fix(sandbox): round-3 探针改 pinned 版本直下,绕开被墙的版本解析(bump 0.58.7)
@stable tag 要先访问 Google last-known-good 版本解析端点(被墙)才换到具体 版本号,--base-url 只管二进制下载不管解析 —— 这是上一轮三源全败的真因。 改从镜像内 puppeteer-core revisions.js 读 pinned chrome-headless-shell 版本 直下阿里 binary 源(且正是 mermaid-cli CI 实测版本);错误输出 grep Error 行; 加 [步骤] 参数支持只跑第 3 步(1/2 已有结论:静默 CHECK 无 FATAL、栈无符号、 CPU 无 pku/shstk/ibt)。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
parent
0631aa4a4f
commit
9f78b151c1
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
> 配合 `DESIGN.md`。本文件只记 phase 状态、决策偏差、文件量、下一步。每条 1-2 句:做了啥 + 关键判断;细节查 `git log` / `git diff` / `DESIGN §7.9`。
|
||||
|
||||
最后更新:2026-07-11(round-3 探针下载源改阿里,bump 0.58.6)
|
||||
最后更新:2026-07-11(round-3 探针改 pinned 版本直下,绕开被墙的版本解析端点,bump 0.58.7)
|
||||
|
||||
---
|
||||
|
||||
|
|
@ -23,6 +23,7 @@
|
|||
|
||||
### 2026-07
|
||||
|
||||
- **07-11 / 0.58.7**:round-3 第 3 步改从镜像内 puppeteer-core `revisions.js` 读 pinned 版本号直下(`@stable` tag 需先访问 Google 版本解析端点——被墙,上一轮三源全败的真因;`--base-url` 只管二进制不管解析),错误输出改 grep Error 行;加 `[步骤]` 参数支持只跑第 3 步。round-1/2 结论沉淀:崩溃无 FATAL 行(静默 CHECK)、gdb 栈无符号、CPU 无 pku/shstk/ibt(排除新安全特性交互)。
|
||||
- **07-11 / 0.58.6**:round-3 探针下载源修正——npx 拉 `@puppeteer/browsers` 显式走阿里 npm registry,chrome-for-testing 二进制按 阿里 CDN → 阿里 registry binary → 官方 三级 fallback(服务器实测默认源下不动)。
|
||||
- **07-11 / 0.58.5**:**chromium 秒崩 round-3 探针**:bisect 结果全 case FAIL(含 baseline 无 hardening、seccomp=unconfined)→ hardening 全部无罪,宿主 overcommit/ulimit 数据也干净——嫌疑收敛为 trixie chromium 150 构建 × 本宿主组合本身跑不了。新 `deploy/sandbox/probe_chromium_round3.sh`:①抓崩溃 FATAL 行(此前日志被 head 截断)+ gdb backtrace(best-effort);②实测 Google 官方 chrome-headless-shell(npmmirror 下载,puppeteer 生态对着它测试)在本宿主能否跑 + mmdc 接上出图——直接验证「镜像弃发行版 chromium 改 pinned headless shell」修法可行性,PASS 即定案动 Dockerfile。
|
||||
- **07-11 / 0.58.4**:**mermaid 崩塌第二根因排查工具 `deploy/sandbox/probe_chromium_bisect.sh`**:pids-limit 1024 部署后复测(同 task 9dcae061,green 实例全新容器)仍首调秒崩——排除 pids 打满,根因在 hardening flag × chromium 150 交互。探针把线上 docker run 全款 hardening 逐 flag 开关(no-new-privileges / read-only / cap-drop / mem·cpu / seccomp=unconfined),每 case 跑 mmdc + 裸 chromium 两条,忠实复现 exec 路径(--user zcbot + HOME=/tmp),尾部带判读表;RUN.md 故障兜底条目同步。
|
||||
|
|
|
|||
|
|
@ -1,3 +1,3 @@
|
|||
# zcbot 版本号单一事实源:web/app.py 的 FastAPI version、/healthz 返回、前端展示都引这里。
|
||||
# 改版本只动这一行。
|
||||
__version__ = "0.58.6"
|
||||
__version__ = "0.58.7"
|
||||
|
|
|
|||
|
|
@ -4,10 +4,13 @@
|
|||
# 1/2. 拿到崩溃的真实 FATAL 行 + gdb backtrace(此前日志被 head 截断,一直没见到)
|
||||
# 3. 实测 Google 官方 chrome-headless-shell 在本宿主能否跑 —— 直接验证
|
||||
# 「镜像弃发行版 chromium、改装 puppeteer pinned headless shell」修法的可行性
|
||||
# 用法(服务器 repo 根): bash deploy/sandbox/probe_chromium_round3.sh [镜像名]
|
||||
# 用法(服务器 repo 根): bash deploy/sandbox/probe_chromium_round3.sh [镜像名] [步骤]
|
||||
# 步骤 = all(默认)/ 3(只跑第 3 步 headless-shell 实测)
|
||||
set -u
|
||||
IMG="${1:-zcbot-sandbox:latest}"
|
||||
STEP="${2:-all}"
|
||||
|
||||
if [ "$STEP" = "all" ]; then
|
||||
echo "===== 1. 崩溃日志尾部(找 FATAL/CHECK 行) ====="
|
||||
docker run --rm --user zcbot -e HOME=/tmp --entrypoint bash "$IMG" -c '
|
||||
/usr/lib/chromium/chromium --no-sandbox --headless --disable-gpu --disable-dev-shm-usage \
|
||||
|
|
@ -30,27 +33,35 @@ docker run --rm --entrypoint bash "$IMG" -c '
|
|||
else
|
||||
echo "[SKIP] apt 装 gdb 失败(容器网络不通?)"
|
||||
fi'
|
||||
fi
|
||||
|
||||
echo
|
||||
echo "===== 3. Google 官方 chrome-headless-shell 实测(验证修法 A) ====="
|
||||
docker run --rm --user zcbot -e HOME=/tmp --entrypoint bash "$IMG" -c '
|
||||
set -u
|
||||
cd /tmp
|
||||
# npm 包源走阿里(npx 拉 @puppeteer/browsers 包本身);二进制源三级 fallback:
|
||||
# 阿里 CDN -> 阿里 registry binary 路径 -> Google 官方
|
||||
# npm 包源走阿里(npx 拉 @puppeteer/browsers 包本身)
|
||||
export npm_config_registry="https://registry.npmmirror.com"
|
||||
# 版本号从镜像内 puppeteer-core 锁定的 revisions 读 —— 不用 @stable:stable tag
|
||||
# 要先访问 Google 的 last-known-good 版本解析端点(被墙,上一轮三源全败的真因,
|
||||
# --base-url 只管二进制下载不管版本解析);pinned 版本还正好是 mermaid-cli CI
|
||||
# 实测过的那个。
|
||||
PC=/usr/local/lib/node_modules/@mermaid-js/mermaid-cli/node_modules/puppeteer-core
|
||||
VER=$(node -e "console.log(require(\"$PC/lib/cjs/puppeteer/revisions.js\").PUPPETEER_REVISIONS[\"chrome-headless-shell\"])" 2>/dev/null \
|
||||
|| grep -rhoE "chrome-headless-shell.{0,4}[0-9]+\.[0-9.]+" "$PC/lib" 2>/dev/null | grep -oE "[0-9]+\.[0-9.]+" | head -1)
|
||||
[ -n "$VER" ] || { echo "[FAIL] 从 $PC 读不到 pinned 版本号"; exit 1; }
|
||||
echo "pinned chrome-headless-shell version: $VER"
|
||||
ok=""
|
||||
for BASE in "https://cdn.npmmirror.com/binaries/chrome-for-testing" \
|
||||
"https://registry.npmmirror.com/-/binary/chrome-for-testing" \
|
||||
""; do
|
||||
echo "[download] chrome-headless-shell@stable base-url=${BASE:-官方} ..."
|
||||
if npx -y @puppeteer/browsers install chrome-headless-shell@stable \
|
||||
--path /tmp/pptr ${BASE:+--base-url "$BASE"} >/tmp/dl.log 2>&1; then
|
||||
"https://registry.npmmirror.com/-/binary/chrome-for-testing"; do
|
||||
echo "[download] chrome-headless-shell@$VER base-url=$BASE ..."
|
||||
if npx -y @puppeteer/browsers install "chrome-headless-shell@$VER" \
|
||||
--path /tmp/pptr --base-url "$BASE" >/tmp/dl.log 2>&1; then
|
||||
ok=1; break
|
||||
fi
|
||||
tail -2 /tmp/dl.log
|
||||
grep -aE "Error|ENOTFOUND|ECONNRE|ETIMEDOUT|404|403" /tmp/dl.log | head -3
|
||||
done
|
||||
[ -n "$ok" ] || { echo "[FAIL] 三个源都下不动"; tail -5 /tmp/dl.log; exit 1; }
|
||||
[ -n "$ok" ] || { echo "[FAIL] 阿里两个 binary 源都失败,完整日志尾部:"; tail -8 /tmp/dl.log; exit 1; }
|
||||
BIN=$(find /tmp/pptr -type f -name chrome-headless-shell | head -1)
|
||||
[ -n "$BIN" ] || { echo "[FAIL] 下载完成但没找到二进制"; exit 1; }
|
||||
echo "BIN=$BIN"
|
||||
|
|
|
|||
Loading…
Reference in New Issue