From 1b626f2ee81f7a3ef473f430948a80ae63fd4d6e Mon Sep 17 00:00:00 2001 From: root Date: Tue, 29 Sep 2026 00:23:59 +0800 Subject: [PATCH] docs(runbook): containers via host proxy relay (socat on docker0) Co-Authored-By: Claude Fable 5.1 --- docs/runbook/deploy.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/docs/runbook/deploy.md b/docs/runbook/deploy.md index 034c2d8c..6db1c782 100644 --- a/docs/runbook/deploy.md +++ b/docs/runbook/deploy.md @@ -212,3 +212,25 @@ docker compose ps && docker compose logs --tail=50 app | 清理 | `compose down -v`、删除测试镜像与临时目录 | `UMT_FS_TEST_HANG_AFTER_BYTES` 只用于这类验收(让数据类操作的 worker 读到 n 字节后卡死 JS 线程并屏蔽 SIGTERM),必须同时设置 `UMT_FS_TEST_HOOKS=1` 才生效;单独设置不生效,但 `preflight` 会打 warn。生产不要设置。 + +## 容器经宿主代理访问境外站点(可选) + +宿主上的代理(如 mihomo)常只监听 `127.0.0.1`,容器从网桥够不到。改动最小的做法:加一个只绑在 docker 网桥地址上的中继,再放行 docker 网段到该端口;代理本身配置不动。写在本机 `docker-compose.override.yml`(不进 git): + +```yaml +services: + proxy-relay: + image: alpine/socat:1.8.0.0 + network_mode: host + restart: unless-stopped + command: ["TCP-LISTEN:7891,bind=172.17.0.1,fork,reuseaddr", "TCP:127.0.0.1:7890"] + app: + environment: + HTTP_PROXY: http://172.17.0.1:7891 + HTTPS_PROXY: http://172.17.0.1:7891 + NO_PROXY: localhost,127.0.0.1,postgres,camofox,proxy-relay,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 + camofox: + environment: { HTTP_PROXY: http://172.17.0.1:7891, HTTPS_PROXY: http://172.17.0.1:7891, NO_PROXY: localhost,127.0.0.1,app,10.0.0.0/8,172.16.0.0/12 } +``` + +防火墙只放行 docker 网段:`ufw allow from 172.16.0.0/12 to 172.17.0.1 port 7891 proto tcp`。Deno 的 fetch 会读 `HTTP(S)_PROXY`/`NO_PROXY`;TMDB、境外 Pi 上游、camofox 访问境外站都经此代理,站内(postgres/camofox)不走代理。