imbajin commented on code in PR #3149:
URL: https://github.com/apache/hugegraph/pull/3149#discussion_r3892316598
##########
docker/docker-compose-3pd-3store-3server.yml:
##########
@@ -68,11 +81,9 @@ x-server-common: &server-common
store1: { condition: service_healthy }
store2: { condition: service_healthy }
environment:
- STORE_REST: store0:8520
- HG_SERVER_BACKEND: hstore
- HG_SERVER_PD_PEERS: pd0:8686,pd1:8686,pd2:8686
+ <<: *server-environment
healthcheck:
- test: ["CMD-SHELL", "curl -fsS http://localhost:8080/versions >/dev/null
|| exit 1"]
+ test: ["CMD-SHELL", "curl -fsS http://server0:8080/versions >/dev/null"]
Review Comment:
Confirmed and fixed in 9cf8de733. YAML merge was shallow and the three
overrides dropped interval, timeout, retries, and start_period. The shared
healthcheck now uses $$(hostname), the per-server overrides are removed, and
the render contract asserts the complete timing map for all three Servers. The
latest server image contains hostname and resolves its configured hostname.
##########
docker/docker-compose-hstore.yml:
##########
@@ -0,0 +1,131 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: hugegraph-hstore
+
+networks:
+ hg-net:
+
+volumes:
+ pd-data:
+ store-data:
+ hubble-data:
+
+services:
+ pd:
+ image: hugegraph/pd:${HUGEGRAPH_VERSION:-latest}
+ pull_policy: ${HUGEGRAPH_PULL_POLICY:-missing}
+ restart: unless-stopped
+ networks: [hg-net]
+ environment:
+ HG_PD_GRPC_HOST: pd
+ HG_PD_GRPC_PORT: "8686"
+ HG_PD_REST_PORT: "8620"
+ HG_PD_RAFT_ADDRESS: pd:8610
+ HG_PD_RAFT_PEERS_LIST: pd:8610
+ HG_PD_INITIAL_STORE_LIST: store:8500
+ HG_PD_DATA_PATH: /hugegraph-pd/pd_data
+ ports:
+ - "8620:8620"
+ volumes:
+ - pd-data:/hugegraph-pd/pd_data
+ healthcheck:
+ test: ["CMD-SHELL", "curl -fsS http://localhost:8620/v1/health
>/dev/null"]
+ interval: 10s
+ timeout: 5s
+ retries: 12
+ start_period: 30s
+
+ store:
+ image: hugegraph/store:${HUGEGRAPH_VERSION:-latest}
+ pull_policy: ${HUGEGRAPH_PULL_POLICY:-missing}
+ restart: unless-stopped
+ networks: [hg-net]
+ depends_on:
+ pd:
+ condition: service_healthy
+ environment:
+ HG_STORE_PD_ADDRESS: pd:8686
+ HG_STORE_GRPC_HOST: store
+ HG_STORE_GRPC_PORT: "8500"
+ HG_STORE_REST_PORT: "8520"
+ HG_STORE_RAFT_ADDRESS: store:8510
+ HG_STORE_DATA_PATH: /hugegraph-store/storage
+ ports:
+ - "8520:8520"
+ volumes:
+ - store-data:/hugegraph-store/storage
+ healthcheck:
+ test: ["CMD-SHELL", "curl -fsS http://localhost:8520/v1/health
>/dev/null"]
+ interval: 10s
+ timeout: 10s
+ retries: 30
+ start_period: 60s
+
+ server:
+ image: hugegraph/server:${HUGEGRAPH_VERSION:-latest}
+ pull_policy: ${HUGEGRAPH_PULL_POLICY:-missing}
+ restart: unless-stopped
+ networks: [hg-net]
+ depends_on:
+ store:
+ condition: service_healthy
+ environment:
+ HG_SERVER_BACKEND: hstore
+ HG_SERVER_PD_PEERS: pd:8686
+ HG_SERVER_CLUSTER: hg
+ HG_SERVER_USE_PD: "true"
+ HG_SERVER_REST_URL: http://server:8080
+ HG_SERVER_MIN_FREE_MEMORY: "0"
+ HG_SERVER_INIT_STORE_ENABLED: "false"
+ HG_SERVER_AUTH_TOKEN_SECRET: ${HUGEGRAPH_AUTH_TOKEN_SECRET:-}
+ PASSWORD: ${HUGEGRAPH_ADMIN_PASSWORD:-}
+ ports:
+ - "8080:8080"
Review Comment:
The exposure risk is real, but this is the same policy question already
decided in discussion_r3891967579. Auth-off is an explicitly required local
mode, the README limits it to trusted environments, and broad Server/PD/Store
publishing hardening remains outside this focused redesign. Applying it only to
the new minimal file would also leave the topology family inconsistent, so no
change here.
##########
docker/docker-compose.yml:
##########
@@ -14,117 +14,59 @@
# See the License for the specific language governing permissions and
# limitations under the License.
#
-name: hugegraph-single
+
+name: hugegraph-standalone
networks:
hg-net:
- driver: bridge
volumes:
- hg-pd-data:
- hg-store-data:
+ server-data:
+ hubble-data:
services:
-
- pd:
- image: hugegraph/pd:${HUGEGRAPH_VERSION:-latest}
- pull_policy: always
- container_name: hg-pd
- hostname: pd
- restart: unless-stopped
- networks: [hg-net]
- environment:
- HG_PD_GRPC_HOST: pd
- HG_PD_GRPC_PORT: "8686"
- HG_PD_REST_PORT: "8620"
- HG_PD_RAFT_ADDRESS: pd:8610
- HG_PD_RAFT_PEERS_LIST: pd:8610
- HG_PD_INITIAL_STORE_LIST: store:8500
- HG_PD_DATA_PATH: /hugegraph-pd/pd_data
- ports:
- - "8620:8620"
- volumes:
- - hg-pd-data:/hugegraph-pd/pd_data
- healthcheck:
- test: ["CMD-SHELL", "curl -fsS http://localhost:8620/v1/health
>/dev/null || exit 1"]
- interval: 10s
- timeout: 5s
- retries: 12
- start_period: 30s
-
- store:
- image: hugegraph/store:${HUGEGRAPH_VERSION:-latest}
- pull_policy: always
- container_name: hg-store
- hostname: store
- restart: unless-stopped
- networks: [hg-net]
- depends_on:
- pd:
- condition: service_healthy
- environment:
- HG_STORE_PD_ADDRESS: pd:8686
- HG_STORE_GRPC_HOST: store
- HG_STORE_GRPC_PORT: "8500"
- HG_STORE_REST_PORT: "8520"
- HG_STORE_RAFT_ADDRESS: store:8510
- HG_STORE_DATA_PATH: /hugegraph-store/storage
- ports:
- - "8520:8520"
- volumes:
- - hg-store-data:/hugegraph-store/storage
- healthcheck:
- test: ["CMD-SHELL", "curl -fsS http://localhost:8520/v1/health
>/dev/null || exit 1"]
- interval: 10s
- timeout: 10s
- retries: 30
- start_period: 60s
-
server:
- image:
${HUGEGRAPH_SERVER_IMAGE:-hugegraph/server:${HUGEGRAPH_VERSION:-latest}}
- pull_policy: ${HUGEGRAPH_SERVER_PULL_POLICY:-always}
- container_name: hg-server
- hostname: server
+ image: hugegraph/hugegraph:${HUGEGRAPH_VERSION:-latest}
+ pull_policy: ${HUGEGRAPH_PULL_POLICY:-missing}
restart: unless-stopped
networks: [hg-net]
- depends_on:
- store:
- condition: service_healthy
environment:
- HG_SERVER_BACKEND: hstore
- HG_SERVER_PD_PEERS: pd:8686
- HG_SERVER_CLUSTER: hg
- HG_SERVER_USE_PD: "true"
- HG_SERVER_REST_URL: http://server:8080
- HG_SERVER_MIN_FREE_MEMORY: "0"
- HG_SERVER_INIT_STORE_ENABLED: "false"
+ PASSWORD: ${HUGEGRAPH_ADMIN_PASSWORD:-}
HG_SERVER_AUTH_TOKEN_SECRET: ${HUGEGRAPH_AUTH_TOKEN_SECRET:-}
- PASSWORD: ${HUGEGRAPH_ADMIN_PASSWORD:?Set a non-default admin password}
+ HG_SERVER_MIN_FREE_MEMORY: "0"
ports:
- "8080:8080"
+ volumes:
+ - server-data:/hugegraph-server/rocksdb-data
healthcheck:
- test: ["CMD-SHELL", "curl -fsS http://server:8080/versions >/dev/null ||
exit 1"]
+ test: ["CMD-SHELL", "curl -fsS http://localhost:8080/versions
>/dev/null"]
interval: 10s
timeout: 5s
retries: 30
start_period: 60s
hubble:
- image: ${HUBBLE_IMAGE:-hugegraph/hubble:${HUGEGRAPH_VERSION:-latest}}
- pull_policy: ${HUBBLE_PULL_POLICY:-always}
- container_name: hg-hubble
- hostname: hubble
+ image: ${HUBBLE_IMAGE:-hugegraph/hubble:latest}
+ pull_policy: ${HUBBLE_PULL_POLICY:-missing}
restart: unless-stopped
networks: [hg-net]
depends_on:
server:
condition: service_healthy
+ environment:
+ SPRING_DATASOURCE_URL:
jdbc:h2:file:/hubble/data/hubble;DB_CLOSE_ON_EXIT=FALSE
ports:
- "${HUBBLE_PUBLISH_HOST:-127.0.0.1}:8088:8088"
volumes:
- -
./hugegraph-hubble.properties:/hubble/conf/hugegraph-hubble.properties:ro
+ - hubble-data:/hubble/data
+ -
./conf/hubble/standalone.properties:/hubble/conf/hugegraph-hubble.properties:ro
healthcheck:
- test: ["CMD-SHELL", "body=$$(curl -fsS http://127.0.0.1:8088/about) &&
printf '%s' \"$$body\" | grep -q '\"status\":200' && printf '%s' \"$$body\" |
grep -q '\"name\":\"hugegraph-hubble\"'"]
+ test:
+ - CMD-SHELL
+ - >-
+ body=$$(curl -fsS http://localhost:8088/about) &&
+ printf '%s' "$$body" | grep -q '"status":200' &&
+ printf '%s' "$$body" | grep -q '"name":"hugegraph-hubble"'
Review Comment:
Keeping the current check. The one-line pipeline is not strictly equivalent
under CMD-SHELL: without pipefail, grep can return success after curl returns a
nonzero status with partial matching output. The current body=$(curl ...) &&
checks preserve curl failure independently and retain both application status
and product identity.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
