From e20133a177b32f73a5ee365ac5c733d61e4a5ea7 Mon Sep 17 00:00:00 2001 From: Codex Bot Date: Wed, 16 Sep 2026 04:01:06 +0800 Subject: [PATCH] Fix Compose tmpfs options and validate stack configuration --- compose.yml | 2 +- scripts/compose_stack.sh | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 14cf7aa..df44e8d 100644 --- a/compose.yml +++ b/compose.yml @@ -4,7 +4,7 @@ x-app: &app read_only: true cap_drop: [ALL] security_opt: [no-new-privileges:true] - tmpfs: [/tmp:rw,noexec,nosuid,size=64m] + tmpfs: ['/tmp:rw,noexec,nosuid,size=64m'] mem_limit: 512m pids_limit: 128 volumes: [config:/config] diff --git a/scripts/compose_stack.sh b/scripts/compose_stack.sh index 2e380bd..04f96fc 100755 --- a/scripts/compose_stack.sh +++ b/scripts/compose_stack.sh @@ -11,6 +11,7 @@ if [[ "$mode" == ci ]]; then export POSTGRES_PASSWORD POSTGRES_PASSWORD=$(python3 -c 'import secrets; print(secrets.token_urlsafe(48))') unset CONFIG_VOLUME CONFIG_EXTERNAL + docker compose -f compose.yml --profile ci config --quiet # Only this unique disposable CI project is removed, including its volumes. trap 'docker compose -f compose.yml --profile ci down --volumes --remove-orphans >/dev/null' EXIT docker compose -f compose.yml --profile ci run --rm integration @@ -53,6 +54,7 @@ fi # Capture a persistent random password in memory; never echo it or use shell tracing. export POSTGRES_PASSWORD POSTGRES_PASSWORD=$(docker run --rm --volume "$CONFIG_VOLUME:/config" --entrypoint python "$DEPLOY_IMAGE" -c 'from pathlib import Path; from adcloud_server.container_entrypoint import bootstrap; print(bootstrap(Path("/config/identity.env"))["POSTGRES_PASSWORD"])') +docker compose -f compose.yml config --quiet # Initialize databases before switching the public API port. docker compose -f compose.yml up -d postgres cassandra docker compose -f compose.yml run --rm cassandra-init