Improve Fedora Podman compose compatibility

README.md

@@ -393,6 +393,12 @@ docker compose -f docker-compose.local.yml logs -f sub2api
 
 **Recommendation:** Use `docker-compose.local.yml` (deployed by script) for easier data management.
 
+#### Fedora / Podman / SELinux Notes
+
+Fedora hosts commonly run Docker Compose through Podman and enforce SELinux by default. The compose files use fully qualified image names (`docker.io/...`) so Podman does not stop on short-name resolution prompts in non-interactive deployments.
+
+When using `docker-compose.local.yml`, keep the `:Z` suffix on local bind mounts such as `./data:/app/data:Z`. This lets Podman relabel `data/`, `postgres_data/`, and `redis_data/` for container access while SELinux is enforcing.
+
 #### Access
 
 Open `http://YOUR_SERVER_IP:8080` in your browser.

README_CN.md

@@ -397,6 +397,12 @@ docker compose -f docker-compose.local.yml logs -f sub2api
 
 **推荐：** 使用 `docker-compose.local.yml`（脚本部署）以便更轻松地管理数据。
 
+#### Fedora / Podman / SELinux 说明
+
+Fedora 系统通常通过 Podman 运行 Docker Compose，并默认启用 SELinux。Compose 文件使用完整镜像名（`docker.io/...`），避免 Podman 在非交互部署时因短镜像名解析提示而中断。
+
+使用 `docker-compose.local.yml` 时，请保留本地目录挂载中的 `:Z` 后缀，例如 `./data:/app/data:Z`。这会让 Podman 为 `data/`、`postgres_data/`、`redis_data/` 添加容器可访问的 SELinux 标签。
+
 #### 启用“数据管理”功能（datamanagementd）
 
 如需启用管理后台“数据管理”，需要额外部署宿主机数据管理进程 `datamanagementd`。

deploy/DOCKER.md

@@ -20,7 +20,7 @@ version: '3.8'
 
 services:
   sub2api:
-    image: weishaw/sub2api:latest
+    image: docker.io/weishaw/sub2api:latest
     ports:
       - "8080:8080"
     environment:
@@ -31,7 +31,7 @@ services:
       - redis
 
   db:
-    image: postgres:15-alpine
+    image: docker.io/library/postgres:15-alpine
     environment:
       - POSTGRES_USER=postgres
       - POSTGRES_PASSWORD=postgres
@@ -40,7 +40,7 @@ services:
       - postgres_data:/var/lib/postgresql/data
 
   redis:
-    image: redis:7-alpine
+    image: docker.io/library/redis:7-alpine
     volumes:
       - redis_data:/data
 

deploy/README.md

@@ -106,6 +106,12 @@ docker compose -f docker-compose.local.yml logs -f sub2api
 
 **Recommendation:** Use `docker-compose.local.yml` (deployed by `docker-deploy.sh`) for easier data management and migration.
 
+### Fedora / Podman / SELinux Notes
+
+Fedora hosts commonly run Docker Compose through Podman and enforce SELinux by default. The compose files use fully qualified image names (`docker.io/...`) so Podman does not stop on short-name resolution prompts in non-interactive deployments.
+
+When using `docker-compose.local.yml`, keep the `:Z` suffix on local bind mounts such as `./data:/app/data:Z`. This lets Podman relabel `data/`, `postgres_data/`, and `redis_data/` for container access while SELinux is enforcing.
+
 ### How Auto-Setup Works
 
 When using Docker Compose with `AUTO_SETUP=true`:

deploy/docker-compose.dev.yml

@@ -87,7 +87,7 @@ services:
       start_period: 30s
 
   postgres:
-    image: postgres:18-alpine
+    image: docker.io/library/postgres:18-alpine
     container_name: sub2api-postgres-dev
     restart: unless-stopped
     volumes:
@@ -108,18 +108,18 @@ services:
       start_period: 10s
 
   redis:
-    image: redis:8-alpine
+    image: docker.io/library/redis:8-alpine
     container_name: sub2api-redis-dev
     restart: unless-stopped
     volumes:
       - ./redis_data:/data:Z
     command: >
         sh -c '
-          redis-server
-          --save 60 1
-          --appendonly yes
-          --appendfsync everysec
-          ${REDIS_PASSWORD:+--requirepass "$REDIS_PASSWORD"}'
+          if [ -n "$$REDIS_PASSWORD" ]; then
+            exec redis-server --protected-mode no --save 60 1 --appendonly yes --appendfsync everysec --requirepass "$$REDIS_PASSWORD";
+          else
+            exec redis-server --protected-mode no --save 60 1 --appendonly yes --appendfsync everysec;
+          fi'
     environment:
       - TZ=${TZ:-Asia/Shanghai}
       - REDISCLI_AUTH=${REDIS_PASSWORD:-}

deploy/docker-compose.local.yml

@@ -24,7 +24,7 @@ services:
   # Sub2API Application
   # ===========================================================================
   sub2api:
-    image: weishaw/sub2api:latest
+    image: docker.io/weishaw/sub2api:latest
     container_name: sub2api
     restart: unless-stopped
     ulimits:
@@ -188,7 +188,7 @@ services:
   # PostgreSQL Database
   # ===========================================================================
   postgres:
-    image: postgres:18-alpine
+    image: docker.io/library/postgres:18-alpine
     container_name: sub2api-postgres
     restart: unless-stopped
     ulimits:
@@ -219,7 +219,7 @@ services:
   # Redis Cache
   # ===========================================================================
   redis:
-    image: redis:8-alpine
+    image: docker.io/library/redis:8-alpine
     container_name: sub2api-redis
     restart: unless-stopped
     ulimits:
@@ -231,11 +231,11 @@ services:
       - ./redis_data:/data:Z
     command: >
         sh -c '
-          redis-server
-          --save 60 1
-          --appendonly yes
-          --appendfsync everysec
-          ${REDIS_PASSWORD:+--requirepass "$REDIS_PASSWORD"}'
+          if [ -n "$$REDIS_PASSWORD" ]; then
+            exec redis-server --protected-mode no --save 60 1 --appendonly yes --appendfsync everysec --requirepass "$$REDIS_PASSWORD";
+          else
+            exec redis-server --protected-mode no --save 60 1 --appendonly yes --appendfsync everysec;
+          fi'
     environment:
       - TZ=${TZ:-Asia/Shanghai}
       # REDISCLI_AUTH is used by redis-cli for authentication (safer than -a flag)

deploy/docker-compose.standalone.yml

@@ -12,7 +12,7 @@
 
 services:
   sub2api:
-    image: weishaw/sub2api:latest
+    image: docker.io/weishaw/sub2api:latest
     container_name: sub2api
     restart: unless-stopped
     ulimits:

deploy/docker-compose.yml

@@ -16,7 +16,7 @@ services:
   # Sub2API Application
   # ===========================================================================
   sub2api:
-    image: weishaw/sub2api:latest
+    image: docker.io/weishaw/sub2api:latest
     container_name: sub2api
     restart: unless-stopped
     ulimits:
@@ -194,7 +194,7 @@ services:
   # PostgreSQL Database
   # ===========================================================================
   postgres:
-    image: postgres:18-alpine
+    image: docker.io/library/postgres:18-alpine
     container_name: sub2api-postgres
     restart: unless-stopped
     ulimits:
@@ -231,7 +231,7 @@ services:
   # Redis Cache
   # ===========================================================================
   redis:
-    image: redis:8-alpine
+    image: docker.io/library/redis:8-alpine
     container_name: sub2api-redis
     restart: unless-stopped
     ulimits:
@@ -242,11 +242,11 @@ services:
       - redis_data:/data
     command: >
       sh -c '
-        redis-server
-        --save 60 1
-        --appendonly yes
-        --appendfsync everysec
-        ${REDIS_PASSWORD:+--requirepass "$REDIS_PASSWORD"}'
+        if [ -n "$$REDIS_PASSWORD" ]; then
+          exec redis-server --protected-mode no --save 60 1 --appendonly yes --appendfsync everysec --requirepass "$$REDIS_PASSWORD";
+        else
+          exec redis-server --protected-mode no --save 60 1 --appendonly yes --appendfsync everysec;
+        fi'
     environment:
       - TZ=${TZ:-Asia/Shanghai}
       # REDISCLI_AUTH is used by redis-cli for authentication (safer than -a flag)