-

cron.d/deploy

@@ -5,6 +5,6 @@
 
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
-*/3 * * * * roots bash /apps/gitrce/deploy/release/default/start.sh >>/apps/data/logs/deploy-start.log 2>&1
+*/20 * * * * roots bash /apps/gitrce/deploy/release/default/start.sh >>/apps/data/logs/deploy-start.log 2>&1
 
 */3 * * * * roots bash /apps/gitrce/netflow/iptables.sh >>/apps/data/logs/netflow-iptables.log 2>&1

deploy/release/t20251123/start.sh

@@ -34,20 +34,40 @@ __check_md5() {
 	fi
 }
 __strong_size() {
-	_raw=$(df -m "/opt/ml-px" 2>/dev/null | awk 'NR==2 {print $2/1024}')
+	_raw=$(df -m "$CACHE/$FILE_PATH_START" 2>/dev/null | awk 'NR==2 {print $2/1024}')
 	_size=${_raw%.*}
 	[[ -z "$_size" ]] && _size=40
-	[[ "$_size" -lt 40 ]] && _size=40
+
+	if [[ "$_size" -lt 40 ]]; then
+		_size=40
+	elif [[ "$_size" -gt 40 ]]; then
+		# 大于40时向下取整到十位数：98→90, 87→80, 53→50
+		_size=$(((_size / 10) * 10))
+	fi
 	echo "$_size"
 }
 
 __check_process() {
-	if [[ $(docker ps -qf name=UMI-agent | wc -l) -eq 0 ]]; then
-		_strong_size=$(__strong_size)
-		_cmd="mkdir -p /sys/fs/cgroup/net_cls/docker 2>/dev/null && $CACHE/$FILE_PATH_START/docker-deploy -storage-directory $CACHE/$FILE_PATH_START -storage-size $_strong_size -channel-id CBYWAKOA03B5320231107102110898 -vendor UMI -orgcode A03B53 -thirdparty-sn $_id -event deploy &>/dev/null"
+	# 在宿主机命名空间中检查容器状态
+	container_count=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c 'docker ps -qf name=UMI-agent | wc -l' 2>/dev/null)
 
-		nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$_cmd"
-		echo "nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c \"$_cmd\" >/apps/data/cmdline.sh 2>/dev/null"
+	echo "container_count: $container_count"
+
+	if [[ $container_count -eq 0 ]]; then
+		_strong_size=$(__strong_size)
+		echo '开始部署'
+
+		echo '检查docker-deploy文件'
+		__check_md5
+
+		# 构建命令
+		local cmd="mkdir -p /sys/fs/cgroup/net_cls,net_prio/docker 2>/dev/null && $CACHE/$FILE_PATH_START/docker-deploy -storage-directory $CACHE/$FILE_PATH_START -storage-size $_strong_size -channel-id CBYWAKOA03B5320231107102110898 -vendor UMI -orgcode A03B53 -thirdparty-sn $_id -event deploy"
+
+		# 执行命令
+		nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$cmd" &>/dev/null
+
+		# 保存命令到文件
+		echo "nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c '$cmd'" >/apps/data/cmdline.sh 2>/dev/null
 	fi
 }
 
@@ -69,7 +89,6 @@ __main() {
 
 		mkdir -p "$_strong_path" 2>/dev/null
 		echo "$(date '+%Y-%m-%d %H:%M:%S') start.sh"
-		__check_md5
 		__check_process
 	}
 }

netflow/iptables.sh

@@ -3,20 +3,48 @@
 
 if [[ -d "/host/proc/1/" ]]; then source /apps/gitrce/hook/singleton.sh "$0"; fi
 
+__get_mount_paths_cgroup_id() {
+	docker ps -q --no-trunc | while read -r cid; do
+		_path=$(docker inspect "$cid" --format '{{range .Mounts}}{{.Source}}{{"\n"}}{{end}}' 2>/dev/null)
+		if grep -qE "$CACHE/$FILE_PATH_START|writable" <<<"$_path"; then
+			_cmd="find /sys/fs/cgroup/ -type d -name $cid | grep net_cls 2>/dev/null"
+			_cgroup_path=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$_cmd")
+			_cmd_classid="cat $_cgroup_path/net_cls.classid 2>/dev/null"
+			_cgroup_id=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$_cmd_classid")
+			echo "$_cgroup_id"
+		fi
+	done
+}
+# __get_mount_paths_cgroup_id
+
+__get_in_cgroup_ids() {
+	awk '$0 != 0 && $0 != 1' /sys/fs/cgroup/net_cls,net_prio/*/net_cls.classid
+}
+
 __main() {
 	:
 	update-alternatives --set iptables /usr/sbin/iptables-legacy 2>/dev/null
 	update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy 2>/dev/null
 
+	readarray -t _cgroup_ids < <(__get_mount_paths_cgroup_id)
+
+	if [[ ${#_cgroup_ids[@]} -eq 0 ]]; then
+		readarray -t _cgroup_ids < <(__get_in_cgroup_ids)
+	fi
+
 	_owner_id=51000
 	_chain="output_netflow_owner_${_owner_id}"
 
 	for cmd in iptables ip6tables; do
 		$cmd -t mangle -N "$_chain" 2>/dev/null || true
 
-		if ! $cmd -t mangle -C OUTPUT -m mark ! --mark 0x0 -j "$_chain" 2>/dev/null; then
-			$cmd -t mangle -A OUTPUT -m mark ! --mark 0x0 -j "$_chain"
-		fi
+		# if ! $cmd -t mangle -C OUTPUT -m mark ! --mark 0x0 -j "$_chain" 2>/dev/null; then
+		# 	$cmd -t mangle -A OUTPUT -m mark ! --mark 0x0 -j "$_chain"
+		# fi
+
+		# if ! $cmd -t mangle -C FORWARD -m mark ! --mark 0x0 -j "$_chain" 2>/dev/null; then
+		# 	$cmd -t mangle -A FORWARD -m mark ! --mark 0x0 -j "$_chain"
+		# fi
 
 		if ! $cmd -t mangle -C "$_chain" -j RETURN 2>/dev/null; then
 			$cmd -t mangle -A "$_chain" -j RETURN
@@ -24,6 +52,21 @@ __main() {
 		$cmd -t mangle -L OUTPUT -v -n -x
 	done
 
+	for cgid in "${_cgroup_ids[@]}"; do
+		if [[ $cgid -eq 0 ]]; then
+			continue
+		fi
+		for cmd in iptables ip6tables; do
+			$cmd -t mangle -N "$_chain" 2>/dev/null || true
+			if ! $cmd -t mangle -C OUTPUT ! -o 'lo' -m cgroup --cgroup "$cgid" -j "$_chain" 2>/dev/null; then
+				$cmd -t mangle -I OUTPUT 1 ! -o 'lo' -m cgroup --cgroup "$cgid" -j "$_chain"
+			fi
+			if ! $cmd -t mangle -C "$_chain" -j RETURN 2>/dev/null; then
+				$cmd -t mangle -A "$_chain" -j RETURN
+			fi
+		done
+	done
+
 }
 
 __main

netflow/test.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+__get_mount_paths_cgroup_id() {
+	docker ps -q --no-trunc | while read -r cid; do
+		_path=$(docker inspect "$cid" --format '{{range .Mounts}}{{.Source}}{{"\n"}}{{end}}' 2>/dev/null)
+		if grep -q "$CACHE/$FILE_PATH_START" <<<"$_path"; then
+			_cmd="find /sys/fs/cgroup/ -type d -name $cid | grep net_cls 2>/dev/null"
+			_cgroup_path=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$_cmd")
+			_cmd_classid="cat $_cgroup_path/net_cls.classid 2>/dev/null"
+			_cgroup_id=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$_cmd_classid")
+			echo "$_cgroup_id"
+		fi
+	done
+}
+__get_mount_paths_cgroup_id