
labels:
|
|
- "com.lokistack.description=lokistack data directory"
|
|
|
|
# ---- Network isolation ----
|
|
networks:
|
|
lokistack-net:
|
|
driver: bridge
|
|
ipam:
|
|
config:
|
|
- subnet: 172.28.0.0/16
|
|
labels:
|
|
- "com.lokistack.description=lokistack internal network"
|