Further organize Docker images. (#4)

Further organize Docker images.

Author: FisherMS

.github/workflows/docker-build.yml

@@ -69,30 +69,40 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-        # ========== A) 构建 chiseled 瘦镜像 ==========
+      # ========== A) 构建 chiseled 瘦镜像 ==========
       - name: Build & push chiseled
         uses: docker/build-push-action@v4
         with:
           context: .
           file: build/scripts/Dockerfile
-          target: chiseled # 关键：只构建 chiseled 阶段
+          target: chiseled
           push: true
           tags: |
             ${{ env.DOCKERHUB_REPO }}:latest
             ${{ env.DOCKERHUB_REPO }}:${{ steps.set_version.outputs.version }}
             ${{ env.GHCR_REPO_LC }}:latest
             ${{ env.GHCR_REPO_LC }}:${{ steps.set_version.outputs.version }}
 
+      # ========== B) 构建 secure 镜像 ==========
+      - name: Build & push debug
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          file: build/scripts/Dockerfile
+          target: secure
+          push: true
+          tags: |
+            ${{ env.DOCKERHUB_REPO }}:secure
+            ${{ env.GHCR_REPO_LC }}:secure
+
       # ========== B) 构建 debug 镜像 ==========
       - name: Build & push debug
         uses: docker/build-push-action@v4
         with:
           context: .
           file: build/scripts/Dockerfile
-          target: debug # 关键：只构建 debug 阶段
+          target: debug
           push: true
           tags: |
             ${{ env.DOCKERHUB_REPO }}:debug
-            ${{ env.DOCKERHUB_REPO }}:${{ steps.set_version.outputs.version }}-debug
             ${{ env.GHCR_REPO_LC }}:debug
-            ${{ env.GHCR_REPO_LC }}:${{ steps.set_version.outputs.version }}-debug

README.md

@@ -103,8 +103,10 @@ NOTE: `Job type extensions are not supported at the moment`.
   - [Manual Execution](#manual-execution)
   - [As a Windows Service](#as-a-windows-service)
   - [As a Docker Container](#as-a-docker-container)
-    - [Debugging creation](#debugging-creation)
-    - [Production creation](#production-creation)
+    - [Available Docker Versions](#available-docker-versions)
+    - [Debug Creation](#debug-creation)
+    - [Production Environment](#production-environment)
+    - [Production Environment with Minimum Privileges](#production-environment-with-minimum-privileges)
     - [Parameter Description](#parameter-description)
 - [Contributing](#contributing)
 - [Special Thanks](#special-thanks)
@@ -725,23 +727,43 @@ Available Docker registries:
 - <https://github.com/neatFactory/JobAgent/pkgs/container/jobagent>
 > Visit <https://hub.docker.com/r/aicrosoft/jobagent> to get the latest Docker image.
 
-### Debugging creation
+
+### Available Docker Versions
+| Version | Type            | Description                                         |
+| :------ | :-------------- | :-------------------------------------------------- |
+| 1.2.3.4 | Standard        | Root privileges + No shell series                   |
+| latest  | Latest Standard | Root privileges + No shell, latest                  |
+| secure  | Secure          | Minimum privileges + No shell, latest               |
+| debug   | Debug           | Root privileges + Shell + JobSamples plugin, latest |
+
+### Debug Creation
 ```shell
 # You can enter the container to perform operations
 sudo docker run -d \
   --name jobagent-de \
   aicrosoft/jobagent:debug
-### The DEBUG version of the image already has the JobSamples plugin.
+## The DEBUG version image already includes the JobSamples plugin.
+```
+
+### Production Environment
+```shell
+## Create a container.
+sudo docker run -d \
+  --name jobagent \
+  -v /apps/ja/logs:/app/logs:rw \
+  -v /apps/ja/plugins:/app/Plugins:rw \
+  -v /apps/ja/states:/app/states:rw \
+  aicrosoft/jobagent:latest
 ```
 
-### Production creation
+### Production Environment with Minimum Privileges
 ```shell
-## Pre-create Empty Directories on the Host Machine and Assign Permissions
+## Pre-create empty directories on the host machine and assign permissions
 sudo mkdir -p /apps/ja/logs /apps/ja/plugins /apps/ja/states
 sudo chmod -R 777 /apps/ja
 sudo chown -R 65532:65532 /apps/ja
 
-## When creating the container, the plugin directory is empty in the non-DEBUG version.
+## Create a container.
 sudo docker run -d \
   --name jobagent \
   -v /apps/ja/logs:/app/logs:rw \

build/scripts/Dockerfile

@@ -37,21 +37,26 @@ RUN mkdir -p /app/states /app/logs /app/Plugins && \
     chown -R 65532:65532 /app/states /app/logs
 
 # ==============================================================================
-# 阶A：chiseled 瘦镜像（生产用）（chiseled —— 无 sh、无 chmod）
+# 阶A：chiseled 瘦镜像（生产用）（chiseled —— 无 sh、无 chmod） 1.2.3.4 | 普通版本 | root权限 + 无shell
 # ==============================================================================
 FROM mcr.microsoft.com/dotnet/runtime:8.0-jammy-chiseled AS chiseled
 WORKDIR /app
-# 直接拷过去并把属主改成非 root
+COPY --from=build /app .
+ENTRYPOINT ["./JobAgent"]
+
+# ==============================================================================
+# 阶B：chiseled 瘦镜像（生产用）（chiseled —— 无 sh、无 chmod） secure  | 安全版本 | 最小权限 + 无shell
+# ==============================================================================
+FROM mcr.microsoft.com/dotnet/runtime:8.0-jammy-chiseled AS secure
+WORKDIR /app
 COPY --from=build --chown=65532:65532 /app .
 USER 65532
 ENTRYPOINT ["./JobAgent"]
 
 # ==============================================================================
-# 阶段B：带 SDK 的 debug 调试镜像（调试/排障用|带 shell）
+# 阶段C：带 SDK 的 debug 调试镜像（调试/排障用|带 shell）  debug   | 测试版本 | root根限 + 有shell + JobSamples插件
 # ==============================================================================
 FROM mcr.microsoft.com/dotnet/sdk:8.0-jammy AS debug
 WORKDIR /app
-# 这里不需要改属主，默认 root 即可，方便进去装工具
-COPY --from=build /app .
-COPY --from=build /plugin .
+COPY --from=build /app /plugin ./
 ENTRYPOINT ["./JobAgent"]

docs/cn/README.md

@@ -104,8 +104,10 @@ NOTE： `暂时不提供Job类型的扩展`。
   - [手动运行](#手动运行)
   - [作为 Windows 服务](#作为-windows-服务)
   - [Docker 方式](#docker-方式)
+    - [Docker 的可用版本](#docker-的可用版本)
     - [调试创建](#调试创建)
     - [生产环境](#生产环境)
+    - [生产环境 最小权限](#生产环境-最小权限)
     - [Docker参数说明](#docker参数说明)
 - [贡献](#贡献)
 - [特别感谢](#特别感谢)
@@ -724,6 +726,15 @@ install -u  # uninstall it
 - <https://github.com/neatFactory/JobAgent/pkgs/container/jobagent>
 > 访问 <https://hub.docker.com/r/aicrosoft/jobagent> 获取最新的 docker 镜像。
 
+### Docker 的可用版本
+| 版本    | 类型     | 说明                                       |
+| ------- | :------- | :----------------------------------------- |
+| 1.2.3.4 | 普通版本 | root权限 + 无shell 系列                    |
+| latest  | 普通最新 | root权限 + 无shell ，最新                  |
+| secure  | 安全版本 | 最小权限 + 无shell，最新                   |
+| debug   | 测试版本 | root根限 + 有shell + JobSamples插件 ，最新 |
+
+
 ### 调试创建
 ```shell
 # 可以进到容器中进行操作
@@ -735,12 +746,23 @@ sudo docker run -d \
 
 ### 生产环境
 ```shell
+## 创建容器。
+sudo docker run -d \
+  --name jobagent \
+  -v /apps/ja/logs:/app/logs:rw \
+  -v /apps/ja/plugins:/app/Plugins:rw \
+  -v /apps/ja/states:/app/states:rw \
+  aicrosoft/jobagent:latest
+```
+
+### 生产环境 最小权限
+```shell
 ## 在宿主机预建空目录并赋权
 sudo mkdir -p /apps/ja/logs /apps/ja/plugins /apps/ja/states
 sudo chmod -R 777 /apps/ja
 sudo chown -R 65532:65532 /apps/ja
 
-## 创建容器，非DEBUG版本中，插件目录为空。
+## 创建容器。
 sudo docker run -d \
   --name jobagent \
   -v /apps/ja/logs:/app/logs:rw \

docs/en/Docker.md

@@ -54,23 +54,42 @@ Available Docker registries:
 > Visit <https://hub.docker.com/r/aicrosoft/jobagent> to get the latest Docker image.
 
 
-### Debugging creation
+### Available Docker Versions
+| Version | Type            | Description                                         |
+| :------ | :-------------- | :-------------------------------------------------- |
+| 1.2.3.4 | Standard        | Root privileges + No shell series                   |
+| latest  | Latest Standard | Root privileges + No shell, latest                  |
+| secure  | Secure          | Minimum privileges + No shell, latest               |
+| debug   | Debug           | Root privileges + Shell + JobSamples plugin, latest |
+
+### Debug Creation
 ```shell
 # You can enter the container to perform operations
 sudo docker run -d \
   --name jobagent-de \
   aicrosoft/jobagent:debug
-### The DEBUG version of the image already has the JobSamples plugin.
+## The DEBUG version image already includes the JobSamples plugin.
 ```
 
-### Production creation
+### Production Environment
 ```shell
-## Pre-create Empty Directories on the Host Machine and Assign Permissions
+## Create a container.
+sudo docker run -d \
+  --name jobagent \
+  -v /apps/ja/logs:/app/logs:rw \
+  -v /apps/ja/plugins:/app/Plugins:rw \
+  -v /apps/ja/states:/app/states:rw \
+  aicrosoft/jobagent:latest
+```
+
+### Production Environment with Minimum Privileges
+```shell
+## Pre-create empty directories on the host machine and assign permissions
 sudo mkdir -p /apps/ja/logs /apps/ja/plugins /apps/ja/states
 sudo chmod -R 777 /apps/ja
 sudo chown -R 65532:65532 /apps/ja
 
-## When creating the container, the plugin directory is empty in the non-DEBUG version.
+## Create a container.
 sudo docker run -d \
   --name jobagent \
   -v /apps/ja/logs:/app/logs:rw \