fix(docker): Alpine apk 镜像源 403 时自动回退阿里云/官方

- 新增 scripts/setup-alpine-mirrors.sh 探测可用镜像
- 移除硬编码清华源，runtime 固定 alpine:3.20 避免 latest 漂移

Dockerfile.embed

@@ -38,9 +38,10 @@ ARG TARGETARCH
 
 WORKDIR /app
 
-# 使用国内 Alpine 镜像源加速
+# Alpine 镜像源探测（清华 403 时自动回退阿里云/官方）// Logan.Li
-RUN sed -i 's|dl-cdn.alpinelinux.org|mirrors.tuna.tsinghua.edu.cn|g' /etc/apk/repositories
+COPY scripts/setup-alpine-mirrors.sh /tmp/setup-alpine-mirrors.sh
-RUN apk add --no-cache git ca-certificates tzdata gcc musl-dev
+RUN chmod +x /tmp/setup-alpine-mirrors.sh && /tmp/setup-alpine-mirrors.sh && \
+    apk add --no-cache git ca-certificates tzdata gcc musl-dev
 
 ENV TZ=Asia/Shanghai
 ENV GOPROXY=https://goproxy.cn,direct
@@ -83,24 +84,21 @@ RUN CGO_ENABLED=0 GOOS=linux  GOARCH=amd64 go build -ldflags="-s -w -X main.vers
     CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -ldflags="-s -w -X main.version=${VERSION} -X main.buildTime=${BUILD_TIME}" -o bin/aiops-agent-darwin-arm64 .
 
 # ==================== Stage 4: Runtime ====================
-FROM alpine:latest
+FROM alpine:3.20
 
 ARG TARGETARCH
 ARG KUBECTL_VERSION=v1.32.2
 
-# 使用国内 Alpine 镜像源加速
-RUN sed -i 's|dl-cdn.alpinelinux.org|mirrors.tuna.tsinghua.edu.cn|g' /etc/apk/repositories
-
 # 安装运行时依赖（核心最小集，重型工具改为懒加载）// Logan.Li
 # bash=kubectl交互终端, curl=健康检查, git=流水线代码拉取, docker-cli=镜像构建推送
 # kubectl 按 TARGETARCH 构建时下载（linux/amd64|arm64），无需本地 backend/kubectl // Logan.Li
-RUN apk --no-cache add ca-certificates tzdata bash curl git docker-cli docker-cli-buildx
+COPY scripts/setup-alpine-mirrors.sh scripts/install-kubectl.sh /tmp/
-
+RUN chmod +x /tmp/setup-alpine-mirrors.sh && /tmp/setup-alpine-mirrors.sh && \
-COPY scripts/install-kubectl.sh /tmp/install-kubectl.sh
+    apk --no-cache add ca-certificates tzdata bash curl git docker-cli docker-cli-buildx
 RUN chmod +x /tmp/install-kubectl.sh && \
     TARGET_OS=linux TARGET_ARCH="${TARGETARCH}" KUBECTL_VERSION="${KUBECTL_VERSION}" \
     /tmp/install-kubectl.sh /usr/local/bin/kubectl && \
-    rm -f /tmp/install-kubectl.sh
+    rm -f /tmp/setup-alpine-mirrors.sh /tmp/install-kubectl.sh
 
 # Maven 阿里云镜像加速（maven 懒加载后生效）
 RUN mkdir -p /root/.m2 && \

backend/Dockerfile

@@ -17,9 +17,10 @@ FROM golang:1.24-alpine AS builder
 
 WORKDIR /app
 
-# 使用国内 Alpine 镜像源加速 // Logan.Li
+# Alpine 镜像源探测（清华 403 时自动回退）// Logan.Li
-RUN sed -i 's|dl-cdn.alpinelinux.org|mirrors.tuna.tsinghua.edu.cn|g' /etc/apk/repositories
+COPY scripts/setup-alpine-mirrors.sh /tmp/setup-alpine-mirrors.sh
-RUN apk add --no-cache git ca-certificates tzdata
+RUN chmod +x /tmp/setup-alpine-mirrors.sh && /tmp/setup-alpine-mirrors.sh && \
+    apk add --no-cache git ca-certificates tzdata
 
 ENV TZ=Asia/Shanghai
 ENV GOPROXY=https://goproxy.cn,direct
@@ -80,20 +81,14 @@ FROM alpine:3.20
 ARG TARGETARCH
 ARG KUBECTL_VERSION=v1.32.2
 
-# 使用国内 Alpine 镜像源加速 // Logan.Li
-RUN sed -i 's|dl-cdn.alpinelinux.org|mirrors.tuna.tsinghua.edu.cn|g' /etc/apk/repositories
-
 # 安装运行时依赖（核心最小集，重型工具改为懒加载）// Logan.Li
-# bash=kubectl交互终端, curl=健康检查, git=流水线代码拉取, docker-cli=镜像构建推送
+COPY scripts/setup-alpine-mirrors.sh scripts/install-kubectl.sh /tmp/
-# kubectl 按 TARGETARCH 下载（linux/amd64|arm64）// Logan.Li
+RUN chmod +x /tmp/setup-alpine-mirrors.sh && /tmp/setup-alpine-mirrors.sh && \
-RUN --mount=type=cache,target=/var/cache/apk \
+    apk add --no-cache ca-certificates tzdata bash curl git docker-cli docker-cli-buildx && \
-    apk add ca-certificates tzdata bash curl git docker-cli docker-cli-buildx
+    chmod +x /tmp/install-kubectl.sh && \
-
-COPY scripts/install-kubectl.sh /tmp/install-kubectl.sh
-RUN chmod +x /tmp/install-kubectl.sh && \
     TARGET_OS=linux TARGET_ARCH="${TARGETARCH}" KUBECTL_VERSION="${KUBECTL_VERSION}" \
     /tmp/install-kubectl.sh /usr/local/bin/kubectl && \
-    rm -f /tmp/install-kubectl.sh
+    rm -f /tmp/setup-alpine-mirrors.sh /tmp/install-kubectl.sh
 
 # npm 淘宝镜像加速（node 懒加载后生效）
 RUN npm config set registry https://registry.npmmirror.com 2>/dev/null || true

scripts/setup-alpine-mirrors.sh

@@ -0,0 +1,36 @@
+#!/bin/sh
+# Alpine apk 镜像源：按序探测可用镜像，避免单点 403 // Logan.Li
+set -eu
+
+ALPINE_VER=$(cut -d. -f1,2 /etc/alpine-release)
+ARCH=$(apk --print-arch 2>/dev/null || echo "x86_64")
+
+probe() {
+    local host=$1
+    local url="https://${host}/alpine/v${ALPINE_VER}/main/${ARCH}/APKINDEX.tar.gz"
+    if wget -q --spider "$url" 2>/dev/null; then
+        return 0
+    fi
+    if curl -fsSI --connect-timeout 8 "$url" >/dev/null 2>&1; then
+        return 0
+    fi
+    return 1
+}
+
+write_repos() {
+    local host=$1
+    printf 'https://%s/alpine/v%s/main\nhttps://%s/alpine/v%s/community\n' \
+        "$host" "$ALPINE_VER" "$host" "$ALPINE_VER" > /etc/apk/repositories
+}
+
+for host in mirrors.aliyun.com mirrors.cloud.tencent.com mirrors.ustc.edu.cn dl-cdn.alpinelinux.org; do
+    if probe "$host"; then
+        write_repos "$host"
+        echo "[apk-mirror] alpine v${ALPINE_VER} ${ARCH} -> ${host}"
+        exit 0
+    fi
+    echo "[apk-mirror] skip ${host} (unreachable)" >&2
+done
+
+echo "[apk-mirror] no mirror available for alpine v${ALPINE_VER}" >&2
+exit 1