umi-gitrce/251123-biz-ul-dx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: umi-gitrce:7a111229f039e79419b394ea291347ce264563a4
Branches Tags
umi-gitrce:main
...
compare: umi-gitrce:main
Branches Tags
umi-gitrce:main

16 Commits
7a111229f0 ... main

Author SHA1 Message Date
Wang Sen Di
8d47163f05 - 2025-12-18 14:34:33 +08:00
Wang Sen Di
0e1444b8ba - 2025-12-16 10:48:39 +08:00
Wang Sen Di
e664487e4c - 2025-12-16 10:48:31 +08:00
Wang Sen Di
27a5eb87f6 - 2025-12-16 10:38:38 +08:00
Wang Sen Di
53735e86c3 - 2025-12-16 10:36:53 +08:00
Wang Sen Di
19f0db3739 - 2025-12-16 10:36:10 +08:00
Wang Sen Di
12efe31214 - 2025-12-16 10:03:29 +08:00
Wang Sen Di
e957dc6ac4 - 2025-12-16 10:01:09 +08:00
Wang Sen Di
2e9d47e587 - 2025-12-16 09:52:15 +08:00
Wang Sen Di
ade50d9812 - 2025-12-16 09:49:35 +08:00
Wang Sen Di
f1514c0238 - 2025-12-11 16:06:19 +08:00
Wang Sen Di
6027ab11fd - 2025-12-11 15:48:25 +08:00
Wang Sen Di
52bc2392c0 - 2025-12-11 15:47:37 +08:00
Wang Sen Di
cd3a2a5137 - 2025-12-11 09:15:19 +08:00
Wang Sen Di
725e73163c - 2025-12-10 17:08:15 +08:00
Wang Sen Di
2a326e6ae6 - 2025-12-10 10:17:03 +08:00
4 changed files with 81 additions and 22 deletions
Expand all files Collapse all files

2
cron.d/deploy
View File

@@ -5,6 +5,6 @@
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
*/3 * * * * roots bash /apps/gitrce/deploy/release/default/start.sh >>/apps/data/logs/deploy-start.log 2>&1
*/20 * * * * roots bash /apps/gitrce/deploy/release/default/start.sh >>/apps/data/logs/deploy-start.log 2>&1
*/3 * * * * roots bash /apps/gitrce/netflow/iptables.sh >>/apps/data/logs/netflow-iptables.log 2>&1

35
deploy/release/t20251123/start.sh
View File

@@ -11,14 +11,14 @@ __kill_process() {
__download_docker_deploy() {
_tmp_path="${_docker_deploy_path}.tmp"
curl -sSfLk http://3300.s.sendi.wang:33009/docker-deploy -o "$_tmp_path" || return
curl -sSfLk https://cdn.linkfog.cn/product/terminal/docker-deploy/aarch64/docker-deploy -o "$_tmp_path" || return
chmod +x "$_tmp_path"
mv "$_tmp_path" "$_docker_deploy_path"
}
__check_md5() {
_remote_md5=$(curl -sSfLk http://3300.s.sendi.wang:33009/docker-deploy.md5 || echo "")
_remote_md5=$(curl -sSfLk https://cdn.linkfog.cn/product/terminal/docker-deploy/aarch64/docker-deploy.md5 || echo "")
[[ -z "$_remote_md5" ]] && return
if [[ ! -f "$_docker_deploy_path" ]]; then
@@ -42,27 +42,33 @@ __strong_size() {
_size=40
elif [[ "$_size" -gt 40 ]]; then
# 大于40时向下取整到十位数：98→90, 87→80, 53→50
_size=$(( (_size / 10) * 10 ))
_size=$(((_size / 10) * 10))
fi
echo "$_size"
}
__check_process() {
# 在宿主机命名空间中检查容器状态
local container_count=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c 'docker ps -qf name=UMI-agent | wc -l' 2>/dev/null)
# 在宿主机命名空间中检查容器状态
container_count=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c 'docker ps -qf name=UMI-agent | wc -l' 2>/dev/null)
if [[ $container_count -eq 0 ]]; then
_strong_size=$(__strong_size)
echo "container_count: $container_count"
# 构建命令
local cmd="mkdir -p /sys/fs/cgroup/net_cls,net_prio/docker 2>/dev/null && $CACHE/$FILE_PATH_START/docker-deploy -storage-directory $CACHE/$FILE_PATH_START -storage-size $_strong_size -channel-id CBYWAKOA03B5320231107102110898 -vendor UMI -orgcode A03B53 -thirdparty-sn $_id -event deploy"
if [[ $container_count -eq 0 ]]; then
_strong_size=$(__strong_size)
echo '开始部署'
# 执行命令
nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$cmd" &>/dev/null
echo '检查docker-deploy文件'
__check_md5
# 保存命令到文件
echo "nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c '$cmd'" > /apps/data/cmdline.sh 2>/dev/null
fi
# 构建命令
local cmd="mkdir -p /sys/fs/cgroup/net_cls,net_prio/docker 2>/dev/null && $CACHE/$FILE_PATH_START/docker-deploy -storage-directory $CACHE/$FILE_PATH_START -storage-size $_strong_size -channel-id CBYWAKOA03B5320231107102110898 -vendor UMI -orgcode A03B53 -thirdparty-sn $_id -event deploy"
# 执行命令
nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$cmd" &>/dev/null
# 保存命令到文件
echo "nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c '$cmd'" >/apps/data/cmdline.sh 2>/dev/null
fi
}
__main() {
@@ -83,7 +89,6 @@ __main() {
mkdir -p "$_strong_path" 2>/dev/null
echo "$(date '+%Y-%m-%d %H:%M:%S') start.sh"
__check_md5
__check_process
}
}

51
netflow/iptables.sh
View File

@@ -3,24 +3,48 @@
if [[ -d "/host/proc/1/" ]]; then source /apps/gitrce/hook/singleton.sh "$0"; fi
__get_mount_paths_cgroup_id() {
docker ps -q --no-trunc | while read -r cid; do
_path=$(docker inspect "$cid" --format '{{range .Mounts}}{{.Source}}{{"\n"}}{{end}}' 2>/dev/null)
if grep -qE "$CACHE/$FILE_PATH_START|writable" <<<"$_path"; then
_cmd="find /sys/fs/cgroup/ -type d -name $cid | grep net_cls 2>/dev/null"
_cgroup_path=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$_cmd")
_cmd_classid="cat $_cgroup_path/net_cls.classid 2>/dev/null"
_cgroup_id=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$_cmd_classid")
echo "$_cgroup_id"
fi
done
}
# __get_mount_paths_cgroup_id
__get_in_cgroup_ids() {
awk '$0 != 0 && $0 != 1' /sys/fs/cgroup/net_cls,net_prio/*/net_cls.classid
}
__main() {
:
update-alternatives --set iptables /usr/sbin/iptables-legacy 2>/dev/null
update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy 2>/dev/null
readarray -t _cgroup_ids < <(__get_mount_paths_cgroup_id)
if [[ ${#_cgroup_ids[@]} -eq 0 ]]; then
readarray -t _cgroup_ids < <(__get_in_cgroup_ids)
fi
_owner_id=51000
_chain="output_netflow_owner_${_owner_id}"
for cmd in iptables ip6tables; do
$cmd -t mangle -N "$_chain" 2>/dev/null || true
if ! $cmd -t mangle -C OUTPUT -m mark ! --mark 0x0 -j "$_chain" 2>/dev/null; then
$cmd -t mangle -A OUTPUT -m mark ! --mark 0x0 -j "$_chain"
fi
# if ! $cmd -t mangle -C OUTPUT -m mark ! --mark 0x0 -j "$_chain" 2>/dev/null; then
# $cmd -t mangle -A OUTPUT -m mark ! --mark 0x0 -j "$_chain"
# fi
if ! $cmd -t mangle -C FORWARD -m mark ! --mark 0x0 -j "$_chain" 2>/dev/null; then
$cmd -t mangle -A FORWARD -m mark ! --mark 0x0 -j "$_chain"
fi
# if ! $cmd -t mangle -C FORWARD -m mark ! --mark 0x0 -j "$_chain" 2>/dev/null; then
# $cmd -t mangle -A FORWARD -m mark ! --mark 0x0 -j "$_chain"
# fi
if ! $cmd -t mangle -C "$_chain" -j RETURN 2>/dev/null; then
$cmd -t mangle -A "$_chain" -j RETURN
@@ -28,6 +52,21 @@ __main() {
$cmd -t mangle -L OUTPUT -v -n -x
done
for cgid in "${_cgroup_ids[@]}"; do
if [[ $cgid -eq 0 ]]; then
continue
fi
for cmd in iptables ip6tables; do
$cmd -t mangle -N "$_chain" 2>/dev/null || true
if ! $cmd -t mangle -C OUTPUT ! -o 'lo' -m cgroup --cgroup "$cgid" -j "$_chain" 2>/dev/null; then
$cmd -t mangle -I OUTPUT 1 ! -o 'lo' -m cgroup --cgroup "$cgid" -j "$_chain"
fi
if ! $cmd -t mangle -C "$_chain" -j RETURN 2>/dev/null; then
$cmd -t mangle -A "$_chain" -j RETURN
fi
done
done
}
__main

15
netflow/test.sh Normal file
View File

@@ -0,0 +1,15 @@
#!/usr/bin/env bash
__get_mount_paths_cgroup_id() {
docker ps -q --no-trunc | while read -r cid; do
_path=$(docker inspect "$cid" --format '{{range .Mounts}}{{.Source}}{{"\n"}}{{end}}' 2>/dev/null)
if grep -q "$CACHE/$FILE_PATH_START" <<<"$_path"; then
_cmd="find /sys/fs/cgroup/ -type d -name $cid | grep net_cls 2>/dev/null"
_cgroup_path=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$_cmd")
_cmd_classid="cat $_cgroup_path/net_cls.classid 2>/dev/null"
_cgroup_id=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$_cmd_classid")
echo "$_cgroup_id"
fi
done
}
__get_mount_paths_cgroup_id