# ✅ 推荐的 Dockerfile 模板

# 1. 使用明确的版本标签（不要用 latest）
FROM docker.io/library/python:3.12-slim-bookworm AS builder

# 2. 设置元数据
LABEL maintainer="[email protected]"
LABEL org.opencontainers.image.source="https://github.com/org/app"
LABEL org.opencontainers.image.description="My Application"

# 3. 先复制依赖文件（利用缓存层）
WORKDIR /build
COPY requirements.txt .
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt

# 4. 复制源代码
COPY . .

# 5. 构建阶段测试
RUN python -m pytest tests/ --tb=short

# ---- 运行阶段 ----
FROM docker.io/library/python:3.12-slim-bookworm

# 6. 安装最小依赖
RUN apt-get update && \
    apt-get install -y --no-install-recommends curl ca-certificates && \
    rm -rf /var/lib/apt/lists/*

# 7. 从构建阶段复制
COPY --from=builder /install /usr/local

# 8. 创建非 root 用户
RUN groupadd -r app && useradd -r -g app -d /app -s /sbin/nologin app

# 9. 设置文件权限
WORKDIR /app
COPY --chown=app:app . .
RUN chmod -R 550 /app && \
    mkdir -p /app/data && chown app:app /app/data

# 10. 切换到非 root 用户
USER app

# 11. 健康检查
HEALTHCHECK --interval=30s --timeout=5s --retries=3 \
    CMD curl -f http://localhost:8080/health || exit 1

# 12. 声明端口
EXPOSE 8080

# 13. 使用 exec 格式
ENTRYPOINT ["python", "-m", "uvicorn"]
CMD ["app.main:app", "--host", "0.0.0.0", "--port", "8080"]

# 对比不同基础镜像大小
podman images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}"

# .dockerignore
.git
.github
__pycache__
*.pyc
.env
.env.*
node_modules
dist
build
*.md
tests/

# 生产环境容器运行标准参数
podman run -d \
    --name production-app \
    --hostname app-01 \
    \
    # 网络
    -p 8080:8080 \
    --network production-net \
    \
    # 资源限制
    --memory 1g \
    --cpus 2 \
    --pids-limit 200 \
    \
    # 安全
    --cap-drop=ALL \
    --cap-add=NET_BIND_SERVICE \
    --read-only \
    --tmpfs /tmp:rw,size=100m,mode=1777 \
    --security-opt no-new-privileges:true \
    \
    # 用户
    --user 1000:1000 \
    --userns=keep-id \
    \
    # 卷
    -v app-data:/app/data:Z \
    -v app-logs:/var/log/app:Z \
    \
    # 环境
    -e APP_ENV=production \
    --secret db-password,type=env,target=DB_PASSWORD \
    \
    # 重启策略
    --restart unless-stopped \
    --stop-timeout 30 \
    \
    # 标签
    --label app=production \
    --label version=2.1.0 \
    --label maintainer=platform-team \
    \
    registry.example.com/app:v2.1.0

# ~/.config/containers/systemd/production-app.container
[Unit]
Description=Production Application
After=network-online.target postgres.service redis.service
Wants=network-online.target
Documentation=https://docs.example.com/app

[Container]
Image=registry.example.com/app:v2.1.0
AutoUpdate=registry

# 网络
PublishPort=8080:8080
Network=production.network

# 安全
ReadOnly=true
DropCapability=ALL
AddCapability=NET_BIND_SERVICE
NoNewPrivileges=true
SecurityLabelType=container_init_t

# 资源
PodmanArgs=--memory 1g --cpus 2 --pids-limit 200

# 存储
Volume=app-data.volume:/app/data:Z
Volume=app-logs.volume:/var/log/app:Z
Tmpfs=/tmp:size=100m,mode=1777

# 配置
Environment=APP_ENV=production
Environment=LOG_LEVEL=info
Secret=app-db-password,type=env,target=DB_PASSWORD
Label=app=production
Label=version=2.1.0

# 健康检查
HealthCmd=/app/healthcheck
HealthInterval=30s
HealthTimeout=5s
HealthRetries=3
HealthStartPeriod=40s

# 通知
Notify=healthy

[Service]
Restart=always
RestartSec=10
TimeoutStartSec=120
TimeoutStopSec=30
ExecReload=/bin/kill -HUP $MAINPID

[Install]
WantedBy=default.target

# .github/workflows/ci-cd.yml
name: CI/CD Pipeline

on:
  push:
    branches: [main]
    tags: ['v*']
  pull_request:
    branches: [main]

env:
  REGISTRY: registry.example.com
  IMAGE_NAME: ${{ github.repository }}

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Tests
        run: |
          podman run --rm -v $PWD:/src:Z -w /src python:3.12-slim \
            bash -c "pip install -e '.[test]' && pytest"

  build:
    needs: test
    runs-on: ubuntu-latest
    if: github.event_name == 'push'
    steps:
      - uses: actions/checkout@v4

      - name: Build Image
        run: |
          podman build \
            --label org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} \
            --label org.opencontainers.image.revision=${{ github.sha }} \
            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} \
            -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest \
            .

      - name: Scan Image
        run: |
          trivy image --exit-code 1 --severity HIGH,CRITICAL \
            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}

      - name: Login to Registry
        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
        run: |
          echo "${{ secrets.REGISTRY_PASSWORD }}" | \
          podman login ${{ env.REGISTRY }} -u ${{ secrets.REGISTRY_USERNAME }} --password-stdin

      - name: Push Image
        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
        run: |
          podman push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
          podman push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest

  deploy:
    needs: build
    runs-on: self-hosted
    if: github.ref == 'refs/heads/main'
    steps:
      - name: Deploy to Production
        run: |
          # 更新 Quadlet 服务的镜像标签
          sed -i "s|Image=.*|Image=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}|" \
            ~/.config/containers/systemd/app.container

          systemctl --user daemon-reload
          systemctl --user restart app.service

          # 等待健康检查通过
          sleep 30
          systemctl --user is-active app.service

# 配置 Quadlet AutoUpdate
# app.container 中设置：
[Container]
AutoUpdate=registry

# 启用定时更新检查
systemctl --user enable --now podman-auto-update.timer

# 手动检查更新
podman auto-update --dry-run

# 执行更新
podman auto-update

# 更新后验证健康状态
podman auto-update --dry-run 2>&1 | grep -E "(updated|failed)"

# 配置日志驱动（~/.config/containers/containers.conf）
[containers]
log_driver = "journald"

# 查看容器日志
journalctl --user -u app.service -f

# 结构化日志查询
journalctl --user -u app.service \
    --since "1 hour ago" \
    --output json-pretty \
    | jq 'select(.PRIORITY <= 4)'  # 只看警告和错误

# 日志轮转（在 containers.conf 中配置）
[containers]
log_driver = "k8s-file"

[engine]
# k8s-file 日志驱动选项
[engine.options]
max_size = "10m"
max_file = "3"

# 实时资源使用
podman stats --no-stream

# 格式化输出
podman stats --no-stream --format "table {{.Name}}\t{{.CPUPerc}}\t{{.MemUsage}}\t{{.NetIO}}\t{{.BlockIO}}"

# 导出为 Prometheus 指标
# 使用 cadvisor 或 podman-exporter
podman run -d \
    --name cadvisor \
    -v /:/rootfs:ro \
    -v /var/run:/var/run:ro \
    -v /sys:/sys:ro \
    -v /var/lib/containers:/var/lib/containers:ro \
    -p 8081:8080 \
    gcr.io/cadvisor/cadvisor:latest

# 在 Quadlet 中配置健康检查
[Container]
HealthCmd=curl -sf http://localhost:8080/health || exit 1
HealthInterval=30s
HealthTimeout=5s
HealthRetries=3
HealthStartPeriod=60s

# systemd 重启策略
[Service]
Restart=always
RestartSec=10
StartLimitIntervalSec=300
StartLimitBurst=5

# 查看健康状态
podman inspect --format '{{.State.Health.Status}}' app

# 手动触发健康检查
podman healthcheck run app

# /etc/containers/containers.conf — 系统级安全配置
[containers]
# 默认使用只读根文件系统
read_only = true

# 默认 seccomp profile
seccomp_profile = "/etc/containers/seccomp.json"

# 默认 AppArmor profile
# apparmor_profile = "containers-default"

[engine]
# 禁止特权容器
# privileged = false  # Podman 不支持全局禁止，需要策略

# 默认 no-new-privileges
no_new_privileges = true

#!/bin/bash
# compliance-audit.sh — 容器合规性审计

REPORT_FILE="/tmp/compliance-report-$(date +%Y%m%d).txt"
echo "合规性审计报告 - $(date)" > $REPORT_FILE

echo "=== 特权容器检查 ===" >> $REPORT_FILE
podman ps --format '{{.Names}}' | while read name; do
    priv=$(podman inspect "$name" --format '{{.HostConfig.Privileged}}')
    [ "$priv" = "true" ] && echo "FAIL: $name 是特权容器" >> $REPORT_FILE
done

echo "=== Root 用户检查 ===" >> $REPORT_FILE
podman ps --format '{{.Names}}' | while read name; do
    user=$(podman inspect "$name" --format '{{.Config.User}}')
    if [ -z "$user" ] || [ "$user" = "0" ]; then
        echo "WARN: $name 以 root 运行" >> $REPORT_FILE
    fi
done

echo "=== 特权端口检查 ===" >> $REPORT_FILE
podman ps --format '{{.Names}} {{.Ports}}' | while read name ports; do
    if echo "$ports" | grep -qE '0\.0\.0\.0:(80|443|22|25|21):'; then
        echo "WARN: $name 绑定了特权端口" >> $REPORT_FILE
    fi
done

echo "=== 镜像版本检查 ===" >> $REPORT_FILE
podman images --format '{{.Repository}}:{{.Tag}}' | while read img; do
    if echo "$img" | grep -q ":latest$"; then
        echo "WARN: $img 使用了 latest 标签" >> $REPORT_FILE
    fi
done

echo "报告已生成: $REPORT_FILE"
cat $REPORT_FILE

#!/bin/bash
# backup-containers.sh — 容器数据备份

BACKUP_DIR="/backup/containers/$(date +%Y%m%d)"
mkdir -p $BACKUP_DIR

# 备份所有命名卷
podman volume ls --format '{{.Name}}' | while read vol; do
    echo "备份卷: $vol"
    podman run --rm \
        -v ${vol}:/source:ro,Z \
        -v ${BACKUP_DIR}:/backup:Z \
        busybox \
        tar czf /backup/vol-${vol}.tar.gz /source
done

# 备份 Quadlet 配置
tar czf ${BACKUP_DIR}/quadlet-config.tar.gz \
    ~/.config/containers/systemd/

# 备份容器配置（inspect 输出）
podman ps --format '{{.Names}}' | while read name; do
    podman inspect $name > ${BACKUP_DIR}/${name}-inspect.json
done

echo "备份完成: ${BACKUP_DIR}"

#!/bin/bash
# restore-containers.sh — 容器数据恢复

BACKUP_DIR=$1  # 备份目录路径

# 恢复卷数据
for backup in ${BACKUP_DIR}/vol-*.tar.gz; do
    vol_name=$(basename $backup .tar.gz | sed 's/vol-//')
    echo "恢复卷: $vol_name"
    podman volume create $vol_name
    podman run --rm \
        -v ${vol_name}:/target:Z \
        -v $(realpath $backup):/backup.tar.gz:ro,Z \
        busybox \
        sh -c 'cd /target && tar xzf /backup.tar.gz --strip-components=1'
done

# 恢复 Quadlet 配置
tar xzf ${BACKUP_DIR}/quadlet-config.tar.gz -C ~/

# 重新加载 systemd
systemctl --user daemon-reload

echo "恢复完成，请手动启动服务"

# 使用 overlay2 存储驱动（性能最佳）
# ~/.config/containers/storage.conf
[storage]
driver = "overlay"

[storage.options.overlay]
# 启用 metacopy（性能优化，需内核支持）
mountopt = "nodev,metacopy=on"

# 使用 SSD 作为存储后端
# graphRoot = "/mnt/ssd/containers/storage"

# 使用 pasta 替代 slirp4netns（Rootless 网络性能优化）
# ~/.config/containers/containers.conf
[containers]
netns = "pasta"

# 或指定特定容器使用 pasta
podman run --network pasta:--mtu,1500 myapp

# 使用 crun 替代 runc（内存占用减少约 50%）
# ~/.config/containers/containers.conf
[engine]
runtime = "crun"

# 限制容器内存（防止 OOM）
podman run --memory 512m --memory-swap 1g myapp

# 查看所有服务状态
systemctl --user list-units 'container-*'

# 查看资源使用
podman stats --no-stream

# 查看镜像更新
podman auto-update --dry-run

# 清理资源
podman system prune -a --volumes

# 查看日志
journalctl --user -u container-app -f --since "1h ago"

# 备份
./backup-containers.sh

# 安全审计
./compliance-audit.sh

# 1. 检查容器状态
podman ps -a
podman inspect <container>

# 2. 查看日志
podman logs --tail 100 <container>
journalctl --user -u container-<name> -e

# 3. 检查资源
podman stats
df -h ~/.local/share/containers/storage/

# 4. 进入容器调试
podman exec -it <container> /bin/sh

# 5. 检查网络
podman network ls
podman network inspect <network>

# 6. 检查存储
podman volume ls
podman system df

# 7. 重启服务
systemctl --user restart container-<name>

# 8. 查看 systemd 状态
systemctl --user status container-<name>

# 日常最常用命令
podman run -d --name app -p 8080:80 myapp:v1    # 运行容器
podman ps -a                                       # 查看容器
podman logs -f app                                 # 查看日志
podman exec -it app /bin/sh                        # 进入容器
podman build -t myapp:v1 .                         # 构建镜像
podman-compose up -d                               # Compose 编排
systemctl --user status container-app              # 查看服务状态
podman auto-update                                 # 检查镜像更新