chore: update mineru
This commit is contained in:
Sun-ZhenXing
@@ -12,7 +12,8 @@ These services require building custom Docker images from source.
|
|||||||
| [goose](./builds/goose) | 1.18.0 |
|
| [goose](./builds/goose) | 1.18.0 |
|
||||||
| [IOPaint](./builds/io-paint) | 1.6.0 |
|
| [IOPaint](./builds/io-paint) | 1.6.0 |
|
||||||
| [K3s inside DinD](./builds/k3s-inside-dind) | 0.2.2 |
|
| [K3s inside DinD](./builds/k3s-inside-dind) | 0.2.2 |
|
||||||
| [MinerU vLLM](./builds/mineru) | 2.7.0 |
|
| [KrunVM DinD](./builds/krunvm) | 0.1.0 |
|
||||||
|
| [MinerU vLLM](./builds/mineru) | 2.7.1 |
|
||||||
|
|
||||||
## Supported Services
|
## Supported Services
|
||||||
|
|
||||||
@@ -95,6 +96,7 @@ These services require building custom Docker images from source.
|
|||||||
| [OpenList](./src/openlist) | latest |
|
| [OpenList](./src/openlist) | latest |
|
||||||
| [OpenSearch](./src/opensearch) | 2.19.0 |
|
| [OpenSearch](./src/opensearch) | 2.19.0 |
|
||||||
| [PocketBase](./src/pocketbase) | 0.30.0 |
|
| [PocketBase](./src/pocketbase) | 0.30.0 |
|
||||||
|
| [Podman](./src/podman) | v5.7.1 |
|
||||||
| [Portainer](./src/portainer) | 2.27.3-alpine |
|
| [Portainer](./src/portainer) | 2.27.3-alpine |
|
||||||
| [Portkey AI Gateway](./src/portkey-gateway) | latest |
|
| [Portkey AI Gateway](./src/portkey-gateway) | latest |
|
||||||
| [PostgreSQL](./src/postgres) | 17.6 |
|
| [PostgreSQL](./src/postgres) | 17.6 |
|
||||||
|
|||||||
@@ -12,7 +12,8 @@ Compose Anything 通过提供一组高质量的 Docker Compose 配置文件，
|
|||||||
| [goose](./builds/goose) | 1.18.0 |
|
| [goose](./builds/goose) | 1.18.0 |
|
||||||
| [IOPaint](./builds/io-paint) | 1.6.0 |
|
| [IOPaint](./builds/io-paint) | 1.6.0 |
|
||||||
| [K3s inside DinD](./builds/k3s-inside-dind) | 0.2.2 |
|
| [K3s inside DinD](./builds/k3s-inside-dind) | 0.2.2 |
|
||||||
| [MinerU vLLM](./builds/mineru) | 2.7.0 |
|
| [KrunVM DinD](./builds/krunvm) | 0.1.0 |
|
||||||
|
| [MinerU vLLM](./builds/mineru) | 2.7.1 |
|
||||||
|
|
||||||
## 已经支持的服务
|
## 已经支持的服务
|
||||||
|
|
||||||
@@ -95,6 +96,7 @@ Compose Anything 通过提供一组高质量的 Docker Compose 配置文件，
|
|||||||
| [OpenList](./src/openlist) | latest |
|
| [OpenList](./src/openlist) | latest |
|
||||||
| [OpenSearch](./src/opensearch) | 2.19.0 |
|
| [OpenSearch](./src/opensearch) | 2.19.0 |
|
||||||
| [PocketBase](./src/pocketbase) | 0.30.0 |
|
| [PocketBase](./src/pocketbase) | 0.30.0 |
|
||||||
|
| [Podman](./src/podman) | v5.7.1 |
|
||||||
| [Portainer](./src/portainer) | 2.27.3-alpine |
|
| [Portainer](./src/portainer) | 2.27.3-alpine |
|
||||||
| [Portkey AI Gateway](./src/portkey-gateway) | latest |
|
| [Portkey AI Gateway](./src/portkey-gateway) | latest |
|
||||||
| [PostgreSQL](./src/postgres) | 17.6 |
|
| [PostgreSQL](./src/postgres) | 17.6 |
|
||||||
|
|||||||
@@ -1,36 +0,0 @@
|
|||||||
# Global Registry (optional)
|
|
||||||
# GLOBAL_REGISTRY=registry.example.com/
|
|
||||||
|
|
||||||
# Debian Version
|
|
||||||
DEBIAN_VERSION=13.2-slim
|
|
||||||
|
|
||||||
# Kata Containers Version
|
|
||||||
KATA_VERSION=3.24.0
|
|
||||||
|
|
||||||
# Firecracker Version
|
|
||||||
# Version of Firecracker VMM to install
|
|
||||||
FIRECRACKER_VERSION=1.10.1
|
|
||||||
|
|
||||||
# Kata DinD Image Version
|
|
||||||
# Built image version tag
|
|
||||||
KATA_DIND_VERSION=0.2.0
|
|
||||||
|
|
||||||
# Timezone
|
|
||||||
# Set the timezone for the container
|
|
||||||
TZ=UTC
|
|
||||||
|
|
||||||
# Kata Logging Level
|
|
||||||
# Options: debug, info, warn, error
|
|
||||||
KATA_LOGGING_LEVEL=info
|
|
||||||
|
|
||||||
# Resource Limits
|
|
||||||
# CPU limit (cores)
|
|
||||||
KATA_DIND_CPU_LIMIT=2.00
|
|
||||||
# Memory limit
|
|
||||||
KATA_DIND_MEMORY_LIMIT=4G
|
|
||||||
|
|
||||||
# Resource Reservations
|
|
||||||
# CPU reservation (cores)
|
|
||||||
KATA_DIND_CPU_RESERVATION=0.50
|
|
||||||
# Memory reservation
|
|
||||||
KATA_DIND_MEMORY_RESERVATION=1G
|
|
||||||
@@ -1,72 +0,0 @@
|
|||||||
ARG DEBIAN_VERSION=13.2-slim
|
|
||||||
FROM debian:${DEBIAN_VERSION}
|
|
||||||
|
|
||||||
# Install dependencies
|
|
||||||
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
||||||
ca-certificates \
|
|
||||||
curl \
|
|
||||||
gnupg \
|
|
||||||
iptables \
|
|
||||||
procps \
|
|
||||||
e2fsprogs \
|
|
||||||
xfsprogs \
|
|
||||||
xz-utils \
|
|
||||||
pigz \
|
|
||||||
zstd \
|
|
||||||
kmod \
|
|
||||||
&& rm -rf /var/lib/apt/lists/*
|
|
||||||
|
|
||||||
# Install Docker
|
|
||||||
RUN install -m 0755 -d /etc/apt/keyrings \
|
|
||||||
&& curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg \
|
|
||||||
&& chmod a+r /etc/apt/keyrings/docker.gpg \
|
|
||||||
&& echo \
|
|
||||||
"deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \
|
|
||||||
$(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
|
|
||||||
tee /etc/apt/sources.list.d/docker.list > /dev/null \
|
|
||||||
&& apt-get update \
|
|
||||||
&& apt-get install -y --no-install-recommends \
|
|
||||||
docker-ce \
|
|
||||||
docker-ce-cli \
|
|
||||||
containerd.io \
|
|
||||||
docker-buildx-plugin \
|
|
||||||
docker-compose-plugin \
|
|
||||||
&& rm -rf /var/lib/apt/lists/*
|
|
||||||
|
|
||||||
# Install Kata Containers (Static Binaries)
|
|
||||||
ARG KATA_VERSION=3.24.0
|
|
||||||
ARG ARCH=amd64
|
|
||||||
RUN curl -fsSL https://github.com/kata-containers/kata-containers/releases/download/${KATA_VERSION}/kata-static-${KATA_VERSION}-${ARCH}.tar.zst -o kata-static.tar.zst \
|
|
||||||
&& tar -I zstd -xvf kata-static.tar.zst -C / \
|
|
||||||
&& rm kata-static.tar.zst \
|
|
||||||
&& ln -s /opt/kata/bin/kata-runtime /usr/bin/kata-runtime \
|
|
||||||
&& ln -s /opt/kata/bin/containerd-shim-kata-v2 /usr/bin/containerd-shim-kata-v2 \
|
|
||||||
&& ln -s /opt/kata/bin/kata-monitor /usr/bin/kata-monitor \
|
|
||||||
&& ln -s /opt/kata/bin/kata-collect-data /usr/bin/kata-collect-data \
|
|
||||||
&& ln -s /opt/kata/bin/qemu-system-x86_64 /usr/bin/qemu-system-x86_64 || true \
|
|
||||||
&& ln -s /opt/kata/libexec/virtiofsd /usr/bin/virtiofsd || true
|
|
||||||
|
|
||||||
# Configure Kata
|
|
||||||
RUN mkdir -p /etc/kata-containers \
|
|
||||||
&& cp /opt/kata/share/defaults/kata-containers/configuration-qemu.toml /etc/kata-containers/ \
|
|
||||||
&& cp /opt/kata/share/defaults/kata-containers/configuration-fc.toml /etc/kata-containers/ || true
|
|
||||||
|
|
||||||
# Install Firecracker
|
|
||||||
ARG FIRECRACKER_VERSION=1.14.0
|
|
||||||
RUN if [ "${ARCH}" = "amd64" ]; then ARCH="x86_64"; fi \
|
|
||||||
&& curl -fsSL https://github.com/firecracker-microvm/firecracker/releases/download/v${FIRECRACKER_VERSION}/firecracker-v${FIRECRACKER_VERSION}-${ARCH}.tgz -o firecracker.tgz \
|
|
||||||
&& tar -xzf firecracker.tgz \
|
|
||||||
&& mv release-v${FIRECRACKER_VERSION}-${ARCH}/firecracker-v${FIRECRACKER_VERSION}-${ARCH} /usr/local/bin/firecracker \
|
|
||||||
&& mv release-v${FIRECRACKER_VERSION}-${ARCH}/jailer-v${FIRECRACKER_VERSION}-${ARCH} /usr/local/bin/jailer \
|
|
||||||
&& chmod +x /usr/local/bin/firecracker /usr/local/bin/jailer \
|
|
||||||
&& rm -rf release-v${FIRECRACKER_VERSION}-${ARCH} firecracker.tgz
|
|
||||||
|
|
||||||
# Set up dind
|
|
||||||
VOLUME /var/lib/docker
|
|
||||||
|
|
||||||
# Copy entrypoint script
|
|
||||||
COPY dockerd-entrypoint.sh /usr/local/bin/
|
|
||||||
RUN chmod +x /usr/local/bin/dockerd-entrypoint.sh
|
|
||||||
|
|
||||||
ENTRYPOINT ["dockerd-entrypoint.sh"]
|
|
||||||
CMD ["dockerd"]
|
|
||||||
@@ -1,112 +0,0 @@
|
|||||||
# Kata Containers inside Docker-in-Docker
|
|
||||||
|
|
||||||
[中文文档](README.zh.md)
|
|
||||||
|
|
||||||
A VM-based container runtime (Kata Containers with Firecracker VMM) running inside a Docker-in-Docker (DinD) container. This setup provides lightweight virtual machines with strong security isolation while maintaining container-like performance and simplicity. Kata Containers can use multiple hypervisors (QEMU, Firecracker, Cloud Hypervisor), and this image includes Firecracker by default for optimal performance.
|
|
||||||
|
|
||||||
## Features
|
|
||||||
|
|
||||||
- ✅ Complete Kata Containers runtime with official installation
|
|
||||||
- ✅ Firecracker VMM for lightweight VM isolation
|
|
||||||
- ✅ QEMU fallback support
|
|
||||||
- ✅ Docker-in-Docker support for managing containers
|
|
||||||
- ✅ VM-based container isolation with hardware security
|
|
||||||
- ✅ Resource limits to prevent system exhaustion
|
|
||||||
- ✅ Health checks for runtime readiness
|
|
||||||
- ✅ Persistent storage for Kata and Docker data
|
|
||||||
- ✅ Configurable logging levels
|
|
||||||
- ✅ Compatible with Kubernetes via RuntimeClass
|
|
||||||
|
|
||||||
## Prerequisites
|
|
||||||
|
|
||||||
**Critical Requirements:**
|
|
||||||
|
|
||||||
- Docker Engine 20.10+
|
|
||||||
- Docker Compose 2.0+
|
|
||||||
- **Host machine must support nested virtualization (KVM)**
|
|
||||||
- `/dev/kvm` device available on the host
|
|
||||||
- `/lib/modules` available on the host (for kernel module verification)
|
|
||||||
- At least 2 CPU cores and 4GB RAM available
|
|
||||||
- Privileged container support required
|
|
||||||
|
|
||||||
### Verify Host Prerequisites
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Check if KVM is available
|
|
||||||
ls -l /dev/kvm
|
|
||||||
|
|
||||||
# For Intel CPUs, verify nested virtualization is enabled
|
|
||||||
cat /sys/module/kvm_intel/parameters/nested
|
|
||||||
# Should output 'Y' or '1'. If not:
|
|
||||||
# sudo modprobe -r kvm_intel
|
|
||||||
# sudo modprobe kvm_intel nested=1
|
|
||||||
```
|
|
||||||
|
|
||||||
## Quick Start
|
|
||||||
|
|
||||||
1. Copy the environment file:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
cp .env.example .env
|
|
||||||
```
|
|
||||||
|
|
||||||
2. (Optional) Customize the configuration in `.env`
|
|
||||||
|
|
||||||
3. Build and start the service:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
docker compose up -d --build
|
|
||||||
```
|
|
||||||
|
|
||||||
4. Wait for Kata runtime to be ready:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
docker compose logs -f kata-dind
|
|
||||||
```
|
|
||||||
|
|
||||||
5. Access the Docker daemon inside:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Get the container ID
|
|
||||||
docker compose ps
|
|
||||||
|
|
||||||
# Execute commands inside the container
|
|
||||||
docker compose exec kata-dind docker ps
|
|
||||||
|
|
||||||
# Run a container with Kata runtime (Firecracker)
|
|
||||||
docker compose exec kata-dind docker run --rm --runtime=kata-fc debian:bookworm uname -a
|
|
||||||
|
|
||||||
# Or run with QEMU (fallback)
|
|
||||||
docker compose exec kata-dind docker run --rm --runtime=kata debian:bookworm uname -a
|
|
||||||
```
|
|
||||||
|
|
||||||
## Configuration
|
|
||||||
|
|
||||||
### Environment Variables
|
|
||||||
|
|
||||||
| Variable | Default | Description |
|
|
||||||
| ------------------------------ | ----------- | --------------------------------------------- |
|
|
||||||
| `DEBIAN_VERSION` | `13.2-slim` | Base Debian version |
|
|
||||||
| `KATA_VERSION` | `3.24.0` | Kata Containers version |
|
|
||||||
| `FIRECRACKER_VERSION` | `1.10.1` | Version of Firecracker VMM to install |
|
|
||||||
| `KATA_DIND_VERSION` | `0.2.0` | Built image version tag |
|
|
||||||
| `TZ` | `UTC` | Timezone for the container |
|
|
||||||
| `KATA_LOGGING_LEVEL` | `info` | Kata logging level (debug, info, warn, error) |
|
|
||||||
| `KATA_DIND_CPU_LIMIT` | `2.00` | CPU limit in cores |
|
|
||||||
| `KATA_DIND_MEMORY_LIMIT` | `4G` | Memory limit |
|
|
||||||
| `KATA_DIND_CPU_RESERVATION` | `0.50` | CPU reservation in cores |
|
|
||||||
| `KATA_DIND_MEMORY_RESERVATION` | `1G` | Memory reservation |
|
|
||||||
|
|
||||||
## Usage Examples
|
|
||||||
|
|
||||||
### Running a Secure Container
|
|
||||||
|
|
||||||
```bash
|
|
||||||
docker compose exec kata-dind docker run -it --rm --runtime=kata-fc alpine sh
|
|
||||||
```
|
|
||||||
|
|
||||||
### Checking Runtime Information
|
|
||||||
|
|
||||||
```bash
|
|
||||||
docker compose exec kata-dind docker info | grep -i runtime
|
|
||||||
```
|
|
||||||
@@ -1,112 +0,0 @@
|
|||||||
# Kata 容器在 Docker-in-Docker 中运行
|
|
||||||
|
|
||||||
[English Documentation](README.md)
|
|
||||||
|
|
||||||
一个基于虚拟机的容器运行时（Kata Containers 与 Firecracker VMM）在 Docker-in-Docker（DinD）容器内运行。此设置提供轻量级虚拟机，具有强安全隔离的同时保持容器的性能和简洁性。Kata Containers 支持多种虚拟机管理器（QEMU、Firecracker、Cloud Hypervisor），此镜像默认包含 Firecracker 以获得最佳性能。
|
|
||||||
|
|
||||||
## 特性
|
|
||||||
|
|
||||||
- ✅ 使用官方安装脚本的完整 Kata Containers 运行时
|
|
||||||
- ✅ Firecracker VMM 提供轻量级 VM 隔离
|
|
||||||
- ✅ QEMU 回退支持
|
|
||||||
- ✅ Docker-in-Docker 支持容器管理
|
|
||||||
- ✅ 基于 VM 的容器隔离和硬件安全性
|
|
||||||
- ✅ 资源限制防止系统资源耗尽
|
|
||||||
- ✅ 运行时就绪性的健康检查
|
|
||||||
- ✅ Kata 和 Docker 数据的持久化存储
|
|
||||||
- ✅ 可配置的日志级别
|
|
||||||
- ✅ 通过 RuntimeClass 与 Kubernetes 兼容
|
|
||||||
|
|
||||||
## 前置条件
|
|
||||||
|
|
||||||
**关键要求：**
|
|
||||||
|
|
||||||
- Docker Engine 20.10+
|
|
||||||
- Docker Compose 2.0+
|
|
||||||
- **宿主机必须支持嵌套虚拟化（KVM）**
|
|
||||||
- 宿主机上 `/dev/kvm` 设备可用
|
|
||||||
- 宿主机上 `/lib/modules` 可用（用于内核模块验证）
|
|
||||||
- 至少 2 个 CPU 核心和 4GB RAM
|
|
||||||
- 需要特权容器支持
|
|
||||||
|
|
||||||
### 验证宿主机前置条件
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 检查 KVM 是否可用
|
|
||||||
ls -l /dev/kvm
|
|
||||||
|
|
||||||
# 对于 Intel CPU，验证嵌套虚拟化是否启用
|
|
||||||
cat /sys/module/kvm_intel/parameters/nested
|
|
||||||
# 应该输出 'Y' 或 '1'。如果不是：
|
|
||||||
# sudo modprobe -r kvm_intel
|
|
||||||
# sudo modprobe kvm_intel nested=1
|
|
||||||
```
|
|
||||||
|
|
||||||
## 快速开始
|
|
||||||
|
|
||||||
1. 复制环境文件：
|
|
||||||
|
|
||||||
```bash
|
|
||||||
cp .env.example .env
|
|
||||||
```
|
|
||||||
|
|
||||||
2. （可选）在 `.env` 中自定义配置
|
|
||||||
|
|
||||||
3. 构建并启动服务：
|
|
||||||
|
|
||||||
```bash
|
|
||||||
docker compose up -d --build
|
|
||||||
```
|
|
||||||
|
|
||||||
4. 等待 Kata 运行时就绪：
|
|
||||||
|
|
||||||
```bash
|
|
||||||
docker compose logs -f kata-dind
|
|
||||||
```
|
|
||||||
|
|
||||||
5. 访问容器内的 Docker 守护进程：
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# 获取容器 ID
|
|
||||||
docker compose ps
|
|
||||||
|
|
||||||
# 在容器内执行命令
|
|
||||||
docker compose exec kata-dind docker ps
|
|
||||||
|
|
||||||
# 使用 Firecracker 运行时运行容器
|
|
||||||
docker compose exec kata-dind docker run --rm --runtime=kata-fc debian:bookworm uname -a
|
|
||||||
|
|
||||||
# 或使用 QEMU（回退方案）
|
|
||||||
docker compose exec kata-dind docker run --rm --runtime=kata debian:bookworm uname -a
|
|
||||||
```
|
|
||||||
|
|
||||||
## 配置
|
|
||||||
|
|
||||||
### 环境变量
|
|
||||||
|
|
||||||
| 变量 | 默认值 | 说明 |
|
|
||||||
| ------------------------------ | ----------- | ----------------------------------------- |
|
|
||||||
| `DEBIAN_VERSION` | `13.2-slim` | 基础 Debian 版本 |
|
|
||||||
| `KATA_VERSION` | `3.24.0` | Kata Containers 版本 |
|
|
||||||
| `FIRECRACKER_VERSION` | `1.10.1` | 要安装的 Firecracker VMM 版本 |
|
|
||||||
| `KATA_DIND_VERSION` | `0.2.0` | 构建的镜像版本标签 |
|
|
||||||
| `TZ` | `UTC` | 容器的时区 |
|
|
||||||
| `KATA_LOGGING_LEVEL` | `info` | Kata 日志级别（debug、info、warn、error） |
|
|
||||||
| `KATA_DIND_CPU_LIMIT` | `2.00` | CPU 限制（核心数） |
|
|
||||||
| `KATA_DIND_MEMORY_LIMIT` | `4G` | 内存限制 |
|
|
||||||
| `KATA_DIND_CPU_RESERVATION` | `0.50` | CPU 预留（核心数） |
|
|
||||||
| `KATA_DIND_MEMORY_RESERVATION` | `1G` | 内存预留 |
|
|
||||||
|
|
||||||
## 使用示例
|
|
||||||
|
|
||||||
### 运行安全容器
|
|
||||||
|
|
||||||
```bash
|
|
||||||
docker compose exec kata-dind docker run -it --rm --runtime=kata-fc alpine sh
|
|
||||||
```
|
|
||||||
|
|
||||||
### 检查运行时信息
|
|
||||||
|
|
||||||
```bash
|
|
||||||
docker compose exec kata-dind docker info | grep -i runtime
|
|
||||||
```
|
|
||||||
@@ -1,55 +0,0 @@
|
|||||||
# Kata Containers inside Docker-in-Docker
|
|
||||||
# A VM-based container runtime running inside a Docker container with Docker daemon
|
|
||||||
# See README.md for usage instructions
|
|
||||||
|
|
||||||
x-defaults: &defaults
|
|
||||||
restart: unless-stopped
|
|
||||||
logging:
|
|
||||||
driver: json-file
|
|
||||||
options:
|
|
||||||
max-size: 100m
|
|
||||||
max-file: "3"
|
|
||||||
|
|
||||||
services:
|
|
||||||
kata-dind:
|
|
||||||
<<: *defaults
|
|
||||||
image: ${GLOBAL_REGISTRY:-}alexsuntop/kata-inside-dind:${KATA_DIND_VERSION:-0.2.0}
|
|
||||||
build:
|
|
||||||
context: .
|
|
||||||
dockerfile: Dockerfile
|
|
||||||
args:
|
|
||||||
DEBIAN_VERSION: ${DEBIAN_VERSION:-13.2-slim}
|
|
||||||
KATA_VERSION: ${KATA_VERSION:-3.24.0}
|
|
||||||
FIRECRACKER_VERSION: ${FIRECRACKER_VERSION:-1.14.0}
|
|
||||||
privileged: true
|
|
||||||
devices:
|
|
||||||
- /dev/kvm:/dev/kvm
|
|
||||||
- /dev/net/tun:/dev/net/tun
|
|
||||||
- /dev/vhost-net:/dev/vhost-net
|
|
||||||
- /dev/vhost-vsock:/dev/vhost-vsock
|
|
||||||
volumes:
|
|
||||||
- kata_data:/var/lib/kata
|
|
||||||
- docker_data:/var/lib/docker
|
|
||||||
- /lib/modules:/lib/modules:ro
|
|
||||||
environment:
|
|
||||||
- TZ=${TZ:-UTC}
|
|
||||||
- DOCKER_TLS_CERTDIR=${DOCKER_TLS_CERTDIR:-}
|
|
||||||
- KATA_LOGGING_LEVEL=${KATA_LOGGING_LEVEL:-info}
|
|
||||||
healthcheck:
|
|
||||||
test: ["CMD", "docker", "info"]
|
|
||||||
interval: 30s
|
|
||||||
timeout: 10s
|
|
||||||
retries: 5
|
|
||||||
start_period: 60s
|
|
||||||
deploy:
|
|
||||||
resources:
|
|
||||||
limits:
|
|
||||||
cpus: ${KATA_DIND_CPU_LIMIT:-2.00}
|
|
||||||
memory: ${KATA_DIND_MEMORY_LIMIT:-4G}
|
|
||||||
reservations:
|
|
||||||
cpus: ${KATA_DIND_CPU_RESERVATION:-0.50}
|
|
||||||
memory: ${KATA_DIND_MEMORY_RESERVATION:-1G}
|
|
||||||
|
|
||||||
volumes:
|
|
||||||
kata_data:
|
|
||||||
docker_data:
|
|
||||||
@@ -1,120 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
set -e
|
|
||||||
|
|
||||||
# Adapted from official docker-library/docker dind entrypoint
|
|
||||||
# https://github.com/docker-library/docker/blob/master/24/dind/dockerd-entrypoint.sh
|
|
||||||
|
|
||||||
if [ -z "$DOCKER_HOST" ]; then
|
|
||||||
case "$1" in
|
|
||||||
dockerd*)
|
|
||||||
# If we're running dockerd, we need to make sure we have cgroups mounted
|
|
||||||
if [ ! -d /sys/fs/cgroup ]; then
|
|
||||||
mkdir -p /sys/fs/cgroup
|
|
||||||
fi
|
|
||||||
if ! mountpoint -q /sys/fs/cgroup; then
|
|
||||||
mount -t tmpfs -o uid=0,gid=0,mode=0755 cgroup /sys/fs/cgroup
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Mount cgroup v2 if available and not mounted
|
|
||||||
if [ -e /sys/fs/cgroup/cgroup.controllers ] && ! mountpoint -q /sys/fs/cgroup; then
|
|
||||||
mount -t cgroup2 -o nsdelegate cgroup2 /sys/fs/cgroup
|
|
||||||
fi
|
|
||||||
|
|
||||||
# If /sys/fs/cgroup is not a cgroup2 mount, we might need to mount cgroup v1 hierarchies
|
|
||||||
if ! mountpoint -q /sys/fs/cgroup || [ "$(stat -f -c %T /sys/fs/cgroup)" != "cgroup2fs" ]; then
|
|
||||||
if [ -d /sys/fs/cgroup/cgroup.controllers ]; then
|
|
||||||
# It is cgroup2 but maybe not mounted as such?
|
|
||||||
# Actually if it exists, it's likely v2.
|
|
||||||
:
|
|
||||||
else
|
|
||||||
# cgroup v1
|
|
||||||
for subsystem in $(awk '/^[^#]/ { print $1 }' /proc/cgroups); do
|
|
||||||
mkdir -p "/sys/fs/cgroup/$subsystem"
|
|
||||||
if ! mountpoint -q "/sys/fs/cgroup/$subsystem"; then
|
|
||||||
mount -t cgroup -o "$subsystem" cgroup "/sys/fs/cgroup/$subsystem"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Configure Docker daemon with Kata runtime support
|
|
||||||
mkdir -p /etc/docker
|
|
||||||
cat > /etc/docker/daemon.json <<EOF
|
|
||||||
{
|
|
||||||
"storage-driver": "overlay2",
|
|
||||||
"log-driver": "json-file",
|
|
||||||
"log-opts": {
|
|
||||||
"max-size": "10m",
|
|
||||||
"max-file": "3"
|
|
||||||
},
|
|
||||||
"runtimes": {
|
|
||||||
"kata": {
|
|
||||||
"path": "/usr/bin/containerd-shim-kata-v2",
|
|
||||||
"runtimeArgs": [
|
|
||||||
"--kata-config",
|
|
||||||
"/etc/kata-containers/configuration-qemu.toml"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"kata-fc": {
|
|
||||||
"path": "/usr/bin/containerd-shim-kata-v2",
|
|
||||||
"runtimeArgs": [
|
|
||||||
"--kata-config",
|
|
||||||
"/etc/kata-containers/configuration-fc.toml"
|
|
||||||
]
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
EOF
|
|
||||||
|
|
||||||
# Configure Kata to use Firecracker if available
|
|
||||||
if [ -f /etc/kata-containers/configuration-fc.toml ] && [ -x /usr/local/bin/firecracker ]; then
|
|
||||||
echo "[INFO] Firecracker configuration found"
|
|
||||||
# Update path in configuration if needed
|
|
||||||
if ! grep -q "path = \"/usr/local/bin/firecracker\"" /etc/kata-containers/configuration-fc.toml 2>/dev/null; then
|
|
||||||
if [ -w /etc/kata-containers/configuration-fc.toml ]; then
|
|
||||||
sed -i 's|path = ".*firecracker"|path = "/usr/local/bin/firecracker"|g' /etc/kata-containers/configuration-fc.toml || true
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Update jailer path if available
|
|
||||||
if [ -x /usr/local/bin/jailer ]; then
|
|
||||||
if ! grep -q "jailer_path = \"/usr/local/bin/jailer\"" /etc/kata-containers/configuration-fc.toml 2>/dev/null; then
|
|
||||||
if [ -w /etc/kata-containers/configuration-fc.toml ]; then
|
|
||||||
sed -i 's|jailer_path = ".*jailer"|jailer_path = "/usr/local/bin/jailer"|g' /etc/kata-containers/configuration-fc.toml || true
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Enable debug logging if requested
|
|
||||||
if [ "${KATA_LOGGING_LEVEL}" = "debug" ]; then
|
|
||||||
echo "[INFO] Enabling debug logging for Kata"
|
|
||||||
for config in /etc/kata-containers/configuration-*.toml; do
|
|
||||||
if [ -f "$config" ]; then
|
|
||||||
sed -i 's/enable_debug = false/enable_debug = true/g' "$config"
|
|
||||||
sed -i 's/#log_path = .*/log_path = "\/var\/log\/kata\/kata.log"/g' "$config"
|
|
||||||
sed -i 's/level = "info"/level = "debug"/g' "$config"
|
|
||||||
fi
|
|
||||||
done
|
|
||||||
mkdir -p /var/log/kata
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ "$1" = 'dockerd' ] || [ "${1#-}" != "$1" ]; then
|
|
||||||
# if the first argument is "dockerd" or a flag (starts with -)
|
|
||||||
if [ "${1#-}" != "$1" ]; then
|
|
||||||
set -- dockerd "$@"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Explicitly use iptables-legacy if available, as it is often more stable for DinD
|
|
||||||
if command -v update-alternatives >/dev/null; then
|
|
||||||
if update-alternatives --query iptables | grep -q "iptables-legacy"; then
|
|
||||||
update-alternatives --set iptables /usr/sbin/iptables-legacy || true
|
|
||||||
update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy || true
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
fi
|
|
||||||
|
|
||||||
exec "$@"
|
|
||||||
@@ -1,5 +1,5 @@
|
|||||||
# MinerU Docker image
|
# MinerU Docker image
|
||||||
MINERU_DOCKER_IMAGE=alexsuntop/mineru:2.7.0
|
MINERU_VERSION=2.7.1
|
||||||
|
|
||||||
# Port configurations
|
# Port configurations
|
||||||
MINERU_PORT_OVERRIDE_VLLM=30000
|
MINERU_PORT_OVERRIDE_VLLM=30000
|
||||||
|
|||||||
@@ -19,7 +19,7 @@ RUN apt-get update && \
|
|||||||
rm -rf /var/lib/apt/lists/*
|
rm -rf /var/lib/apt/lists/*
|
||||||
|
|
||||||
# Install mineru latest
|
# Install mineru latest
|
||||||
RUN python3 -m pip install -U 'mineru[core]>=2.7.0' --break-system-packages && \
|
RUN python3 -m pip install -U 'mineru[core]>=2.7.1' --break-system-packages && \
|
||||||
python3 -m pip cache purge
|
python3 -m pip cache purge
|
||||||
|
|
||||||
# Download models and update the configuration file
|
# Download models and update the configuration file
|
||||||
|
|||||||
@@ -39,7 +39,7 @@ mineru -p demo.pdf -o ./output -b vlm-http-client -u http://localhost:30000
|
|||||||
|
|
||||||
## Configuration
|
## Configuration
|
||||||
|
|
||||||
- `MINERU_VERSION`: The version for MinerU, default is `2.7.0`.
|
- `MINERU_VERSION`: The version for MinerU, default is `2.7.1`.
|
||||||
- `MINERU_PORT_OVERRIDE_VLLM`: The host port for the VLLM server, default is `30000`.
|
- `MINERU_PORT_OVERRIDE_VLLM`: The host port for the VLLM server, default is `30000`.
|
||||||
- `MINERU_PORT_OVERRIDE_API`: The host port for the API service, default is `8000`.
|
- `MINERU_PORT_OVERRIDE_API`: The host port for the API service, default is `8000`.
|
||||||
- `MINERU_PORT_OVERRIDE_GRADIO`: The host port for the Gradio WebUI, default is `7860`.
|
- `MINERU_PORT_OVERRIDE_GRADIO`: The host port for the Gradio WebUI, default is `7860`.
|
||||||
|
|||||||
@@ -39,7 +39,7 @@ mineru -p demo.pdf -o ./output -b vlm-http-client -u http://localhost:30000
|
|||||||
|
|
||||||
## 配置
|
## 配置
|
||||||
|
|
||||||
- `MINERU_VERSION`: MinerU 的 Docker 镜像版本，默认为 `2.7.0`。
|
- `MINERU_VERSION`: MinerU 的 Docker 镜像版本，默认为 `2.7.1`。
|
||||||
- `MINERU_PORT_OVERRIDE_VLLM`: VLLM 服务器的主机端口，默认为 `30000`。
|
- `MINERU_PORT_OVERRIDE_VLLM`: VLLM 服务器的主机端口，默认为 `30000`。
|
||||||
- `MINERU_PORT_OVERRIDE_API`: API 服务的主机端口，默认为 `8000`。
|
- `MINERU_PORT_OVERRIDE_API`: API 服务的主机端口，默认为 `8000`。
|
||||||
- `MINERU_PORT_OVERRIDE_GRADIO`: Gradio WebUI 的主机端口，默认为 `7860`。
|
- `MINERU_PORT_OVERRIDE_GRADIO`: Gradio WebUI 的主机端口，默认为 `7860`。
|
||||||
|
|||||||
@@ -8,10 +8,13 @@ x-defaults: &defaults
|
|||||||
|
|
||||||
x-mineru-vllm: &mineru-vllm
|
x-mineru-vllm: &mineru-vllm
|
||||||
<<: *defaults
|
<<: *defaults
|
||||||
image: ${GLOBAL_REGISTRY:-}alexsuntop/mineru:${MINERU_VERSION:-2.7.0}
|
image: ${GLOBAL_REGISTRY:-}alexsuntop/mineru:${MINERU_VERSION:-2.7.1}
|
||||||
build:
|
build:
|
||||||
context: .
|
context: .
|
||||||
dockerfile: Dockerfile
|
dockerfile: Dockerfile
|
||||||
|
platforms:
|
||||||
|
- linux/amd64
|
||||||
|
- linux/arm64
|
||||||
environment:
|
environment:
|
||||||
TZ: ${TZ:-UTC}
|
TZ: ${TZ:-UTC}
|
||||||
MINERU_MODEL_SOURCE: local
|
MINERU_MODEL_SOURCE: local
|
||||||
|
|||||||
17
src/podman/.env.example
Normal file
17
src/podman/.env.example
Normal file
@@ -0,0 +1,17 @@
|
|||||||
|
# Podman Configuration
|
||||||
|
|
||||||
|
# Image version: quay.io/podman/stable
|
||||||
|
# Reference: https://quay.io/repository/podman/stable
|
||||||
|
PODMAN_VERSION=v5.7.1
|
||||||
|
|
||||||
|
# Host port for Podman API (default: 8888)
|
||||||
|
# PODMAN_PORT_OVERRIDE=8888
|
||||||
|
|
||||||
|
# Timezone
|
||||||
|
TZ=UTC
|
||||||
|
|
||||||
|
# Resource Limits
|
||||||
|
# PODMAN_CPU_LIMIT=2.0
|
||||||
|
# PODMAN_MEMORY_LIMIT=4G
|
||||||
|
# PODMAN_CPU_RESERVATION=1.0
|
||||||
|
# PODMAN_MEMORY_RESERVATION=2G
|
||||||
38
src/podman/README.md
Normal file
38
src/podman/README.md
Normal file
@@ -0,0 +1,38 @@
|
|||||||
|
# Podman (Podman-in-Container)
|
||||||
|
|
||||||
|
[English](./README.md) | [中文](./README.zh.md)
|
||||||
|
|
||||||
|
This service provides a Podman environment running inside a container (Podman-in-Container). It allows you to run and manage OCI containers using Podman without installing it directly on your host.
|
||||||
|
|
||||||
|
## Quick Start
|
||||||
|
|
||||||
|
1. (Optional) Customize the configuration in `.env`.
|
||||||
|
2. Start the service:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker compose up -d
|
||||||
|
```
|
||||||
|
|
||||||
|
3. You can either use the Podman API on port `8888` or execute commands directly:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker compose exec podman podman info
|
||||||
|
```
|
||||||
|
|
||||||
|
## Services
|
||||||
|
|
||||||
|
- `podman`: The Podman engine service.
|
||||||
|
|
||||||
|
## Configuration
|
||||||
|
|
||||||
|
| Environment Variable | Description | Default |
|
||||||
|
| ---------------------- | -------------------------- | -------- |
|
||||||
|
| `PODMAN_VERSION` | Version of Podman image | `v5.7.1` |
|
||||||
|
| `PODMAN_PORT_OVERRIDE` | Host port for Podman API | `8888` |
|
||||||
|
| `TZ` | Timezone for the container | `UTC` |
|
||||||
|
| `PODMAN_CPU_LIMIT` | Maximum CPU usage | `2.0` |
|
||||||
|
| `PODMAN_MEMORY_LIMIT` | Maximum Memory usage | `4G` |
|
||||||
|
|
||||||
|
## Security Note
|
||||||
|
|
||||||
|
This container requires `privileged: true` to function correctly as it needs to manage container namespaces and mounts. Use it only in trusted environments.
|
||||||
38
src/podman/README.zh.md
Normal file
38
src/podman/README.zh.md
Normal file
@@ -0,0 +1,38 @@
|
|||||||
|
# Podman (容器内 Podman)
|
||||||
|
|
||||||
|
[English](./README.md) | [中文](./README.zh.md)
|
||||||
|
|
||||||
|
此服务提供一个运行在容器内的 Podman 环境（Podman-in-Container）。它允许你在不直接在主机上安装 Podman 的情况下，使用 Podman 运行和管理 OCI 容器。
|
||||||
|
|
||||||
|
## 快速开始
|
||||||
|
|
||||||
|
1. （可选）在 `.env` 中自定义配置。
|
||||||
|
2. 启动服务：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker compose up -d
|
||||||
|
```
|
||||||
|
|
||||||
|
3. 你可以使用端口 `8888` 上的 Podman API，或者直接执行命令：
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker compose exec podman podman info
|
||||||
|
```
|
||||||
|
|
||||||
|
## 服务
|
||||||
|
|
||||||
|
- `podman`：Podman 引擎服务。
|
||||||
|
|
||||||
|
## 配置
|
||||||
|
|
||||||
|
| 环境变量 | 描述 | 默认值 |
|
||||||
|
| ---------------------- | --------------------- | -------- |
|
||||||
|
| `PODMAN_VERSION` | Podman 镜像版本 | `v5.7.1` |
|
||||||
|
| `PODMAN_PORT_OVERRIDE` | Podman API 的主机端口 | `8888` |
|
||||||
|
| `TZ` | 容器的时区 | `UTC` |
|
||||||
|
| `PODMAN_CPU_LIMIT` | 最大 CPU 限制 | `2.0` |
|
||||||
|
| `PODMAN_MEMORY_LIMIT` | 最大内存限制 | `4G` |
|
||||||
|
|
||||||
|
## 安全说明
|
||||||
|
|
||||||
|
此容器需要 `privileged: true` 才能正常运行，因为它需要管理容器命名空间和挂载。请仅在受信任的环境中使用。
|
||||||
44
src/podman/docker-compose.yaml
Normal file
44
src/podman/docker-compose.yaml
Normal file
@@ -0,0 +1,44 @@
|
|||||||
|
# Podman (Podman-in-Container)
|
||||||
|
# High-quality container management tool for developing, managing, and running OCI Containers
|
||||||
|
|
||||||
|
x-defaults: &defaults
|
||||||
|
restart: unless-stopped
|
||||||
|
logging:
|
||||||
|
driver: json-file
|
||||||
|
options:
|
||||||
|
max-size: 100m
|
||||||
|
max-file: "3"
|
||||||
|
|
||||||
|
services:
|
||||||
|
podman:
|
||||||
|
<<: *defaults
|
||||||
|
image: ${GLOBAL_REGISTRY:-}quay.io/podman/stable:${PODMAN_VERSION:-v5.7.1}
|
||||||
|
#! Podman-in-Container usually requires privileged mode to manage containers
|
||||||
|
privileged: true
|
||||||
|
#! Optional: Enable Podman API service
|
||||||
|
command: podman system service --time=0 tcp:0.0.0.0:8888
|
||||||
|
ports:
|
||||||
|
- "${PODMAN_PORT_OVERRIDE:-8888}:8888"
|
||||||
|
volumes:
|
||||||
|
- podman_data:/var/lib/containers
|
||||||
|
#! Optional: volume for podman configs/registries
|
||||||
|
# - ./registries.conf:/etc/containers/registries.conf:ro
|
||||||
|
environment:
|
||||||
|
- TZ=${TZ:-UTC}
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD", "podman", "info"]
|
||||||
|
interval: 30s
|
||||||
|
timeout: 10s
|
||||||
|
retries: 3
|
||||||
|
start_period: 10s
|
||||||
|
deploy:
|
||||||
|
resources:
|
||||||
|
limits:
|
||||||
|
cpus: ${PODMAN_CPU_LIMIT:-2.0}
|
||||||
|
memory: ${PODMAN_MEMORY_LIMIT:-4G}
|
||||||
|
reservations:
|
||||||
|
cpus: ${PODMAN_CPU_RESERVATION:-1.0}
|
||||||
|
memory: ${PODMAN_MEMORY_RESERVATION:-2G}
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
podman_data:
|
||||||
Reference in New Issue
Block a user