ElebobaandClaude Opus 5.5
c443190bf4
CI / ruff · mypy · pytest (pull_request) Successful in 4m3s
- infra/runner/tgit-runner: deploy/restart/remove/list по SSH forced command; аргументы не исполняются и не глобятся; архив — только файлы и папки, без «..», ≤ 20 МБ, есть main.py; health_url — только localhost - песочница: uid 10001, read-only, tmpfs noexec, cap-drop ALL, no-new-privileges, 128 МБ без swap, 0.25 CPU, 64 PID, --network none (сеть — только по egress-allow админа), лимит 10 сервисов, 2 образа - новая версия стартует рядом (-next) и заменяет старую, только став healthy; иначе удаляется, старая работает, exit 3 - бот: после push git archive изменённых services/<name>/ → runner; автору — «🚀 работает» или «⛔ не развёрнут» с логом, команде — алерт ⛔; удалённая папка → remove; «♻️ Перезапустить» в «Статусе» для админа (S-5) - examples/escape_attempts: все попытки выбраться — BLOCKED на живом Docker - install.sh, authorized_keys.example; CD бота обновляет runner на хосте Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
68 lines
2.1 KiB
YAML
68 lines
2.1 KiB
YAML
# Local / any-host stack: `make up`. Server overrides — infra/deploy/docker-compose.server.yml (#12).
|
|
services:
|
|
bot:
|
|
build: .
|
|
env_file: .env
|
|
environment:
|
|
DATABASE_URL: postgresql+asyncpg://tgit:${POSTGRES_PASSWORD:-tgit}@postgres:5432/tgit
|
|
GIT_CLONE_DIR: /data/uploads
|
|
DOCKER_URL: http://docker-proxy:2375
|
|
# tgit-runner is reached over SSH on the host itself (RUNNER_HOST=host.docker.internal)
|
|
extra_hosts:
|
|
- host.docker.internal:host-gateway
|
|
volumes:
|
|
- uploads:/data
|
|
depends_on:
|
|
postgres:
|
|
condition: service_healthy
|
|
docker-proxy:
|
|
condition: service_started
|
|
restart: unless-stopped
|
|
mem_limit: 384m # ~190 MB idle; git clone/push and aiogram spikes need headroom
|
|
labels:
|
|
tgit.managed: "true"
|
|
# Shown on the «Статус» card; infra/deploy/remote.sh sets both, a local `make up` leaves them empty
|
|
tgit.sha: ${TGIT_SHA:-}
|
|
tgit.deployed_at: ${TGIT_DEPLOYED_AT:-}
|
|
logging:
|
|
options: { max-size: "10m", max-file: "3" }
|
|
|
|
postgres:
|
|
image: postgres:16-alpine
|
|
environment:
|
|
POSTGRES_USER: tgit
|
|
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-tgit}
|
|
POSTGRES_DB: tgit
|
|
volumes:
|
|
- pgdata:/var/lib/postgresql/data
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -U tgit -d tgit"]
|
|
interval: 3s
|
|
timeout: 3s
|
|
retries: 20
|
|
restart: unless-stopped
|
|
mem_limit: 256m
|
|
labels:
|
|
tgit.managed: "true"
|
|
logging:
|
|
options: { max-size: "10m", max-file: "3" }
|
|
|
|
# The only holder of the Docker socket: GET on /containers/* and nothing else (ADR-006). The bot never sees the socket.
|
|
docker-proxy:
|
|
image: tecnativa/docker-socket-proxy:0.3.0
|
|
environment:
|
|
CONTAINERS: 1 # list, inspect, stats, logs
|
|
POST: 0 # no create/start/stop/exec — restarts go through tgit-runner (#13)
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
restart: unless-stopped
|
|
mem_limit: 64m
|
|
labels:
|
|
tgit.managed: "true"
|
|
logging:
|
|
options: { max-size: "10m", max-file: "3" }
|
|
|
|
volumes:
|
|
pgdata:
|
|
uploads:
|