Initial commit: DSH Web Manager

2026-10-13 09:34:47 +08:00
commit 85332bbc56
135 changed files with 19712 additions and 0 deletions
@@ -0,0 +1,25 @@
+#!/bin/bash
+set -Eeuo pipefail
+image_id=$(docker image inspect --format '{{.Id}}' "$1")
+expected_version=$(docker image inspect --format '{{index .Config.Labels "dsh-mgr.version"}}' "$image_id")
+[[ -n "$expected_version" && "$expected_version" != '<no value>' ]] || { echo 'FAIL: missing version label.' >&2; exit 1; }
+container_id=$(docker run -d --read-only --cap-drop ALL --security-opt no-new-privileges --memory 2g --cpus 2 --pids-limit 256 --tmpfs /tmp:rw,exec,nosuid,nodev,size=256m --tmpfs /data/dsh-home:rw,uid=1000,gid=1000,size=512m --tmpfs /workspace:rw,uid=1000,gid=1000,size=64m "$image_id")
+cleanup() { docker rm -f "$container_id" >/dev/null; }
+trap cleanup EXIT
+for ((attempt=0; attempt<60; attempt++)); do
+    if [[ $(docker inspect --format '{{.State.Running}}' "$container_id") != true ]]; then
+        echo 'FAIL: runtime exited before readiness.' >&2
+        exit 1
+    fi
+    if docker logs "$container_id" 2>&1 | grep 'dsh web:.*token=' >/dev/null; then
+        docker exec "$container_id" node -e 'fetch("http://127.0.0.1:8080/").then(r=>{console.log("Proxy HTTP status:",r.status);process.exit(r.status>=500?1:0)}).catch(()=>process.exit(1))'
+        actual_version=$(docker exec "$container_id" dsh --version)
+        [[ "$actual_version" == "$expected_version" ]] || { echo 'FAIL: CLI version does not match image label.' >&2; exit 1; }
+        printf 'Verified DSH version: %s\n' "$actual_version"
+        echo 'PASS: readiness under read-only rootfs, non-root and dropped capabilities.'
+        exit 0
+    fi
+    sleep 1
+done
+echo 'FAIL: readiness timeout; credential-bearing logs were not printed.' >&2
+exit 1