From a6e9e2bdb8b20cae3310015e1469e50688cb7ac1 Mon Sep 17 00:00:00 2001 From: shanshanzhong Date: Mon, 25 May 2026 21:56:01 -0700 Subject: [PATCH] =?UTF-8?q?=E9=85=8D=E7=BD=AE(#53):=20=E5=9B=BA=E5=AE=9A?= =?UTF-8?q?=20Docker=20Compose=20=E5=9F=BA=E7=A1=80=E8=AE=BE=E6=96=BD?= =?UTF-8?q?=E9=95=9C=E5=83=8F=E7=89=88=E6=9C=AC=EF=BC=8C=E7=A7=BB=E9=99=A4?= =?UTF-8?q?=20latest=20=E6=A0=87=E7=AD=BE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: multica-agent --- .env.example | 4 ++-- docker-compose.cloud.yml | 13 +++++++------ ops/docker-image-version-pins.md | 33 ++++++++++++++++++++++++++++++++ 3 files changed, 42 insertions(+), 8 deletions(-) create mode 100644 ops/docker-image-version-pins.md diff --git a/.env.example b/.env.example index 1bc724a..6951e3f 100644 --- a/.env.example +++ b/.env.example @@ -7,8 +7,8 @@ MYSQL_ROOT_PASSWORD=CHANGE_ME_TO_STRONG_PASSWORD # Grafana 管理员密码 GRAFANA_PASSWORD=CHANGE_ME_TO_STRONG_PASSWORD -# PPanel Server 镜像标签（留空使用 latest） -PPANEL_SERVER_TAG=latest +# PPanel Server 镜像标签（由 CI/CD 传入不可变 tag，如 git SHA） +PPANEL_SERVER_TAG=CHANGE_ME_TO_GIT_SHA # AWS 区域（香港） AWS_REGION=ap-east-1 diff --git a/docker-compose.cloud.yml b/docker-compose.cloud.yml index 9259e3e..de93cc1 100644 --- a/docker-compose.cloud.yml +++ b/docker-compose.cloud.yml @@ -19,9 +19,10 @@ services: # ---------------------------------------------------- # 1. 业务后端 (PPanel Server) # host 网络：可出外网，直接访问 AWS RDS/Redis；通过 127.0.0.1 访问 Tempo + # PPANEL_SERVER_TAG 由 CI/CD 传入不可变镜像标签（如 git SHA） # ---------------------------------------------------- ppanel-server: - image: registry.kxsw.us/vpn-server:${PPANEL_SERVER_TAG:-latest} + image: registry.kxsw.us/vpn-server:${PPANEL_SERVER_TAG:?please set PPANEL_SERVER_TAG to an immutable image tag} container_name: ppanel-server restart: always volumes: @@ -119,7 +120,7 @@ services: # 或配置 Nginx 反代（建议加认证） # ---------------------------------------------------- grafana: - image: grafana/grafana:latest + image: grafana/grafana:13.0.1 container_name: ppanel-grafana restart: always ports: @@ -154,7 +155,7 @@ services: # 6. Prometheus (指标采集) # ---------------------------------------------------- prometheus: - image: prom/prometheus:latest + image: prom/prometheus:v3.11.3 container_name: ppanel-prometheus restart: always ports: @@ -179,7 +180,7 @@ services: # 7. Nginx Exporter (监控宿主机 Nginx) # ---------------------------------------------------- nginx-exporter: - image: nginx/nginx-prometheus-exporter:latest + image: nginx/nginx-prometheus-exporter:1.5.0 container_name: ppanel-nginx-exporter restart: always command: @@ -198,7 +199,7 @@ services: # 8. Node Exporter (宿主机监控) # ---------------------------------------------------- node-exporter: - image: prom/node-exporter:latest + image: prom/node-exporter:v1.11.1 container_name: ppanel-node-exporter restart: always volumes: @@ -221,7 +222,7 @@ services: # 9. cAdvisor (容器监控) # ---------------------------------------------------- cadvisor: - image: gcr.io/cadvisor/cadvisor:latest + image: gcr.io/cadvisor/cadvisor:v0.55.1 container_name: ppanel-cadvisor restart: always volumes: diff --git a/ops/docker-image-version-pins.md b/ops/docker-image-version-pins.md new file mode 100644 index 0000000..8568394 --- /dev/null +++ b/ops/docker-image-version-pins.md @@ -0,0 +1,33 @@ +# Docker Image Version Pins + +This file records the infrastructure image versions pinned in `docker-compose.cloud.yml`. +The versions below match the images observed on the test deployment on 2026-05-26. + +| Service | Image | Running version source | +| --- | --- | --- | +| grafana | `grafana/grafana:13.0.1` | `grafana version 13.0.1` | +| prometheus | `prom/prometheus:v3.11.3` | `prometheus, version 3.11.3` | +| nginx-exporter | `nginx/nginx-prometheus-exporter:1.5.0` | image label `org.opencontainers.image.version=1.5.0` | +| node-exporter | `prom/node-exporter:v1.11.1` | `node_exporter, version 1.11.1` | +| cadvisor | `gcr.io/cadvisor/cadvisor:v0.55.1` | `cAdvisor version v0.55.1` | + +The test deployment in `/root/bindbox/docker-compose.cloud.yml` also contains +live-only exporter services that are not present in this repository's +`docker-compose.cloud.yml`. They were pinned during staging validation: + +| Test-only service | Image | Running version source | +| --- | --- | --- | +| mysql-exporter | `prom/mysqld-exporter:v0.19.0` | `mysqld_exporter, version 0.19.0` | +| redis-exporter | `oliver006/redis_exporter:v1.82.0` | image label `org.opencontainers.image.version=v1.82.0` | + +`ppanel-server` intentionally remains variable and requires `PPANEL_SERVER_TAG` +from CI/CD so deployments use an immutable application image tag. + +## Rollback + +Restore the previous compose file from git and redeploy: + +```sh +git checkout HEAD~1 -- docker-compose.cloud.yml .env.example ops/docker-image-version-pins.md +docker compose -f docker-compose.cloud.yml up -d +```