feat: refresh model and voice test catalog with favicon

2026-10-20 11:06:52 +08:00
parent ae7c5bc967
commit 36c228544e
23 changed files with 1026 additions and 42 deletions
@@ -0,0 +1,89 @@
+"""Fixed original-image clients. No user-provided Docker flags or GPU access."""
+import json
+from pathlib import Path, PurePosixPath
+import re
+import subprocess
+
+
+def name(identity):
+    if not re.fullmatch(r'[a-f0-9]{32}', identity):
+        raise ValueError('原环境任务编号不合法')
+    return 'adamwen-native-run-' + identity
+
+
+def mounts(profile):
+    values = profile['docker']['mounts']
+    for mount in values:
+        for key in ('source', 'target'):
+            value = mount[key]
+            if not value.startswith('/') or ',' in value or '\x00' in value or '..' in PurePosixPath(value).parts:
+                raise ValueError('原镜像挂载路径不合法')
+        if mount['target'] in ('/', '/out', '/tmp'):
+            raise ValueError('原镜像挂载不能覆盖任务输出目录')
+    return values
+
+
+def command(profile, source, arguments, directory, identity):
+    image = profile['docker']['image']
+    if not re.fullmatch(r'sha256:[a-f0-9]{64}', image):
+        raise ValueError('原镜像必须登记不可变摘要')
+    container = name(identity) if identity != '{run_id}' else 'adamwen-native-run-{run_id}'
+    args = ['/usr/bin/docker', 'run', '--rm', '--init', '--name', container, '--label', 'xas.native-run=' + identity,
+        '--runtime', 'runc', '--network', 'host', '--user', '0:0', '--cap-drop', 'ALL',
+        '--security-opt', 'no-new-privileges', '--read-only', '--memory', '4g', '--cpus', '2', '--pids-limit', '128',
+        '--tmpfs', '/tmp:rw,nosuid,nodev,size=268435456', '--env', 'HOME=/tmp',
+        '--env', 'PYTHONUNBUFFERED=1', '--env', 'PYTHONDONTWRITEBYTECODE=1',
+        '--env', 'OMP_NUM_THREADS=2', '--env', 'OPENBLAS_NUM_THREADS=2', '--env', 'MKL_NUM_THREADS=2',
+        '--env', 'NUMBA_NUM_THREADS=2', '--env', 'NUMBA_CACHE_DIR=/tmp/numba']
+    entry = None
+    for mount in mounts(profile):
+        args.extend(['--mount', f"type=bind,src={mount['source']},dst={mount['target']},readonly"])
+        try:
+            relative = PurePosixPath(Path(source).as_posix()).relative_to(PurePosixPath(mount['source']))
+            entry = str(PurePosixPath(mount['target']) / relative)
+        except ValueError:
+            pass
+    if entry is None:
+        raise ValueError('原入口未包含在只读挂载中')
+    output = str(PurePosixPath(str(directory)) / 'work')
+    args += ['--mount', f'type=bind,src={output},dst=/out', '--workdir', '/out',
+             '--entrypoint', profile['interpreter'], image, '-u', entry, *arguments]
+    return args
+
+
+def checks(profile):
+    result = []
+    for mount in mounts(profile):
+        path = Path(mount['source'])
+        valid = path.exists() and not any(p.is_symlink() for p in (path, *path.parents))
+        result.append({'name': '原镜像只读依赖', 'ok': valid, 'message': mount['source']})
+    try:
+        value = subprocess.run(['/usr/bin/docker', 'image', 'inspect', '--format', '{{.Id}}', profile['docker']['image']],
+            capture_output=True, text=True, timeout=5)
+        valid = value.returncode == 0 and value.stdout.strip() == profile['docker']['image']
+    except (OSError, subprocess.TimeoutExpired):
+        valid = False
+    result.append({'name': '原依赖镜像', 'ok': valid, 'message': '使用已登记镜像，不拉取或升级环境'})
+    return result
+
+
+def cleanup(identity):
+    container = name(identity)
+    value = subprocess.run(['/usr/bin/docker', 'inspect', container], capture_output=True, text=True, timeout=8)
+    if value.returncode:
+        if 'no such object:' in value.stderr.lower() or 'no such container:' in value.stderr.lower():
+            return
+        raise OSError('本次原镜像客户端状态未知')
+    item = json.loads(value.stdout)[0]
+    if item.get('Name') != '/' + container or item.get('Config', {}).get('Labels', {}).get('xas.native-run') != identity:
+        raise ValueError('原镜像客户端归属核验失败')
+    identity_value = item.get('Id', '')
+    if not re.fullmatch(r'[a-f0-9]{64}', identity_value):
+        raise ValueError('原镜像客户端标识不合法')
+    value = subprocess.run(['/usr/bin/docker', 'rm', '-f', identity_value], capture_output=True, timeout=15)
+    if value.returncode:
+        # --rm may delete the verified container between inspect and removal.
+        remaining = subprocess.run(['/usr/bin/docker', 'inspect', identity_value], capture_output=True, text=True, timeout=8)
+        if remaining.returncode and ('no such object:' in remaining.stderr.lower() or 'no such container:' in remaining.stderr.lower()):
+            return
+        raise OSError('本次原镜像客户端收尾未确认')