Isolate CI Compose runtime with temporary volumes and reliable cleanup

2026-10-07 20:29:48 +08:00
parent d88c88f876
commit 58823051ee
5 changed files with 276 additions and 21 deletions
@@ -284,3 +284,29 @@ or using a fresh Docker daemon loses the benefit. Cache mounts are disposable:
 an empty cache still builds correctly. `--pull` remains enabled; a pinned base
 digest check alone does not invalidate dependency layers. To deliberately
 refresh installed APT versions, use `docker compose build --pull --no-cache`.
+
+### CI with a host Docker socket
+
+Run `python scripts/ci-compose-verify.py` after loading the build mirror profile.
+The script derives a temporary Compose document from production settings, with
+an absolute client-side build context, a UUID project name, a unique CI image
+tag, and project-scoped `data` / `config` named volumes. It removes production
+bind mounts, the fixed container name, host ports, and the production `.env`
+reference. A fresh test token, mock driver, and disabled device writes are
+explicitly configured. Docker initializes empty named volumes from the image's
+owned `/data` and `/config` directories; the service remains UID/GID 10333.
+
+Build contexts are sent by the Docker client, so the job workspace can remain
+inside the job container. Runtime storage is managed by the daemon; no matching
+NAS host `/workspace` directory is needed. HTTP readiness and the unmodified
+nine-endpoint smoke script run inside the service with `compose exec -T`.
+Restart is followed by another readiness check and the same smoke test.
+
+A `finally` block removes the test containers, network, volumes, and unique
+image tag on success or failure. The workflow records the private temporary
+Compose path in `GITHUB_ENV` and repeats cleanup in an `always()` step, covering
+normal cancellation/interruption. Failed cleanup retains the manifest so the
+fallback can retry. Abrupt host/daemon loss or a forcibly terminated entire job
+can prevent both cleanup paths; no CI script can guarantee cleanup in that case.
+No global prune or production resource removal is performed. Keep builder
+caches: only the run-specific image tag is removed.