agross/upsource

docker-upsource

该Dockerfile用于构建部署JetBrains http://www.jetbrains.com/upsource/实例的镜像，已在Fedora 23和https://www.centos.org/系统上测试通过。

请记得定期备份数据目录，尤其是在升级到新版本之前。

测试运行

1. http://docs.docker.io/en/latest/installation/。
2. 运行容器（按CTRL-C停止）：

sh
docker run -it -p 8080:8080 docker.xuanyuan.run/agross/upsource

3. 打开浏览器，访问 http://localhost:8080。

作为systemd服务运行

1. 准备systemd环境

systemd 229及更高版本默认将https://www.freedesktop.org/software/systemd/man/systemd.resource-control.html#TasksMax=N限制为512。任务等同于线程（内核和用户空间线程）。Upsource容器启动后约运行740个线程。

如果出现 java.lang.OutOfMemoryError unable to create new native thread 错误，需增加Upsource容器systemd作用域的任务限制或所有单元的https://www.freedesktop.org/software/systemd/man/systemd-system.conf.html#DefaultTasksMax=：

sh
vim /etc/systemd/system.conf.d/default-tasks-max-required-for-upsource.conf

粘贴以下内容：

[Manager]
DefaultTasksMax=infinity

sh
systemctl daemon-reexec

2. 设置基础参数

确定Upsource数据和日志的存储位置，设置域名/服务器名及公共端口：

sh
UPSOURCE_DATA="/var/data/upsource"
UPSOURCE_LOGS="/var/log/upsource"

DOMAIN=example.com
PORT=8013

3. 创建数据和日志目录

在容器外部创建用于存储数据和日志的目录：

sh
mkdir --parents "$UPSOURCE_DATA/backups" \
                "$UPSOURCE_DATA/conf" \
                "$UPSOURCE_DATA/data" \
                "$UPSOURCE_LOGS"

4. 设置权限

Dockerfile创建了UID和GID均为6000的upsource用户和组。需在主机系统添加具有相同UID和GID的用户，并允许其读写$UPSOURCE_DATA和$UPSOURCE_LOGS目录。主机用户和组的名称不重要。

sh
# 在Docker主机创建upsource组和用户，例如：
groupadd --gid 6000 --system upsource
useradd --uid 6000 --gid 6000 --system --shell /sbin/nologin --comment "JetBrains Upsource" upsource

# 6000是Dockerfile创建的upsource用户和组的ID
chown -R 6000:6000 "$UPSOURCE_DATA" "$UPSOURCE_LOGS"

5. 创建容器

注意： 卷挂载的:z选项确保目录的SELinux上下文被http://www.projectatomic.io/blog/2015/06/using-volumes-with-docker-can-cause-problems-with-selinux/。

需绑定挂载/etc/localtime以使用与Docker主机相同的时区。

sh
docker create -it -p $PORT:8080 \
                  -v /etc/localtime:/etc/localtime:ro \
                  -v "$UPSOURCE_DATA/backups:/upsource/backups:z" \
                  -v "$UPSOURCE_DATA/conf:/upsource/conf:z" \
                  -v "$UPSOURCE_DATA/data:/upsource/data:z" \
                  -v "$UPSOURCE_LOGS:/upsource/logs:z" \
                  --name upsource \
                  agross/upsource

6. 创建systemd单元文件

创建 /etc/systemd/system/upsource.service：

sh
cat <<EOF > "/etc/systemd/system/upsource.service"
[Unit]
Description=JetBrains Upsource
Requires=docker.service
After=docker.service

[Service]
Restart=always
# 当执行docker stop时，docker-entrypoint.sh的trap+wait组合会生成143的退出状态码（128+15，SIGTERM）
# 更多信息：http://veithen.github.io/2014/11/16/sigterm-propagation.html
SuccessExitStatus=143
PrivateTmp=true
ExecStart=/usr/bin/docker start --attach=true upsource
ExecStop=/usr/bin/docker stop --time=10 upsource

[Install]
WantedBy=multi-user.target
EOF

systemctl enable upsource.service
systemctl start upsource.service

7. 配置日志轮转

创建 /etc/logrotate.d/upsource：

sh
cat <<EOF > "/etc/logrotate.d/upsource"
$UPSOURCE_LOGS/*.log
$UPSOURCE_LOGS/cassandra/*.log
$UPSOURCE_LOGS/hub/*.log
$UPSOURCE_LOGS/internal/services/bundleProcess/*.log
$UPSOURCE_LOGS/upsource-analyzer/*.log
$UPSOURCE_LOGS/upsource-cluster-init/*.log
$UPSOURCE_LOGS/upsource-frontend/*.log
$UPSOURCE_LOGS/upsource-monitoring/*.log
$UPSOURCE_LOGS/upsource-psi/*.log
{
  rotate 7
  daily
  dateext
  missingok
  notifempty
  sharedscripts
  copytruncate
  compress
}
EOF

8. 添加Nginx配置

创建 /etc/nginx/conf.d/upsource.conf：

sh
cat <<EOF > "/etc/nginx/conf.d/upsource.conf"
upstream upsource {
  server localhost:$PORT;
}

server {
  listen           80;
  listen      [::]:80;

  server_name $DOMAIN;

  access_log  /var/log/nginx/$DOMAIN.access.log;
  error_log   /var/log/nginx/$DOMAIN.error.log;

  # 不限制上传大小
  client_max_body_size 0;

  # 避免HTTP 411错误：参见issue #1486 (https://github.com/dotcloud/docker/issues/1486)
  chunked_transfer_encoding on;

  location / {
    proxy_pass http://upsource;

    proxy_set_header Host \$host;
    proxy_set_header X-Real-IP \$remote_addr;
    proxy_set_header X-Forwarded-Host \$http_host;
    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto \$scheme;
    proxy_http_version 1.1;

    # 支持WebSocket
    proxy_set_header Upgrade \$http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_pass_header Sec-Websocket-Extensions;
  }
}
EOF

nginx -s reload

确保SELinux策略允许Nginx访问端口$PORT（步骤3中-p $PORT:8080的第一部分）：

sh
if [ $(semanage port --list | grep --count "^http_port_t.*$PORT") -eq 0 ]; then
  if semanage port --add --type http_port_t --proto tcp $PORT; then
    echo Added port $PORT as a valid port for nginx:
    semanage port --list | grep ^http_port_t
  else
    >&2 echo Could not add port $PORT as a valid port for nginx. Please add it yourself. More information: http://axilleas.me/en/blog/2013/selinux-policy-for-nginx-and-gitlab-unix-socket-in-fedora-19/
  fi
else
  echo Port $PORT is already a valid port for nginx:
  semanage port --list | grep ^http_port_t
fi

9. 配置Upsource

按照JetBrains Upsource的https://confluence.jetbrains.com/display/YTD65/Installing+Upsource+with+ZIP+Distribution步骤进行配置，使用容器内以下路径：

• /upsource/backups
• /upsource/data
• /upsource/logs
• /upsource/temp

10. 升级到新版本

sh
docker pull docker.xuanyuan.run/agross/upsource

systemctl stop upsource.service

# 备份$UPSOURCE_DATA
tar -zcvf "upsource-data-$(date +%F-%H-%M-%S).tar.gz" "$UPSOURCE_DATA"

docker rm upsource

# 重复步骤4创建新镜像
docker create ...

systemctl start upsource.service

构建和测试Dockerfile

1. 构建Dockerfile

sh
docker build --tag agross/upsource:testing .

docker images
# 应包含：
# REPOSITORY                        TAG                 IMAGE ID            CREATED             VIRTUAL SIZE
# agross/upsource                   testing             0dcb8bf6093f        49 seconds ago      405.4 MB

2. 准备测试目录

sh
TEST_DIR="/tmp/upsource-testing"

mkdir --parents "$TEST_DIR/backups" \
                "$TEST_DIR/conf" \
                "$TEST_DIR/data" \
                "$TEST_DIR/logs"
chown -R 6000:6000 "$TEST_DIR"

3. 运行步骤1构建的容器

注意： 卷挂载的:z选项确保目录的SELinux上下文被http://www.projectatomic.io/blog/2015/06/using-volumes-with-docker-can-cause-problems-with-selinux/。

sh
docker run -it --rm \
               --name upsource-testing \
               -p 8080:8080 \
               -v "$TEST_DIR/backups:/upsource/backups:z" \
               -v "$TEST_DIR/conf:/upsource/conf:z" \
               -v "$TEST_DIR/data:/upsource/data:z" \
               -v "$TEST_DIR/logs:/upsource/logs:z" \
               docker.xuanyuan.run/agross/upsource:testing

4. 进入运行中的容器

sh
docker exec -it upsource-testing bash

5. 运行bash而非启动Upsource

注意： 卷挂载的:z选项确保目录的SELinux上下文被http://www.projectatomic.io/blog/2015/06/using-volumes-with-docker-can-cause-problems-with-selinux/。

sh
docker run -it -v "$TEST_DIR/backups:/upsource/backups:z" \
               -v "$TEST_DIR/conf:/upsource/conf:z" \
               -v "$TEST_DIR/data:/upsource/data:z" \
               -v "$TEST_DIR/logs:/upsource/logs:z" \
               docker.xuanyuan.run/agross/upsource:testing bash

不挂载数据目录：

sh
docker run -it docker.xuanyuan.run/agross/upsource:testing bash

6. 清理测试环境

sh
docker ps -aq --no-trunc --filter ancestor=agross/upsource:testing | xargs --no-run-if-empty docker rm
docker images -q --no-trunc agross/upsource:testing | xargs --no-run-if-empty docker rmi
rm -rf "$TEST_DIR"