From b7fc1f045fe112ce57ee182f78c2efd5175a2585 Mon Sep 17 00:00:00 2001 From: Min Liu Date: Wed, 8 Jul 2026 10:40:37 -0700 Subject: [PATCH] Improve Fedora Podman compose compatibility --- README.md | 6 ++++++ README_CN.md | 6 ++++++ deploy/DOCKER.md | 6 +++--- deploy/README.md | 6 ++++++ deploy/docker-compose.dev.yml | 14 +++++++------- deploy/docker-compose.local.yml | 16 ++++++++-------- deploy/docker-compose.standalone.yml | 2 +- deploy/docker-compose.yml | 16 ++++++++-------- 8 files changed, 45 insertions(+), 27 deletions(-) diff --git a/README.md b/README.md index a2b1901422d..c0c866b0b80 100644 --- a/README.md +++ b/README.md @@ -388,6 +388,12 @@ docker compose -f docker-compose.local.yml logs -f sub2api **Recommendation:** Use `docker-compose.local.yml` (deployed by script) for easier data management. +#### Fedora / Podman / SELinux Notes + +Fedora hosts commonly run Docker Compose through Podman and enforce SELinux by default. The compose files use fully qualified image names (`docker.io/...`) so Podman does not stop on short-name resolution prompts in non-interactive deployments. + +When using `docker-compose.local.yml`, keep the `:Z` suffix on local bind mounts such as `./data:/app/data:Z`. This lets Podman relabel `data/`, `postgres_data/`, and `redis_data/` for container access while SELinux is enforcing. + #### Access Open `http://YOUR_SERVER_IP:8080` in your browser. diff --git a/README_CN.md b/README_CN.md index a65f25f64ca..0e2311c514e 100644 --- a/README_CN.md +++ b/README_CN.md @@ -392,6 +392,12 @@ docker compose -f docker-compose.local.yml logs -f sub2api **推荐：** 使用 `docker-compose.local.yml`（脚本部署）以便更轻松地管理数据。 +#### Fedora / Podman / SELinux 说明 + +Fedora 系统通常通过 Podman 运行 Docker Compose，并默认启用 SELinux。Compose 文件使用完整镜像名（`docker.io/...`），避免 Podman 在非交互部署时因短镜像名解析提示而中断。 + +使用 `docker-compose.local.yml` 时，请保留本地目录挂载中的 `:Z` 后缀，例如 `./data:/app/data:Z`。这会让 Podman 为 `data/`、`postgres_data/`、`redis_data/` 添加容器可访问的 SELinux 标签。 + #### 启用“数据管理”功能（datamanagementd） 如需启用管理后台“数据管理”，需要额外部署宿主机数据管理进程 `datamanagementd`。 diff --git a/deploy/DOCKER.md b/deploy/DOCKER.md index 156b6c97a94..e475f8e4f52 100644 --- a/deploy/DOCKER.md +++ b/deploy/DOCKER.md @@ -20,7 +20,7 @@ version: '3.8' services: sub2api: - image: weishaw/sub2api:latest + image: docker.io/weishaw/sub2api:latest ports: - "8080:8080" environment: @@ -31,7 +31,7 @@ services: - redis db: - image: postgres:15-alpine + image: docker.io/library/postgres:15-alpine environment: - POSTGRES_USER=postgres - POSTGRES_PASSWORD=postgres @@ -40,7 +40,7 @@ services: - postgres_data:/var/lib/postgresql/data redis: - image: redis:7-alpine + image: docker.io/library/redis:7-alpine volumes: - redis_data:/data diff --git a/deploy/README.md b/deploy/README.md index dd311721d91..f5fd7562a4b 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -106,6 +106,12 @@ docker compose -f docker-compose.local.yml logs -f sub2api **Recommendation:** Use `docker-compose.local.yml` (deployed by `docker-deploy.sh`) for easier data management and migration. +### Fedora / Podman / SELinux Notes + +Fedora hosts commonly run Docker Compose through Podman and enforce SELinux by default. The compose files use fully qualified image names (`docker.io/...`) so Podman does not stop on short-name resolution prompts in non-interactive deployments. + +When using `docker-compose.local.yml`, keep the `:Z` suffix on local bind mounts such as `./data:/app/data:Z`. This lets Podman relabel `data/`, `postgres_data/`, and `redis_data/` for container access while SELinux is enforcing. + ### How Auto-Setup Works When using Docker Compose with `AUTO_SETUP=true`: diff --git a/deploy/docker-compose.dev.yml b/deploy/docker-compose.dev.yml index 6f5b3f56f3d..661c8f23466 100644 --- a/deploy/docker-compose.dev.yml +++ b/deploy/docker-compose.dev.yml @@ -87,7 +87,7 @@ services: start_period: 30s postgres: - image: postgres:18-alpine + image: docker.io/library/postgres:18-alpine container_name: sub2api-postgres-dev restart: unless-stopped volumes: @@ -108,18 +108,18 @@ services: start_period: 10s redis: - image: redis:8-alpine + image: docker.io/library/redis:8-alpine container_name: sub2api-redis-dev restart: unless-stopped volumes: - ./redis_data:/data:Z command: > sh -c ' - redis-server - --save 60 1 - --appendonly yes - --appendfsync everysec - ${REDIS_PASSWORD:+--requirepass "$REDIS_PASSWORD"}' + if [ -n "$$REDIS_PASSWORD" ]; then + exec redis-server --protected-mode no --save 60 1 --appendonly yes --appendfsync everysec --requirepass "$$REDIS_PASSWORD"; + else + exec redis-server --protected-mode no --save 60 1 --appendonly yes --appendfsync everysec; + fi' environment: - TZ=${TZ:-Asia/Shanghai} - REDISCLI_AUTH=${REDIS_PASSWORD:-} diff --git a/deploy/docker-compose.local.yml b/deploy/docker-compose.local.yml index 042752e8578..274a0d5a4ba 100644 --- a/deploy/docker-compose.local.yml +++ b/deploy/docker-compose.local.yml @@ -24,7 +24,7 @@ services: # Sub2API Application # =========================================================================== sub2api: - image: weishaw/sub2api:latest + image: docker.io/weishaw/sub2api:latest container_name: sub2api restart: unless-stopped ulimits: @@ -188,7 +188,7 @@ services: # PostgreSQL Database # =========================================================================== postgres: - image: postgres:18-alpine + image: docker.io/library/postgres:18-alpine container_name: sub2api-postgres restart: unless-stopped ulimits: @@ -219,7 +219,7 @@ services: # Redis Cache # =========================================================================== redis: - image: redis:8-alpine + image: docker.io/library/redis:8-alpine container_name: sub2api-redis restart: unless-stopped ulimits: @@ -231,11 +231,11 @@ services: - ./redis_data:/data:Z command: > sh -c ' - redis-server - --save 60 1 - --appendonly yes - --appendfsync everysec - ${REDIS_PASSWORD:+--requirepass "$REDIS_PASSWORD"}' + if [ -n "$$REDIS_PASSWORD" ]; then + exec redis-server --protected-mode no --save 60 1 --appendonly yes --appendfsync everysec --requirepass "$$REDIS_PASSWORD"; + else + exec redis-server --protected-mode no --save 60 1 --appendonly yes --appendfsync everysec; + fi' environment: - TZ=${TZ:-Asia/Shanghai} # REDISCLI_AUTH is used by redis-cli for authentication (safer than -a flag) diff --git a/deploy/docker-compose.standalone.yml b/deploy/docker-compose.standalone.yml index 2e1d3356244..e29ad36b337 100644 --- a/deploy/docker-compose.standalone.yml +++ b/deploy/docker-compose.standalone.yml @@ -12,7 +12,7 @@ services: sub2api: - image: weishaw/sub2api:latest + image: docker.io/weishaw/sub2api:latest container_name: sub2api restart: unless-stopped ulimits: diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml index 22713c59aab..834823764f1 100644 --- a/deploy/docker-compose.yml +++ b/deploy/docker-compose.yml @@ -16,7 +16,7 @@ services: # Sub2API Application # =========================================================================== sub2api: - image: weishaw/sub2api:latest + image: docker.io/weishaw/sub2api:latest container_name: sub2api restart: unless-stopped ulimits: @@ -194,7 +194,7 @@ services: # PostgreSQL Database # =========================================================================== postgres: - image: postgres:18-alpine + image: docker.io/library/postgres:18-alpine container_name: sub2api-postgres restart: unless-stopped ulimits: @@ -231,7 +231,7 @@ services: # Redis Cache # =========================================================================== redis: - image: redis:8-alpine + image: docker.io/library/redis:8-alpine container_name: sub2api-redis restart: unless-stopped ulimits: @@ -242,11 +242,11 @@ services: - redis_data:/data command: > sh -c ' - redis-server - --save 60 1 - --appendonly yes - --appendfsync everysec - ${REDIS_PASSWORD:+--requirepass "$REDIS_PASSWORD"}' + if [ -n "$$REDIS_PASSWORD" ]; then + exec redis-server --protected-mode no --save 60 1 --appendonly yes --appendfsync everysec --requirepass "$$REDIS_PASSWORD"; + else + exec redis-server --protected-mode no --save 60 1 --appendonly yes --appendfsync everysec; + fi' environment: - TZ=${TZ:-Asia/Shanghai} # REDISCLI_AUTH is used by redis-cli for authentication (safer than -a flag)