From 404ca3110892b617b7ffd7864bc4d8275a3f0007 Mon Sep 17 00:00:00 2001 From: cxhello Date: Tue, 26 May 2026 14:09:12 +0800 Subject: [PATCH 01/12] chore(config): disable AI pipeline in standard/slim images AI features (ai-pipeline, skill-scanner, anonymous AI access) are now hardcoded to false in the default application.properties. Users who need AI features should use the -ai tagged image. Signed-off-by: cxhello --- build/conf/application.properties | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/build/conf/application.properties b/build/conf/application.properties index bdfbb45..61398a7 100644 --- a/build/conf/application.properties +++ b/build/conf/application.properties @@ -258,7 +258,7 @@ nacos.core.auth.plugin.nacos.token.expire.seconds=${NACOS_AUTH_TOKEN_EXPIRE_SECO nacos.core.auth.plugin.nacos.token.secret.key=${NACOS_AUTH_TOKEN:} ### Allow anonymous read access, default `false`, current only ai(skill, agentspec) supported. -nacos.core.auth.nacos.anonymous.ai.enabled=${NACOS_AUTH_ALLOW_ANONYMOUS_AI_ENABLED:false} +nacos.core.auth.nacos.anonymous.ai.enabled=false ### worked when nacos.core.auth.system.type=ldap?{0} is Placeholder,replace login username #nacos.core.auth.ldap.url=ldap://localhost:389 @@ -301,9 +301,9 @@ nacos.istio.mcp.server.enabled=false #*************** AI Publish Pipeline Configurations ***************# # Optional: total switch for ai-pipeline plugin. -nacos.plugin.ai-pipeline.enabled=true -nacos.plugin.ai-pipeline.type=skill-scanner -nacos.plugin.ai-pipeline.skill-scanner.enabled=${NACOS_AI_PIPELINE_SKILL_SCANNER_ENABLED:true} +# AI pipeline is disabled in standard/slim images. Use the `-ai` tagged image for AI features. +nacos.plugin.ai-pipeline.enabled=false +nacos.plugin.ai-pipeline.skill-scanner.enabled=false #--------------- Nacos Experimental Features Configurations ---------------# From a72abd79af71f2fac4b69c745bdf585925ab4a64 Mon Sep 17 00:00:00 2001 From: cxhello Date: Tue, 26 May 2026 14:10:30 +0800 Subject: [PATCH 02/12] feat(config): add application-ai.properties for AI image Separate config file with AI features enabled: ai-pipeline, skill-scanner, anonymous AI access, and MCP registry default to true. Signed-off-by: cxhello --- build/conf/application-ai.properties | 317 +++++++++++++++++++++++++++ 1 file changed, 317 insertions(+) create mode 100644 build/conf/application-ai.properties diff --git a/build/conf/application-ai.properties b/build/conf/application-ai.properties new file mode 100644 index 0000000..c3c4853 --- /dev/null +++ b/build/conf/application-ai.properties @@ -0,0 +1,317 @@ +# +# Copyright 1999-2025 Alibaba Group Holding Ltd. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +#--------------- Nacos Common Configurations ---------------# + +#*************** Nacos port Related Configurations ***************# +### Nacos Server Main port +nacos.server.main.port=${NACOS_APPLICATION_PORT:8848} + +#*************** Network Related Configurations ***************# +### If prefer hostname over ip for Nacos server addresses in cluster.conf: +# nacos.inetutils.prefer-hostname-over-ip=false + +### Specify local server's IP: +# nacos.inetutils.ip-address= + +#*************** Datasource Related Configurations ***************# +### nacos.plugin.datasource.log.enabled=true +spring.sql.init.platform=${SPRING_DATASOURCE_PLATFORM:} +### Count of DB: +# db.num=1 + +### Connect URL of DB: +db.num=${MYSQL_DATABASE_NUM:1} +db.url.0=jdbc:mysql://${MYSQL_SERVICE_HOST}:${MYSQL_SERVICE_PORT:3306}/${MYSQL_SERVICE_DB_NAME}?${MYSQL_SERVICE_DB_PARAM:characterEncoding=utf8&connectTimeout=1000&socketTimeout=3000&autoReconnect=true&useSSL=false} +db.user.0=${MYSQL_SERVICE_USER} +db.password.0=${MYSQL_SERVICE_PASSWORD} + +db.pool.config.connectionTimeout=${DB_POOL_CONNECTION_TIMEOUT:30000} +db.pool.config.validationTimeout=10000 +db.pool.config.maximumPoolSize=20 +db.pool.config.minimumIdle=2 + +#*************** Metrics Related Configurations ***************# +### Metrics for prometheus +management.endpoints.web.exposure.include=prometheus + +### Metrics for elastic search +management.metrics.export.elastic.enabled=false +#management.metrics.export.elastic.host=http://localhost:9200 + +### Metrics for influx +management.metrics.export.influx.enabled=false +#management.metrics.export.influx.db=springboot +#management.metrics.export.influx.uri=http://localhost:8086 +#management.metrics.export.influx.auto-create-db=true +#management.metrics.export.influx.consistency=one +#management.metrics.export.influx.compressed=true + +#*************** Core Related Configurations ***************# + +### set the WorkerID manually +# nacos.core.snowflake.worker-id= + +### Member-MetaData +# nacos.core.member.meta.site= +# nacos.core.member.meta.adweight= +# nacos.core.member.meta.weight= + +### MemberLookup +### Addressing pattern category, If set, the priority is highest +# nacos.core.member.lookup.type=[file,address-server] + +## Set the cluster list with a configuration file or command-line argument +# nacos.member.list=192.168.16.101:8847?raft_port=8807,192.168.16.101?raft_port=8808,192.168.16.101:8849?raft_port=8809 + +## for AddressServerMemberLookup +# Maximum number of retries to query the address server upon initialization +# nacos.core.address-server.retry=5 +## Server domain name address of [address-server] mode +# address.server.domain=jmenv.tbsite.net +## Server port of [address-server] mode +# address.server.port=8080 +## Request address of [address-server] mode +# address.server.url=/nacos/serverlist + +#*************** JRaft Related Configurations ***************# + +### Sets the Raft cluster election timeout, default value is 5 second +# nacos.core.protocol.raft.data.election_timeout_ms=5000 +### Sets the amount of time the Raft snapshot will execute periodically, default is 30 minute +# nacos.core.protocol.raft.data.snapshot_interval_secs=30 +### raft internal worker threads +# nacos.core.protocol.raft.data.core_thread_num=8 +### Number of threads required for raft business request processing +# nacos.core.protocol.raft.data.cli_service_thread_num=4 +### raft linear read strategy. Safe linear reads are used by default, that is, the Leader tenure is confirmed by heartbeat +# nacos.core.protocol.raft.data.read_index_type=ReadOnlySafe +### rpc request timeout, default 5 seconds +# nacos.core.protocol.raft.data.rpc_request_timeout_ms=5000 +### enable to support prometheus service discovery +#nacos.prometheus.metrics.enabled=true + +#*************** Distro Related Configurations ***************# + +### Distro data sync delay time, when sync task delayed, task will be merged for same data key. Default 1 second. +# nacos.core.protocol.distro.data.sync.delayMs=1000 +### Distro data sync timeout for one sync data, default 3 seconds. +# nacos.core.protocol.distro.data.sync.timeoutMs=3000 +### Distro data sync retry delay time when sync data failed or timeout, same behavior with delayMs, default 3 seconds. +# nacos.core.protocol.distro.data.sync.retryDelayMs=3000 +### Distro data verify interval time, verify synced data whether expired for a interval. Default 5 seconds. +# nacos.core.protocol.distro.data.verify.intervalMs=5000 +### Distro data verify timeout for one verify, default 3 seconds. +# nacos.core.protocol.distro.data.verify.timeoutMs=3000 +### Distro data load retry delay when load snapshot data failed, default 30 seconds. +# nacos.core.protocol.distro.data.load.retryDelayMs=30000 +### enable to support prometheus service discovery +#nacos.prometheus.metrics.enabled=true + +#*************** Grpc Configurations ***************# + +### Sets the maximum message size allowed to be received on the server. +#nacos.remote.server.grpc.sdk.max-inbound-message-size=10485760 +### Sets the time(milliseconds) without read activity before sending a keepalive ping. The typical default is two hours. +#nacos.remote.server.grpc.sdk.keep-alive-time=7200000 +### Sets a time(milliseconds) waiting for read activity after sending a keepalive ping. Defaults to 20 seconds. +#nacos.remote.server.grpc.sdk.keep-alive-timeout=20000 +### Sets a time(milliseconds) that specify the most aggressive keep-alive time clients are permitted to configure. The typical default is 5 minutes +#nacos.remote.server.grpc.sdk.permit-keep-alive-time=300000 +### cluster grpc(inside the nacos server) configuration +#nacos.remote.server.grpc.cluster.max-inbound-message-size=10485760 +### Sets the time(milliseconds) without read activity before sending a keepalive ping. The typical default is two hours. +#nacos.remote.server.grpc.cluster.keep-alive-time=7200000 +### Sets a time(milliseconds) waiting for read activity after sending a keepalive ping. Defaults to 20 seconds. +#nacos.remote.server.grpc.cluster.keep-alive-timeout=20000 +### Sets a time(milliseconds) that specify the most aggressive keep-alive time clients are permitted to configure. The typical default is 5 minutes +#nacos.remote.server.grpc.cluster.permit-keep-alive-time=300000 + +#*************** Config Module Related Configurations ***************# + +### the maximum retry times for push +nacos.config.push.maxRetryTime=50 + +#*************** Naming Module Related Configurations ***************# +### Data dispatch task execution period in milliseconds: + +### If enable data warmup. If set to false, the server would accept request without local data preparation: +nacos.naming.data.warmup=true + +### If enable the instance auto expiration, kind like of health check of instance: +# nacos.naming.expireInstance=true + +nacos.naming.empty-service.auto-clean=true +nacos.naming.empty-service.clean.initial-delay-ms=50000 +nacos.naming.empty-service.clean.period-time-ms=30000 + +### Whether nacos mcp registry is enabled, default is false. +### When enabled=true, Nacos will start a `mcp registry` server with new port with `nacos.ai.mcp.registry.port` +nacos.ai.mcp.registry.enabled=${NACOS_AI_REGISTRY_ENABLED:true} + +### Nacos mcp registry port, default 9080: +nacos.ai.mcp.registry.port=${NACOS_AI_REGISTRY_PORT:9080} + +#--------------- Nacos Web Server Configurations ---------------# + +#*************** Nacos Web Server Related Configurations ***************# +### Nacos Server Web context path: +nacos.server.contextPath=${SERVER_SERVLET_CONTEXTPATH:/nacos} + +#*************** Access Log Related Configurations ***************# +### If turn on the access log: +server.tomcat.accesslog.enabled=true + +### accesslog automatic cleaning time +server.tomcat.accesslog.max-days=30 + +### The access log pattern: +server.tomcat.accesslog.pattern=%h %l %u %t "%r" %s %b %D %{User-Agent}i %{Request-Source}i + +### The directory of access log: +server.tomcat.basedir=file:. + +#*************** API Related Configurations ***************# +### Include message field +server.error.include-message=ALWAYS + +### Enabled for open API compatibility +# nacos.core.api.compatibility.client.enabled=true +### Enabled for admin API compatibility +# nacos.core.api.compatibility.admin.enabled=false +### Enabled for console API compatibility +# nacos.core.api.compatibility.console.enabled=false + +#--------------- Nacos Console Configurations ---------------# + +#*************** Nacos Console Related Configurations ***************# +### Nacos Console Main port +nacos.console.port=${NACOS_CONSOLE_PORT:8080} +### Nacos Server Web context path: +nacos.console.contextPath=${NACOS_CONSOLE_CONTEXTPATH:} + +### Nacos Server context path, which link to nacos server `nacos.server.contextPath`, works when deployment type is `console` +nacos.console.remote.server.context-path=${SERVER_SERVLET_CONTEXTPATH:/nacos} + +#************** Console UI Configuration ***************# + +### Turn on/off the nacos console ui. +nacos.console.ui.enabled=true + +#--------------- Nacos Plugin Configurations ---------------# + +#*************** CMDB Plugin Related Configurations ***************# +### The interval to dump external CMDB in seconds: +# nacos.cmdb.dumpTaskInterval=3600 + +### The interval of polling data change event in seconds: +# nacos.cmdb.eventTaskInterval=10 + +### The interval of loading labels in seconds: +# nacos.cmdb.labelTaskInterval=300 + +### If turn on data loading task: +# nacos.cmdb.loadDataAtStart=false + +#*************** Auth Plugin Related Configurations ***************# +### The ignore urls of auth, will be deprecated in the future: +nacos.security.ignore.urls=${NACOS_SECURITY_IGNORE_URLS:/,/error,/**/*.css,/**/*.js,/**/*.html,/**/*.map,/**/*.svg,/**/*.png,/**/*.ico,/console-fe/public/**,/v1/auth/**,/v1/console/health/**,/actuator/**,/v1/console/server/**} + +### The auth system to use, default 'nacos' and 'ldap' is supported, other type should be implemented by yourself: +nacos.core.auth.system.type=${NACOS_AUTH_SYSTEM_TYPE:nacos} + +### If turn on auth system: +# Whether open nacos server API auth system +nacos.core.auth.enabled=false +# Whether open nacos admin API auth system +nacos.core.auth.admin.enabled=true +# Whether open nacos console API auth system +nacos.core.auth.console.enabled=true + +### Turn on/off caching of auth information. By turning on this switch, the update of auth information would have a 15 seconds delay. +nacos.core.auth.caching.enabled=${NACOS_AUTH_CACHE_ENABLE:false} + +### worked when nacos.core.auth.enabled=true +### The two properties is the white list for auth and used by identity the request from other server. +nacos.core.auth.server.identity.key=${NACOS_AUTH_IDENTITY_KEY:} +nacos.core.auth.server.identity.value=${NACOS_AUTH_IDENTITY_VALUE:} + +### worked when nacos.core.auth.system.type=nacos or nacos.core.auth.console.enabled=true +### The token expiration in seconds: +nacos.core.auth.plugin.nacos.token.cache.enable=false +nacos.core.auth.plugin.nacos.token.expire.seconds=${NACOS_AUTH_TOKEN_EXPIRE_SECONDS:18000} +### The default token (Base64 string): +#nacos.core.auth.plugin.nacos.token.secret.key=VGhpc0lzTXlDdXN0b21TZWNyZXRLZXkwMTIzNDU2Nzg= +nacos.core.auth.plugin.nacos.token.secret.key=${NACOS_AUTH_TOKEN:} + +### Allow anonymous read access, default `false`, current only ai(skill, agentspec) supported. +nacos.core.auth.nacos.anonymous.ai.enabled=${NACOS_AUTH_ALLOW_ANONYMOUS_AI_ENABLED:true} + +### worked when nacos.core.auth.system.type=ldap?{0} is Placeholder,replace login username +#nacos.core.auth.ldap.url=ldap://localhost:389 +#nacos.core.auth.ldap.basedc=dc=example,dc=org +#nacos.core.auth.ldap.userDn=cn=admin,${nacos.core.auth.ldap.basedc} +#nacos.core.auth.ldap.password=admin +#nacos.core.auth.ldap.userdn=cn={0},dc=example,dc=org +#nacos.core.auth.ldap.filter.prefix=uid +#nacos.core.auth.ldap.case.sensitive=true +#nacos.core.auth.ldap.ignore.partial.result.exception=false + +#*************** Control Plugin Related Configurations ***************# +# plugin type +#nacos.plugin.control.manager.type=nacos + +# local control rule storage dir, default ${nacos.home}/data/connection and ${nacos.home}/data/tps +#nacos.plugin.control.rule.local.basedir=${nacos.home} + +# external control rule storage type, if exist +#nacos.plugin.control.rule.external.storage= + +#*************** Config Change Plugin Related Configurations ***************# +# webhook +#nacos.core.config.plugin.webhook.enabled=false +# It is recommended to use EB https://help.aliyun.com/document_detail/413974.html +#nacos.core.config.plugin.webhook.url=http://localhost:8080/webhook/send?token=*** +# The content push max capacity ,byte +#nacos.core.config.plugin.webhook.contentMaxCapacity=102400 + +# whitelist +#nacos.core.config.plugin.whitelist.enabled=false +# The import file suffixs +#nacos.core.config.plugin.whitelist.suffixs=xml,text,properties,yaml,html +# fileformatcheck,which validate the import file of type and content +#nacos.core.config.plugin.fileformatcheck.enabled=false + +#*************** Istio Plugin Related Configurations ***************# +### If turn on the MCP server: +nacos.istio.mcp.server.enabled=false + +#*************** AI Publish Pipeline Configurations ***************# +# Optional: total switch for ai-pipeline plugin. +# AI pipeline is enabled in the -ai tagged image. +nacos.plugin.ai-pipeline.enabled=true +nacos.plugin.ai-pipeline.type=skill-scanner +nacos.plugin.ai-pipeline.skill-scanner.enabled=${NACOS_AI_PIPELINE_SKILL_SCANNER_ENABLED:true} + +#--------------- Nacos Experimental Features Configurations ---------------# + +#*************** K8s Related Configurations ***************# +### If turn on the K8s sync: +nacos.k8s.sync.enabled=false + +### If use the Java API from an application outside a kubernetes cluster +#nacos.k8s.sync.outsideCluster=false +#nacos.k8s.sync.kubeConfig=/.kube/config From 3993c89e437463415ec14d0054c4cfabb0a0e17f Mon Sep 17 00:00:00 2001 From: cxhello Date: Tue, 26 May 2026 14:11:32 +0800 Subject: [PATCH 03/12] refactor(startup): remove JDK 8 dead code branch All Docker images now use JDK 17 exclusively. Remove version detection, CMS GC parameters, java.ext.dirs, and legacy GC logging flags. Signed-off-by: cxhello --- build/bin/docker-startup.sh | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/build/bin/docker-startup.sh b/build/bin/docker-startup.sh index 9389895..fa2d192 100755 --- a/build/bin/docker-startup.sh +++ b/build/bin/docker-startup.sh @@ -124,17 +124,10 @@ if [[ ! -z "${NACOS_DEPLOYMENT_TYPE}" ]]; then JAVA_OPT="${JAVA_OPT} -Dnacos.deployment.type=${NACOS_DEPLOYMENT_TYPE}" fi -JAVA_MAJOR_VERSION=$($JAVA -version 2>&1 | sed -E -n 's/.* version "([0-9]*).*$/\1/p') -if [[ "$JAVA_MAJOR_VERSION" -ge "9" ]]; then - JAVA_OPT="${JAVA_OPT} -Xlog:gc*:file=${BASE_DIR}/logs/nacos_gc.log:time,tags:filecount=10,filesize=102400" - JAVA_OPT="${JAVA_OPT} --add-opens=java.base/java.lang=ALL-UNNAMED" - JAVA_OPT="${JAVA_OPT} --add-opens=java.base/java.lang.reflect=ALL-UNNAMED" - JAVA_OPT="${JAVA_OPT} --add-opens=java.base/java.util=ALL-UNNAMED" -else - JAVA_OPT="${JAVA_OPT} -XX:+UseConcMarkSweepGC -XX:+UseCMSCompactAtFullCollection -XX:CMSInitiatingOccupancyFraction=70 -XX:+CMSParallelRemarkEnabled -XX:SoftRefLRUPolicyMSPerMB=0 -XX:+CMSClassUnloadingEnabled -XX:SurvivorRatio=8 " - JAVA_OPT_EXT_FIX="-Djava.ext.dirs=${JAVA_HOME}/jre/lib/ext:${JAVA_HOME}/lib/ext" - JAVA_OPT="${JAVA_OPT} -Xloggc:${BASE_DIR}/logs/nacos_gc.log -verbose:gc -XX:+PrintGCDetails -XX:+PrintGCDateStamps -XX:+PrintGCTimeStamps -XX:+UseGCLogFileRotation -XX:NumberOfGCLogFiles=10 -XX:GCLogFileSize=100M" -fi +JAVA_OPT="${JAVA_OPT} -Xlog:gc*:file=${BASE_DIR}/logs/nacos_gc.log:time,tags:filecount=10,filesize=102400" +JAVA_OPT="${JAVA_OPT} --add-opens=java.base/java.lang=ALL-UNNAMED" +JAVA_OPT="${JAVA_OPT} --add-opens=java.base/java.lang.reflect=ALL-UNNAMED" +JAVA_OPT="${JAVA_OPT} --add-opens=java.base/java.util=ALL-UNNAMED" JAVA_OPT="${JAVA_OPT} -Dloader.path=${BASE_DIR}/plugins,${BASE_DIR}/plugins/health,${BASE_DIR}/plugins/cmdb,${BASE_DIR}/plugins/selector" JAVA_OPT="${JAVA_OPT} -Dnacos.home=${BASE_DIR}" From f7aab94ec0927103c0e1188744375db1fcab4314 Mon Sep 17 00:00:00 2001 From: cxhello Date: Tue, 26 May 2026 15:11:15 +0800 Subject: [PATCH 04/12] feat(docker): rewrite Dockerfile with multi-stage standard + slim targets Replace the single-stage ubuntu+python Dockerfile with a multi-stage build: downloader stage fetches nacos-server tarball, standard target uses eclipse-temurin:17-jre (Ubuntu), slim target uses eclipse-temurin:17-jre-alpine. Python, uv, cisco-ai-skill-scanner, and AI data packages are removed from both targets. Signed-off-by: cxhello --- build/Dockerfile | 107 ++++++++++++++++++++++++++++++----------------- 1 file changed, 68 insertions(+), 39 deletions(-) diff --git a/build/Dockerfile b/build/Dockerfile index bccc807..c66a06d 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -1,38 +1,75 @@ -FROM ubuntu:latest +# ==================== 下载阶段 ==================== +FROM eclipse-temurin:17-jre AS downloader -LABEL maintainer="pader " +ARG NACOS_VERSION=3.2.1 +ARG HOT_FIX_FLAG="" + +RUN apt-get update && apt-get install -y --no-install-recommends curl \ + && rm -rf /var/lib/apt/lists/* -ENV DEBIAN_FRONTEND=noninteractive +WORKDIR /tmp +# nacos release tarball 根目录为 nacos/，解压到 /opt 后路径为 /opt/nacos/ +RUN curl -fSL --retry 3 --output nacos-server.tar.gz \ + "https://github.com/alibaba/nacos/releases/download/${NACOS_VERSION}${HOT_FIX_FLAG}/nacos-server-${NACOS_VERSION}.tar.gz" \ + && tar -xzf nacos-server.tar.gz -C /opt \ + && rm -rf /opt/nacos/bin/* /opt/nacos/conf/*.properties \ + /opt/nacos/conf/*.example /opt/nacos/conf/nacos-mysql.sql \ + && rm nacos-server.tar.gz + +# ==================== 标准镜像 ==================== +FROM eclipse-temurin:17-jre AS standard + +LABEL maintainer="pader " -# 安装依赖（对应原 apk 包） RUN apt-get update && apt-get install -y --no-install-recommends \ - openjdk-17-jre-headless \ - curl \ - iputils-ping \ - vim \ - libcurl4 \ - bash \ - ca-certificates \ - tzdata \ - unzip \ - libstdc++6 \ - && mkdir -p /opt/java \ - && ln -sfn "$(dirname "$(dirname "$(readlink -f "$(command -v java)")")")" /opt/java/openjdk \ + curl iputils-ping vim ca-certificates tzdata \ && rm -rf /var/lib/apt/lists/* -RUN curl -LsSf https://astral.sh/uv/install.sh | sh +ENV MODE="cluster" \ + PREFER_HOST_MODE="ip" \ + BASE_DIR="/home/nacos" \ + CLASSPATH=".:/home/nacos/conf:${CLASSPATH}" \ + CLUSTER_CONF="/home/nacos/conf/cluster.conf" \ + FUNCTION_MODE="all" \ + NACOS_USER="nacos" \ + JAVA_HOME="/opt/java/openjdk" \ + JAVA="/opt/java/openjdk/bin/java" \ + JVM_XMS="1g" \ + JVM_XMX="1g" \ + JVM_XMN="512m" \ + JVM_MS="128m" \ + JVM_MMS="320m" \ + NACOS_DEBUG="n" \ + TOMCAT_ACCESSLOG_ENABLED="false" \ + TIME_ZONE="Asia/Shanghai" -ENV PATH="/root/.local/bin:${PATH}" +ARG NACOS_VERSION=3.2.1 -RUN uv python install 3.10 \ - && uv venv -p 3.10 /home/nacos/.venv +WORKDIR ${BASE_DIR} -RUN uv pip install -p /home/nacos/.venv/bin/python cisco-ai-skill-scanner==2.0.4 +COPY --from=downloader /opt/nacos /home/nacos -ENV PATH="/home/nacos/.venv/bin:${PATH}" +ADD bin/docker-startup.sh bin/docker-startup.sh +ADD conf/application.properties conf/application.properties -ENV JAVA_HOME="/opt/java/openjdk" \ - JAVA="/opt/java/openjdk/bin/java" +RUN ln -snf /usr/share/zoneinfo/${TIME_ZONE} /etc/localtime \ + && echo ${TIME_ZONE} > /etc/timezone \ + && mkdir -p logs \ + && touch logs/start.out \ + && ln -sf /dev/stdout logs/start.out \ + && ln -sf /dev/stderr logs/start.out \ + && chmod +x bin/docker-startup.sh + +EXPOSE 8848 9848 8080 + +ENTRYPOINT ["bash", "bin/docker-startup.sh"] + +# ==================== Slim 镜像 ==================== +FROM eclipse-temurin:17-jre-alpine AS slim + +LABEL maintainer="pader " + +RUN apk add --no-cache curl bash tzdata ENV MODE="cluster" \ PREFER_HOST_MODE="ip" \ @@ -41,6 +78,8 @@ ENV MODE="cluster" \ CLUSTER_CONF="/home/nacos/conf/cluster.conf" \ FUNCTION_MODE="all" \ NACOS_USER="nacos" \ + JAVA_HOME="/opt/java/openjdk" \ + JAVA="/opt/java/openjdk/bin/java" \ JVM_XMS="1g" \ JVM_XMX="1g" \ JVM_XMN="512m" \ @@ -51,32 +90,22 @@ ENV MODE="cluster" \ TIME_ZONE="Asia/Shanghai" ARG NACOS_VERSION=3.2.1 -ARG HOT_FIX_FLAG="" -ARG SKILLS_DATA_URL="https://download.nacos.io/nacos-server-data/skills-data.zip" -ARG AGENTSPEC_DATA_URL="https://download.nacos.io/nacos-server-data/agentspec-data.zip" WORKDIR ${BASE_DIR} -RUN set -x \ - && curl -fSL --retry 3 --output nacos-server.tar.gz "https://github.com/alibaba/nacos/releases/download/${NACOS_VERSION}${HOT_FIX_FLAG}/nacos-server-${NACOS_VERSION}.tar.gz" \ - && tar -xzvf nacos-server.tar.gz -C /home \ - && mkdir -p /home/nacos/data \ - && curl -fSL --retry 3 --output /home/nacos/data/skills-data.zip "${SKILLS_DATA_URL}" \ - && curl -fSL --retry 3 --output /home/nacos/data/agentspec-data.zip "${AGENTSPEC_DATA_URL}" \ - && rm -rf nacos-server.tar.gz /home/nacos/bin/* /home/nacos/conf/*.properties /home/nacos/conf/*.example /home/nacos/conf/nacos-mysql.sql \ - && ln -snf /usr/share/zoneinfo/${TIME_ZONE} /etc/localtime \ - && echo ${TIME_ZONE} > /etc/timezone +COPY --from=downloader /opt/nacos /home/nacos ADD bin/docker-startup.sh bin/docker-startup.sh ADD conf/application.properties conf/application.properties -RUN mkdir -p logs \ +RUN ln -snf /usr/share/zoneinfo/${TIME_ZONE} /etc/localtime \ + && echo ${TIME_ZONE} > /etc/timezone \ + && mkdir -p logs \ && touch logs/start.out \ && ln -sf /dev/stdout logs/start.out \ && ln -sf /dev/stderr logs/start.out \ && chmod +x bin/docker-startup.sh -EXPOSE 8848 -EXPOSE 9848 8080 +EXPOSE 8848 9848 8080 ENTRYPOINT ["bash", "bin/docker-startup.sh"] From 3fab81b5d6200ccfcc2be8fd64315c8e0d757b76 Mon Sep 17 00:00:00 2001 From: cxhello Date: Tue, 26 May 2026 15:11:54 +0800 Subject: [PATCH 05/12] feat(docker): add Dockerfile.AI for AI-enabled image Layered on top of the standard nacos/nacos-server image. Adds Python 3.10 via uv, cisco-ai-skill-scanner, AI data packages, and application-ai.properties with AI features enabled. Signed-off-by: cxhello --- build/Dockerfile.AI | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 build/Dockerfile.AI diff --git a/build/Dockerfile.AI b/build/Dockerfile.AI new file mode 100644 index 0000000..2f9420e --- /dev/null +++ b/build/Dockerfile.AI @@ -0,0 +1,29 @@ +ARG NACOS_VERSION=3.2.1 + +FROM nacos/nacos-server:v${NACOS_VERSION} + +ARG SKILLS_DATA_URL="https://download.nacos.io/nacos-server-data/skills-data.zip" +ARG AGENTSPEC_DATA_URL="https://download.nacos.io/nacos-server-data/agentspec-data.zip" + +# 安装 Python 环境 + AI Skill Scanner +RUN apt-get update && apt-get install -y --no-install-recommends unzip \ + && rm -rf /var/lib/apt/lists/* + +RUN curl -LsSf https://astral.sh/uv/install.sh | sh + +ENV PATH="/root/.local/bin:${PATH}" + +RUN uv python install 3.10 \ + && uv venv -p 3.10 /home/nacos/.venv + +RUN uv pip install -p /home/nacos/.venv/bin/python cisco-ai-skill-scanner==2.0.4 + +ENV PATH="/home/nacos/.venv/bin:${PATH}" + +# 下载 AI 数据包 +RUN mkdir -p /home/nacos/data \ + && curl -fSL --retry 3 --output /home/nacos/data/skills-data.zip "${SKILLS_DATA_URL}" \ + && curl -fSL --retry 3 --output /home/nacos/data/agentspec-data.zip "${AGENTSPEC_DATA_URL}" + +# 覆盖配置：开启 AI 功能 +ADD conf/application-ai.properties conf/application.properties From c30e5b6c0163771eb39d243b0ead5048899042fd Mon Sep 17 00:00:00 2001 From: cxhello Date: Tue, 26 May 2026 15:12:20 +0800 Subject: [PATCH 06/12] chore(docker): remove Dockerfile.Slim Slim target is now a build stage in the main Dockerfile. Dockerfile.Slim was identical to Dockerfile since PR #495. Signed-off-by: cxhello --- build/Dockerfile.Slim | 82 ------------------------------------------- 1 file changed, 82 deletions(-) delete mode 100644 build/Dockerfile.Slim diff --git a/build/Dockerfile.Slim b/build/Dockerfile.Slim deleted file mode 100644 index bccc807..0000000 --- a/build/Dockerfile.Slim +++ /dev/null @@ -1,82 +0,0 @@ -FROM ubuntu:latest - -LABEL maintainer="pader " - -ENV DEBIAN_FRONTEND=noninteractive - -# 安装依赖（对应原 apk 包） -RUN apt-get update && apt-get install -y --no-install-recommends \ - openjdk-17-jre-headless \ - curl \ - iputils-ping \ - vim \ - libcurl4 \ - bash \ - ca-certificates \ - tzdata \ - unzip \ - libstdc++6 \ - && mkdir -p /opt/java \ - && ln -sfn "$(dirname "$(dirname "$(readlink -f "$(command -v java)")")")" /opt/java/openjdk \ - && rm -rf /var/lib/apt/lists/* - -RUN curl -LsSf https://astral.sh/uv/install.sh | sh - -ENV PATH="/root/.local/bin:${PATH}" - -RUN uv python install 3.10 \ - && uv venv -p 3.10 /home/nacos/.venv - -RUN uv pip install -p /home/nacos/.venv/bin/python cisco-ai-skill-scanner==2.0.4 - -ENV PATH="/home/nacos/.venv/bin:${PATH}" - -ENV JAVA_HOME="/opt/java/openjdk" \ - JAVA="/opt/java/openjdk/bin/java" - -ENV MODE="cluster" \ - PREFER_HOST_MODE="ip" \ - BASE_DIR="/home/nacos" \ - CLASSPATH=".:/home/nacos/conf:${CLASSPATH}" \ - CLUSTER_CONF="/home/nacos/conf/cluster.conf" \ - FUNCTION_MODE="all" \ - NACOS_USER="nacos" \ - JVM_XMS="1g" \ - JVM_XMX="1g" \ - JVM_XMN="512m" \ - JVM_MS="128m" \ - JVM_MMS="320m" \ - NACOS_DEBUG="n" \ - TOMCAT_ACCESSLOG_ENABLED="false" \ - TIME_ZONE="Asia/Shanghai" - -ARG NACOS_VERSION=3.2.1 -ARG HOT_FIX_FLAG="" -ARG SKILLS_DATA_URL="https://download.nacos.io/nacos-server-data/skills-data.zip" -ARG AGENTSPEC_DATA_URL="https://download.nacos.io/nacos-server-data/agentspec-data.zip" - -WORKDIR ${BASE_DIR} - -RUN set -x \ - && curl -fSL --retry 3 --output nacos-server.tar.gz "https://github.com/alibaba/nacos/releases/download/${NACOS_VERSION}${HOT_FIX_FLAG}/nacos-server-${NACOS_VERSION}.tar.gz" \ - && tar -xzvf nacos-server.tar.gz -C /home \ - && mkdir -p /home/nacos/data \ - && curl -fSL --retry 3 --output /home/nacos/data/skills-data.zip "${SKILLS_DATA_URL}" \ - && curl -fSL --retry 3 --output /home/nacos/data/agentspec-data.zip "${AGENTSPEC_DATA_URL}" \ - && rm -rf nacos-server.tar.gz /home/nacos/bin/* /home/nacos/conf/*.properties /home/nacos/conf/*.example /home/nacos/conf/nacos-mysql.sql \ - && ln -snf /usr/share/zoneinfo/${TIME_ZONE} /etc/localtime \ - && echo ${TIME_ZONE} > /etc/timezone - -ADD bin/docker-startup.sh bin/docker-startup.sh -ADD conf/application.properties conf/application.properties - -RUN mkdir -p logs \ - && touch logs/start.out \ - && ln -sf /dev/stdout logs/start.out \ - && ln -sf /dev/stderr logs/start.out \ - && chmod +x bin/docker-startup.sh - -EXPOSE 8848 -EXPOSE 9848 8080 - -ENTRYPOINT ["bash", "bin/docker-startup.sh"] From 3f569fd91b061a5e5a206b4026da5b953b525ffd Mon Sep 17 00:00:00 2001 From: cxhello Date: Tue, 26 May 2026 15:13:03 +0800 Subject: [PATCH 07/12] ci: add PR validation workflow New ci.yml runs on pull_request to master: - Build test: verify standard and slim targets build for amd64+arm64 - Size check: report image sizes, warn if over baseline - Smoke test: start container in standalone mode, verify HTTP 200 Signed-off-by: cxhello --- .github/workflows/ci.yml | 122 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 122 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..efe8cb3 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,122 @@ +name: CI + +on: + pull_request: + branches: [master] + +jobs: + build-test: + name: Build Images + runs-on: ubuntu-latest + strategy: + matrix: + target: [standard, slim] + include: + - target: standard + file: build/Dockerfile + - target: slim + file: build/Dockerfile + steps: + - uses: actions/checkout@v4 + - uses: docker/setup-qemu-action@v3 + - uses: docker/setup-buildx-action@v3 + - name: Build ${{ matrix.target }} + uses: docker/build-push-action@v6 + with: + context: build + file: ${{ matrix.file }} + target: ${{ matrix.target }} + platforms: linux/amd64,linux/arm64 + push: false + load: false + + size-check: + name: Image Size Check + runs-on: ubuntu-latest + needs: [] + steps: + - uses: actions/checkout@v4 + - uses: docker/setup-buildx-action@v3 + - name: Build standard (amd64 only for size check) + uses: docker/build-push-action@v6 + with: + context: build + file: build/Dockerfile + target: standard + platforms: linux/amd64 + push: false + load: true + tags: nacos-size-check:standard + - name: Build slim (amd64 only for size check) + uses: docker/build-push-action@v6 + with: + context: build + file: build/Dockerfile + target: slim + platforms: linux/amd64 + push: false + load: true + tags: nacos-size-check:slim + - name: Check image sizes + run: | + STANDARD_SIZE=$(docker image inspect nacos-size-check:standard --format '{{.Size}}') + SLIM_SIZE=$(docker image inspect nacos-size-check:slim --format '{{.Size}}') + STANDARD_MB=$((STANDARD_SIZE / 1024 / 1024)) + SLIM_MB=$((SLIM_SIZE / 1024 / 1024)) + + echo "## Docker Image Size Report" >> $GITHUB_STEP_SUMMARY + echo "| Image | Size |" >> $GITHUB_STEP_SUMMARY + echo "|-------|------|" >> $GITHUB_STEP_SUMMARY + echo "| standard | ${STANDARD_MB} MB |" >> $GITHUB_STEP_SUMMARY + echo "| slim | ${SLIM_MB} MB |" >> $GITHUB_STEP_SUMMARY + + # Baseline: standard ≤ 400MB, slim ≤ 300MB + if [ "$STANDARD_MB" -gt 400 ]; then + echo "::warning::Standard image ${STANDARD_MB}MB exceeds 400MB baseline" + fi + if [ "$SLIM_MB" -gt 300 ]; then + echo "::warning::Slim image ${SLIM_MB}MB exceeds 300MB baseline" + fi + + smoke-test: + name: Smoke Test (${{ matrix.target }}) + runs-on: ubuntu-latest + strategy: + matrix: + target: [standard, slim] + steps: + - uses: actions/checkout@v4 + - uses: docker/setup-buildx-action@v3 + - name: Build ${{ matrix.target }} image + uses: docker/build-push-action@v6 + with: + context: build + file: build/Dockerfile + target: ${{ matrix.target }} + platforms: linux/amd64 + push: false + load: true + tags: nacos-smoke:${{ matrix.target }} + - name: Run smoke test + run: | + docker run -d --name nacos-test \ + -e MODE=standalone \ + -e NACOS_AUTH_TOKEN=VGhpc0lzTXlDdXN0b21TZWNyZXRLZXkwMTIzNDU2Nzg= \ + -e NACOS_AUTH_IDENTITY_KEY=test \ + -e NACOS_AUTH_IDENTITY_VALUE=test \ + -p 8848:8848 nacos-smoke:${{ matrix.target }} + + echo "Waiting for Nacos (${{ matrix.target }}) to start..." + for i in $(seq 1 60); do + if curl -sf http://localhost:8848/nacos/ > /dev/null 2>&1; then + echo "Nacos is ready after ${i}s" + exit 0 + fi + sleep 2 + done + echo "::error::Nacos (${{ matrix.target }}) failed to start within 120s" + docker logs nacos-test + exit 1 + - name: Cleanup + if: always() + run: docker rm -f nacos-test 2>/dev/null || true From e435f7d6cdac663e15455d8f9c67d1a8de9557ef Mon Sep 17 00:00:00 2001 From: cxhello Date: Tue, 26 May 2026 15:13:57 +0800 Subject: [PATCH 08/12] ci: rewrite build&push workflow for three-image matrix Replace single-job workflow with three parallel jobs: - build-push-standard: tags v + latest - build-push-slim: tags v-slim + slim - build-push-ai: tags v-ai (depends on standard) Upgrade all Actions: checkout@v4, setup-qemu-action@v3, setup-buildx-action@v3, login-action@v3, build-push-action@v6. Replace deprecated set-output with GITHUB_OUTPUT. Signed-off-by: cxhello --- .github/workflows/build&push.yaml | 143 +++++++++++++++--------------- 1 file changed, 72 insertions(+), 71 deletions(-) diff --git a/.github/workflows/build&push.yaml b/.github/workflows/build&push.yaml index 25bfcc4..abd91f4 100644 --- a/.github/workflows/build&push.yaml +++ b/.github/workflows/build&push.yaml @@ -1,102 +1,103 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Publish Docker image +name: Build and Push Docker Images on: push: tags: - 'v*' +env: + REGISTRY_IMAGE: nacos/nacos-server + jobs: - push_to_registry: - name: Push Docker image to Docker Hub + build-push-standard: + name: Push standard image runs-on: ubuntu-latest steps: - - name: Extract Version - id: version_step - run: | - echo "##[set-output name=version;]NACOS_VERSION=${GITHUB_REF#$"refs/tags/v"}" - - - name: Check out the repo - uses: actions/checkout@v2 - with: - fetch-depth: 1 - - - name: Set up QEMU - uses: docker/setup-qemu-action@v1 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 - + - uses: actions/checkout@v4 + - uses: docker/setup-qemu-action@v3 + - uses: docker/setup-buildx-action@v3 - name: Log in to Docker Hub - uses: docker/login-action@v1 + uses: docker/login-action@v3 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - - - name: Extract metadata (tags, labels) for Docker - id: meta - uses: docker/metadata-action@v3 - with: - images: nacos/nacos-server - - - name: Build and push Docker image - uses: docker/build-push-action@v2.3.0 + - name: Extract version + id: version + run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT + - name: Build and push + uses: docker/build-push-action@v6 with: context: build - platforms: linux/amd64,linux/arm64 file: build/Dockerfile + target: standard + platforms: linux/amd64,linux/arm64 push: true - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - build-args: ${{steps.version_step.outputs.version}} + tags: | + ${{ env.REGISTRY_IMAGE }}:v${{ steps.version.outputs.version }} + ${{ env.REGISTRY_IMAGE }}:latest - push_to_multi_platforms_registry: - name: Push Docker slim image to Docker Hub + build-push-slim: + name: Push slim image runs-on: ubuntu-latest steps: - - name: Extract Version - id: version_step - run: | - echo "##[set-output name=version;]NACOS_VERSION=${GITHUB_REF#$"refs/tags/v"}" - - - name: Check out the repo - uses: actions/checkout@v2 - with: - fetch-depth: 1 - - - name: Set up QEMU - uses: docker/setup-qemu-action@v1 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 - + - uses: actions/checkout@v4 + - uses: docker/setup-qemu-action@v3 + - uses: docker/setup-buildx-action@v3 - name: Log in to Docker Hub - uses: docker/login-action@v1 + uses: docker/login-action@v3 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} - - - name: Extract metadata (tags, labels) for Docker - id: meta - uses: docker/metadata-action@v3 + - name: Extract version + id: version + run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT + - name: Build and push + uses: docker/build-push-action@v6 with: - images: nacos/nacos-server - flavor: | - latest=false + context: build + file: build/Dockerfile + target: slim + platforms: linux/amd64,linux/arm64 + push: true tags: | - type=pep440,pattern=v{{version}}-slim + ${{ env.REGISTRY_IMAGE }}:v${{ steps.version.outputs.version }}-slim + ${{ env.REGISTRY_IMAGE }}:slim - - name: Build and push Docker image - uses: docker/build-push-action@v2.3.0 + build-push-ai: + name: Push AI image + runs-on: ubuntu-latest + needs: build-push-standard + steps: + - uses: actions/checkout@v4 + - uses: docker/setup-qemu-action@v3 + - uses: docker/setup-buildx-action@v3 + - name: Log in to Docker Hub + uses: docker/login-action@v3 + with: + username: ${{ secrets.DOCKER_USERNAME }} + password: ${{ secrets.DOCKER_PASSWORD }} + - name: Extract version + id: version + run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT + - name: Pull standard image (retry for Docker Hub propagation) + run: | + for i in $(seq 1 5); do + if docker pull --platform linux/amd64 ${{ env.REGISTRY_IMAGE }}:v${{ steps.version.outputs.version }}; then + echo "Pulled successfully on attempt $i" + exit 0 + fi + echo "Attempt $i failed, retrying in 15s..." + sleep 15 + done + echo "::error::Failed to pull standard image after 5 attempts" + exit 1 + - name: Build and push + uses: docker/build-push-action@v6 with: context: build + file: build/Dockerfile.AI platforms: linux/amd64,linux/arm64 - file: build/Dockerfile.Slim push: true - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - build-args: ${{steps.version_step.outputs.version}} + build-args: NACOS_VERSION=${{ steps.version.outputs.version }} + tags: | + ${{ env.REGISTRY_IMAGE }}:v${{ steps.version.outputs.version }}-ai From 27011cbc9af4d673a640230766f9704e4398c601 Mon Sep 17 00:00:00 2001 From: cxhello Date: Tue, 26 May 2026 15:15:01 +0800 Subject: [PATCH 09/12] docs: add three-image variant documentation and migration guide Document standard, slim, and AI image variants with size estimates. Add migration section for users upgrading from v3.2.0 who need AI features to switch to the -ai tag. Signed-off-by: cxhello --- README.md | 29 ++++++++++++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 3da91aa..3057c18 100644 --- a/README.md +++ b/README.md @@ -6,6 +6,29 @@ This project contains a Docker image meant to facilitate the deployment of [Naco [**中文**](README_ZH.md) +## Image Variants + +| Tag | Base | Size | Use Case | +|-----|------|------|----------| +| `v3.2.x` / `latest` | eclipse-temurin:17-jre | ~300 MB | Production (recommended) | +| `v3.2.x-slim` / `slim` | eclipse-temurin:17-jre-alpine | ~250 MB | Size-constrained environments | +| `v3.2.x-ai` | Based on standard | ~550 MB | AI features (MCP registry, skill scanner) | + +### Migrating from v3.2.0 + +If you were using AI features (skill scanner, MCP registry) with the default `v3.2.0` image, switch to the `-ai` tag: + +```yaml +# Before +image: nacos/nacos-server:v3.2.0 + +# After (with AI features) +image: nacos/nacos-server:v3.2.1-ai + +# After (no AI features, smaller image) +image: nacos/nacos-server:v3.2.1 +``` + ## Note The following environment variables have been **removed** from the default values in the new version(**Nacos 2.2.1**) @@ -70,9 +93,13 @@ docker run --name nacos-standalone-derby-v2.5.1 \ NACOS_VERSION=v3.2.1 ``` -For Mac user with Arm Chip (like M1/M2/M3 series) , you need to add `-slim` after version which support `arm` arch. +All image variants (`latest`, `-slim`, `-ai`) support both `amd64` and `arm64` architectures. The `-slim` variant uses Alpine Linux for a smaller footprint. ```dotenv +# Standard image (recommended) +NACOS_VERSION=v3.2.1 + +# Slim image (Alpine-based, smaller) NACOS_VERSION=v3.2.1-slim ``` From 3100ff761ea7c765aee70676df8dc3948d0dee0a Mon Sep 17 00:00:00 2001 From: cxhello Date: Tue, 26 May 2026 15:38:44 +0800 Subject: [PATCH 10/12] fix(docker): use eclipse-temurin:21-jre-alpine for slim image eclipse-temurin:17-jre-alpine only supports amd64. Switch slim to JDK 21 alpine which supports both amd64 and arm64. Nacos 3.x is compatible with JDK 17+ so JDK 21 works without issues. Signed-off-by: cxhello --- build/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build/Dockerfile b/build/Dockerfile index c66a06d..9633438 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -65,7 +65,7 @@ EXPOSE 8848 9848 8080 ENTRYPOINT ["bash", "bin/docker-startup.sh"] # ==================== Slim 镜像 ==================== -FROM eclipse-temurin:17-jre-alpine AS slim +FROM eclipse-temurin:21-jre-alpine AS slim LABEL maintainer="pader " From 77a63b2b46bddaeca515109ffd786804a4eeb5a1 Mon Sep 17 00:00:00 2001 From: cxhello Date: Tue, 26 May 2026 15:56:43 +0800 Subject: [PATCH 11/12] fix(docker): add libstdc++ to slim image for RocksDB JNI Nacos uses RocksDB via JNI which requires libstdc++.so.6. Alpine does not include it by default, causing startup failure with UnsatisfiedLinkError. Signed-off-by: cxhello --- build/Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build/Dockerfile b/build/Dockerfile index 9633438..1fee2f2 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -69,7 +69,7 @@ FROM eclipse-temurin:21-jre-alpine AS slim LABEL maintainer="pader " -RUN apk add --no-cache curl bash tzdata +RUN apk add --no-cache curl bash tzdata libstdc++ ENV MODE="cluster" \ PREFER_HOST_MODE="ip" \ From 3ec85c6405f9f22574be20a2e24a773c90d3fb5b Mon Sep 17 00:00:00 2001 From: cxhello Date: Tue, 26 May 2026 16:02:16 +0800 Subject: [PATCH 12/12] fix(ci): raise image size baseline to match actual uncompressed sizes Standard ~570MB, slim ~426MB (uncompressed). Previous baselines (400MB/300MB) were based on compressed size estimates. Adjust to 600MB/450MB for uncompressed sizes. Signed-off-by: cxhello --- .github/workflows/ci.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index efe8cb3..b558c9b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -70,12 +70,12 @@ jobs: echo "| standard | ${STANDARD_MB} MB |" >> $GITHUB_STEP_SUMMARY echo "| slim | ${SLIM_MB} MB |" >> $GITHUB_STEP_SUMMARY - # Baseline: standard ≤ 400MB, slim ≤ 300MB - if [ "$STANDARD_MB" -gt 400 ]; then - echo "::warning::Standard image ${STANDARD_MB}MB exceeds 400MB baseline" + # Baseline (uncompressed): standard ≤ 600MB, slim ≤ 450MB + if [ "$STANDARD_MB" -gt 600 ]; then + echo "::warning::Standard image ${STANDARD_MB}MB exceeds 600MB baseline" fi - if [ "$SLIM_MB" -gt 300 ]; then - echo "::warning::Slim image ${SLIM_MB}MB exceeds 300MB baseline" + if [ "$SLIM_MB" -gt 450 ]; then + echo "::warning::Slim image ${SLIM_MB}MB exceeds 450MB baseline" fi smoke-test: