@abtnode/core 1.16.32 → 1.16.33-beta-20241001-015316-119b726d

package/lib/api/team.js

@@ -1740,7 +1740,7 @@ class TeamAPI extends EventEmitter {
               userSessions: [userSession],
             },
           });
-          logger.info('sync userSession to federated site successfully', {
+          logger.debug('Sync userSession to federated site successfully', {
             userDid,
             visitorId,
             ua,
@@ -1751,8 +1751,8 @@ class TeamAPI extends EventEmitter {
             extra,
           });
         } catch (err) {
-          logger.info(
-            'sync userSession to federated site failed',
+          logger.error(
+            'Sync userSession to federated site failed',
             {
               userDid,
               visitorId,

package/lib/blocklet/manager/disk.js

@@ -102,7 +102,7 @@ const isFunction = require('lodash/isFunction');
 const { encode } = require('@abtnode/util/lib/base32');
 const formatContext = require('@abtnode/util/lib/format-context');
 const md5 = require('@abtnode/util/lib/md5');
-const { callFederated } = require('@abtnode/auth/lib/util/federated');
+const { callFederated, isMaster } = require('@abtnode/auth/lib/util/federated');
 const pAll = require('p-all');
 const toBlockletDid = require('@blocklet/meta/lib/did');
 const launcher = require('../../util/launcher');
@@ -4622,7 +4622,7 @@ class FederatedBlockletManager extends DiskBlockletManager {
       sites: [],
     });
     const masterSite = federated.sites[0];
-    if (masterSite && masterSite.isMaster !== false) {
+    if (masterSite && isMaster(masterSite)) {
       const nodeInfo = await states.node.read();
       const blockletInfo = getBlockletInfo(blocklet, nodeInfo.sk);
       const { permanentWallet } = blockletInfo;
@@ -4673,7 +4673,7 @@ class FederatedBlockletManager extends DiskBlockletManager {
     });
     const masterSite = federated.sites[0];
     // 只有 Master 可以调用这个逻辑
-    if (masterSite && masterSite.isMaster !== false && masterSite.appPid === did) {
+    if (masterSite && isMaster(masterSite) && masterSite.appPid === did) {
       const nodeInfo = await states.node.read();
       const blockletInfo = getBlockletInfo(blocklet, nodeInfo.sk);
       const { permanentWallet } = blockletInfo;
@@ -4938,9 +4938,14 @@ class FederatedBlockletManager extends DiskBlockletManager {
               site: item,
               data: safeData,
             });
+            logger.debug('Sync federated sites successfully', {
+              action: 'sync',
+              site: item,
+              data: safeData,
+            });
             return result;
           } catch (error) {
-            logger.warn('Failed to sync federated sites', {
+            logger.error('Failed to sync federated sites', {
               error,
               action: 'sync',
               site: item,

package/lib/states/audit-log.js

@@ -194,7 +194,7 @@ const getLogContent = async (action, args, context, result, info, node) => {
     // blocklet federated config
     case 'requestJoinFederated':
       return `request join in federated: member site ${getSiteInfo(
-        args.site
+        args.memberSite
       )} applied to join master site ${getBlockletInfo(result, info)}`;
     case 'quitFederated':
       return `quit federated: member site ${getSiteInfo(args.memberSite)} quit ${getBlockletInfo(result, info)}`;
@@ -204,16 +204,6 @@ const getLogContent = async (action, args, context, result, info, node) => {
       return `audit federated: master site ${getSiteInfo(
         args.masterSite
       )} audit federated login member site ${getBlockletInfo(result, info)} with status: ${args.status}`;
-    case 'syncFederated':
-      const syncData = {
-        users: args.users,
-        sites: args.sites,
-        userSessions: args.userSessions,
-      };
-      return `sync federated: site ${getSiteInfo(args.callerSite)} sync data:
-\`\`\`json
-${JSON.stringify(syncData, null, 2)}
-\`\`\``;
 
     // federated user relate
     case 'loginFederated':
@@ -415,7 +405,6 @@ const getLogCategory = (action) => {
     case 'requestQuitFederated':
     case 'disbandFederated':
     case 'auditFederated':
-    case 'syncFederated':
       return 'blocklet';
 
     // store，此处应该返回 server

package/lib/states/user.js

@@ -522,7 +522,8 @@ SELECT did,inviter,generation FROM UserTree`.trim();
     if (exist) {
       // immutable fields
       delete updates.locale;
-      delete updates.sourceAppPid;
+      // NOTICE: 开放允许修改 sourceAppPid 字段，来进行旧数据的修正
+      // delete updates.sourceAppPid;
       delete updates.inviter;
       delete updates.generation;
 

package/lib/util/blocklet.js

@@ -69,6 +69,7 @@ const {
   BLOCKLET_RESOURCE_DIR,
   BLOCKLET_TENANT_MODES,
   PROJECT,
+  BLOCKLET_INTERFACE_TYPE_DOCKER,
 } = require('@blocklet/constant');
 const validateBlockletEntry = require('@blocklet/meta/lib/entry');
 const { getBlockletEngine } = require('@blocklet/meta/lib/engine');
@@ -98,6 +99,7 @@ const getComponentProcessId = require('@blocklet/meta/lib/get-component-process-
 const { isInServerlessMode } = require('@abtnode/util/lib/serverless');
 const md5 = require('@abtnode/util/lib/md5');
 
+const ensureDockerEndpointHealthy = require('@abtnode/util/lib/ensure-docker-endpoint-healthy');
 const { validate: validateEngine, get: getEngine } = require('../blocklet/manager/engine');
 
 const isRequirementsSatisfied = require('./requirement');
@@ -689,7 +691,7 @@ const startBlockletProcess = async (
       const nextOptions =
         b.meta.group === 'static' || b.mode === BLOCKLET_MODES.DEVELOPMENT
           ? options
-          : await parseDockerOptionsFromPm2(options, nodeInfo);
+          : await parseDockerOptionsFromPm2({ options, nodeInfo, meta: b.meta, ports: b.ports });
 
       await pm2.startAsync(nextOptions);
 
@@ -887,7 +889,9 @@ const _checkProcessHealthy = async (blocklet, { minConsecutiveTime, timeout, log
   const { processId } = env;
 
   const webInterface = (meta.interfaces || []).find((x) => x.type === BLOCKLET_INTERFACE_TYPE_WEB);
-  if (!webInterface) {
+  const dockerInterface = (meta.interfaces || []).find((x) => x.type === BLOCKLET_INTERFACE_TYPE_DOCKER);
+
+  if (!webInterface && !dockerInterface) {
     // TODO: how do we check healthy for service interfaces
     throw new Error(`Blocklet ${name} does not have any web interface`);
   }
@@ -915,7 +919,7 @@ const _checkProcessHealthy = async (blocklet, { minConsecutiveTime, timeout, log
       throw new Error('process not start within 10s');
     }
 
-    const port = findInterfacePortByName({ meta, ports }, webInterface.name);
+    const port = findInterfacePortByName({ meta, ports }, (webInterface || dockerInterface).name);
     if (logToTerminal) {
       // eslint-disable-next-line no-console
       console.log(
@@ -925,7 +929,11 @@ const _checkProcessHealthy = async (blocklet, { minConsecutiveTime, timeout, log
       );
     }
     try {
-      await ensureEndpointHealthy({ port, minConsecutiveTime, timeout });
+      if (webInterface) {
+        await ensureEndpointHealthy({ port, minConsecutiveTime, timeout });
+      } else {
+        await ensureDockerEndpointHealthy({ hostIP: dockerInterface.hostIP, port, minConsecutiveTime, timeout });
+      }
     } catch (error) {
       logger.error('ensure endpoint healthy failed', { port, minConsecutiveTime, timeout });
       throw error;

package/lib/util/docker/alpine-dockerfile.js

@@ -0,0 +1,31 @@
+const dockerfile = `
+# Base image
+FROM node:22-alpine
+
+RUN apk add --no-cache python3 make gcc g++ build-base socat curl gnupg wget su-exec shadow git ca-certificates cairo-dev pango-dev jpeg-dev giflib-dev curl build-essential
+
+RUN ln -sf /usr/bin/python3 /usr/bin/python
+
+ENV DOCKER_DATA /var/lib/blocklet
+VOLUME /var/lib/blocklet
+
+RUN mkdir -p /var/lib/blocklet
+
+ENV NPM_CONFIG_CACHE=/var/lib/blocklet/.npm
+
+RUN npm install -g pnpm nr
+
+ENV PATH=/sbin:$PATH
+
+WORKDIR /var/lib/blocklet
+    `.trim();
+
+module.exports = {
+  dockerfile,
+  image: 'node_alpine_v3',
+  shell: 'su-exec',
+  network: '--network host',
+  baseDir: '/var/lib/blocklet',
+  installNodeModules: true,
+  runBaseScript: true,
+};

package/lib/util/docker/blocklet-custom-dockerfile.js

@@ -0,0 +1,92 @@
+const path = require('path');
+const fs = require('fs');
+const md5 = require('@abtnode/util/lib/md5');
+const alpineDockerfile = require('./alpine-dockerfile');
+
+function getBlockletCustomDockerfile({ appDir, dataDir, meta, ports }) {
+  const dockerMeta = meta.docker || {};
+  if (!dockerMeta.image && !dockerMeta.dockerfile) {
+    return alpineDockerfile;
+  }
+  let file = '';
+  if (dockerMeta.dockerfile) {
+    // 为了安全性, 默认不允许 build custom dockerfile
+    if (!process.env.CAN_BUILD_DOCKER_FILE) {
+      throw new Error('Cannot build dockerfile');
+    }
+    const dockerfilePath = path.join(appDir, dockerMeta.dockerfile);
+    if (!fs.existsSync(dockerfilePath)) {
+      throw new Error('Dockerfile not found');
+    }
+    file = fs.readFileSync(dockerfilePath, 'utf8').trim();
+  }
+
+  const hash = md5(file);
+  let shell;
+  if (dockerMeta.shell) {
+    shell = dockerMeta.shell;
+  } else if (/su-exec/.test(file)) {
+    shell = 'su-exec';
+  } else if (/gosu/.test(file)) {
+    shell = 'gosu';
+  } else {
+    shell = 'sh';
+  }
+  const interfaceMeta = (meta.interfaces || [])
+    .map((item) => (item.containerPort ? item : null))
+    .filter((item) => item !== null);
+
+  let baseDir = '/var/lib/blocklet';
+  if (dockerMeta.workdir) {
+    baseDir = dockerMeta.workdir;
+  } else {
+    const workDir = file.match(/WORKDIR\s+(.+)/)?.[1];
+    if (workDir) {
+      baseDir = workDir;
+    }
+  }
+
+  const volumes = (dockerMeta.volumes || [])
+    .map((volume) => {
+      const [a, b] = volume.split(':');
+      const hostDir = a.replace('$BLOCKLET_DATA_DIR', dataDir).replace('$BLOCKLET_APP_DIR', appDir);
+      return ` -v ${hostDir}:${b} `;
+    })
+    .join('');
+
+  let network = '';
+  if (interfaceMeta.length > 0) {
+    network = interfaceMeta
+      .map((item) => {
+        const port = ports[item.port];
+        return port ? ` -p ${item.hostIP || '127.0.0.1'}:${port}:${item.containerPort}` : '';
+      })
+      .join('')
+      .trim();
+  }
+
+  if (!network.length) {
+    network = `--network ${dockerMeta.network || 'host'}`;
+  }
+
+  // 防止 dockerImage 和 docker args, dockerScript 会注入 -v 等命令
+  const dockerArgs = [dockerMeta.command, dockerMeta.script, dockerMeta.image].filter(Boolean).join(' ');
+  if (/(\s|^)-v\s/.test(dockerArgs)) {
+    throw new Error('Detected forbidden volume mount (-v) in docker args');
+  }
+
+  return {
+    dockerfile: file,
+    image: dockerMeta.image || `blocklet_custom_${hash.slice(0, 16)}`,
+    shell,
+    baseDir,
+    volumes,
+    network,
+    runBaseScript: !!dockerMeta.runBaseScript,
+    args: dockerMeta.command || '',
+    script: dockerMeta.script || dockerMeta.installNodeModules ? '' : 'tail -f /dev/null',
+    installNodeModules: !!dockerMeta.installNodeModules,
+  };
+}
+
+module.exports = getBlockletCustomDockerfile;

package/lib/util/docker/create-docker-image.js

@@ -3,57 +3,19 @@ const path = require('path');
 const { execSync } = require('child_process');
 const logger = require('@abtnode/logger')('@abtnode/core:util:blocklet');
 const { checkDockerHasImage } = require('./check-docker-has-image');
+const getBlockletCustomDockerfile = require('./blocklet-custom-dockerfile');
 
-const DOCKER_IMAGE_NAME = 'blocklet-node-v2';
-
-async function buildImage() {
+async function buildImage({ image, dockerfile }) {
   const dir = process.env.ABT_NODE_DATA_DIR;
   if (!dir) {
     logger.error('ABT_NODE_DATA_DIR is not set');
     return;
   }
-  if (await checkDockerHasImage(DOCKER_IMAGE_NAME)) {
+
+  if (await checkDockerHasImage(image)) {
     return;
   }
   const dockerfilePath = path.join(dir, 'Dockerfile');
-  const dockerfileContent = `
-# Base image
-FROM node:22-alpine
-
-# Install necessary packages
-RUN apk add --no-cache python3 make gcc g++ build-base socat curl gnupg wget su-exec shadow git ca-certificates cairo-dev pango-dev jpeg-dev giflib-dev curl
-
-# Create a symlink for python if necessary
-RUN ln -sf /usr/bin/python3 /usr/bin/python
-
-
-# RUN install --verbose --directory --owner blocklet --group blocklet --mode 3777 /var/run/blocklet
-
-ENV DOCKER_DATA /var/lib/blocklet
-VOLUME /var/lib/blocklet
-
-RUN mkdir -p /var/lib/blocklet
-
-ENV NPM_CONFIG_CACHE=/var/lib/blocklet/.npm
-
-# Set appropriate ownership and permission
-RUN mkdir -p /var/lib/blocklet/.npm
-RUN mkdir -p /var/lib/blocklet/logs
-RUN mkdir -p /var/lib/blocklet/cache
-RUN mkdir -p /var/lib/blocklet/data
-RUN mkdir -p /var/lib/blocklet/blocklets
-RUN chmod -R 777 /var/lib/blocklet
-
-# Install global npm packages
-RUN npm install -g pnpm nr
-
-# Ensure correct PATH
-ENV PATH=/sbin:$PATH
-
-# Set working directory
-WORKDIR /var/lib/blocklet
-
-    `.trim();
 
   try {
     await fs.access(dockerfilePath);
@@ -62,36 +24,37 @@ WORKDIR /var/lib/blocklet
     // File doesn't exist, no need to remove
   }
 
-  await fs.writeFile(dockerfilePath, dockerfileContent);
+  await fs.writeFile(dockerfilePath, dockerfile);
   try {
     execSync(
-      `docker build -f ${path.join(dir, 'Dockerfile')} --no-cache --build-arg uid=$(id -u) --build-arg gid=$(id -g) -t ${DOCKER_IMAGE_NAME} .`,
+      `docker build -f ${path.join(dir, 'Dockerfile')} --no-cache --build-arg uid=$(id -u) --build-arg gid=$(id -g) -t ${image} .`,
       {
         stdio: 'inherit',
         encoding: 'utf-8',
       }
     );
   } catch (error) {
-    // 如果 docker 会报错: ERROR: failed to solve: failed to read dockerfile: open /var/snap/docker/common/var-lib-docker/tmp/buildkit-mount875872699/Dockerfile: no such file or directory
-    // 表示 docker 没有权限访问 ABT_NODE_DATA_DIR 目录, 后续的一系列操作也会失败
     logger.error('Failed to build Docker image. Error:', error.message);
     throw error;
   }
   logger.info('Success build docker image');
 }
 
-let building = false;
+const building = {};
 
-async function createDockerImage() {
-  if (building) {
-    await building;
-    return;
+async function createDockerImage(data) {
+  const dockerfileInfo = getBlockletCustomDockerfile(data);
+  if (building[dockerfileInfo.image]) {
+    await building[dockerfileInfo.image];
+    return dockerfileInfo;
+  }
+  if (dockerfileInfo.dockerfile) {
+    building[dockerfileInfo.image] = buildImage(dockerfileInfo);
+    await building[dockerfileInfo.image];
   }
-  building = buildImage();
-  await building;
+  return dockerfileInfo;
 }
 
 module.exports = {
   createDockerImage,
-  DOCKER_IMAGE_NAME,
 };

package/lib/util/docker/parse-docker-options-from-pm2.js

@@ -4,10 +4,10 @@ const { stringify: stringifyEnvFile } = require('envfile');
 const path = require('path');
 const fs = require('fs/promises');
 const os = require('os');
-const { existsSync } = require('fs-extra');
+const { existsSync, writeFileSync } = require('fs-extra');
 const { NODE_MODES } = require('@abtnode/constant');
 const parseDockerName = require('./parse-docker-name');
-const { DOCKER_IMAGE_NAME, createDockerImage } = require('./create-docker-image');
+const { createDockerImage } = require('./create-docker-image');
 const { checkDockerInstalled, checkDockerInstalledCache } = require('./check-docker-installed');
 
 async function mkdirpWithPermissions(dir, mode = 0o755) {
@@ -20,87 +20,122 @@ async function mkdirpWithPermissions(dir, mode = 0o755) {
   }
 }
 
-async function parseDockerOptionsFromPm2(input, nodeInfo) {
-  // serverless 模式下，不支持跳过 docker
-  if (input.env.SKIP_DOCKER && nodeInfo.mode !== NODE_MODES.SERVERLESS) {
-    return input;
-  }
+// 函数用于生成 root_script.sh 和 user_script.sh
+function createScripts({ rootCommands, userCommands, scriptDir, baseDir, uid, gid, shell }) {
+  const userScriptPath = path.join(scriptDir, 'user_script.sh');
+  const rootScriptPath = path.join(scriptDir, 'root_script.sh');
+  const execShell = shell === 'sh' || shell === 'bash' ? '' : `exec ${shell} ${uid}:${gid}`;
+  // 生成 root_script.sh 内容
+  const rootScriptContent = `
+#!/bin/sh
+${rootCommands.filter(Boolean).join('\n')}
+${execShell} sh -c '${path.join(baseDir, 'dockerTemp', 'user_script.sh')}'
+  `.trim();
+
+  const userScriptContent = `
+#!/bin/sh
+
+${userCommands.filter(Boolean).join('\n')}
+  `.trim();
+
+  writeFileSync(rootScriptPath, rootScriptContent, { mode: 0o755 });
+  writeFileSync(userScriptPath, userScriptContent, { mode: 0o755 });
+}
 
-  // 环境变量或配置项启用了 docker, 就尝试使用 docker
-  const useDocker = input.env.USE_DOCKER || nodeInfo.enableDocker;
+async function parseDockerOptionsFromPm2({ options, nodeInfo, meta, ports }) {
+  // Serverless mode does not support skipping Docker
+  if (options.env.SKIP_DOCKER && nodeInfo.mode !== NODE_MODES.SERVERLESS) {
+    return options;
+  }
 
+  // Use Docker if enabled via environment variable or config
+  const useDocker = options.env.USE_DOCKER || nodeInfo.enableDocker;
   if (!useDocker) {
-    return input;
+    return options;
   }
 
-  // 防止启用了 docker, 但是因为 docker 意外崩溃, 导致 blocklet 不使用 docker 进行运行
+  // Ensure Docker is installed
   if (!nodeInfo.isDockerInstalled) {
     checkDockerInstalledCache.checked = false;
     if (!(await checkDockerInstalled())) {
       throw new Error('Docker is not installed');
     }
   }
-  await createDockerImage();
-  const options = { ...input };
+
+  const dockerInfo = await createDockerImage({
+    appDir: options.env.BLOCKLET_APP_DIR,
+    dataDir: options.env.BLOCKLET_DATA_DIR,
+    meta,
+    ports,
+  });
+  const nextOptions = { ...options };
+  nextOptions.env = { ...nextOptions.env };
   const name = parseDockerName(options.name);
 
-  // 要确保 BLOCKLET_APP_DIR 等环境变量在 docker 容器内正常使用
-  options.env.BLOCKLET_DOCKER_CPUS = options.env.BLOCKLET_DOCKER_CPUS || '2';
-  options.env.BLOCKLET_DOCKER_MEMORY = options.env.BLOCKLET_DOCKER_MEMORY || '2g';
-  options.env.BLOCKLET_DOCKER_DISK_SIZE = options.env.BLOCKLET_DOCKER_DISK_SIZE || '0g';
-  options.env.BLOCKLET_DOCKER_NAME = name;
-  options.env.INTERNAL_HOST = 'host.docker.internal';
+  // Ensure environment variables are properly set within the Docker container
+  const envDefaults = {
+    BLOCKLET_DOCKER_CPUS: '2',
+    BLOCKLET_DOCKER_MEMORY: '2g',
+    BLOCKLET_DOCKER_DISK_SIZE: '0g',
+    BLOCKLET_DOCKER_NAME: name,
+    INTERNAL_HOST: 'host.docker.internal',
+  };
+  nextOptions.env = { ...nextOptions.env, ...envDefaults };
 
-  let dockerEnv = { ...options.env };
-  const baseDir = '/var/lib/blocklet';
+  const dockerEnv = { ...nextOptions.env };
+  const { baseDir } = dockerInfo;
   const serverDir = process.env.ABT_NODE_DATA_DIR;
+  const replaceDir = (dir) => dir.replace(serverDir, baseDir);
+
   dockerEnv.DOCKER_CONTAINER_SERVER_DIR = baseDir;
-  dockerEnv.BLOCKLET_APP_DATA_DIR = options.env.BLOCKLET_APP_DATA_DIR.replace(serverDir, baseDir);
-  dockerEnv.BLOCKLET_APP_DIR = options.env.BLOCKLET_APP_DIR.replace(serverDir, baseDir);
-  dockerEnv.BLOCKLET_DATA_DIR = options.env.BLOCKLET_DATA_DIR.replace(serverDir, baseDir);
+  dockerEnv.BLOCKLET_APP_DATA_DIR = replaceDir(nextOptions.env.BLOCKLET_APP_DATA_DIR);
+  dockerEnv.BLOCKLET_APP_DIR = replaceDir(nextOptions.env.BLOCKLET_APP_DIR);
+  dockerEnv.BLOCKLET_DATA_DIR = replaceDir(nextOptions.env.BLOCKLET_DATA_DIR);
   dockerEnv.BLOCKLET_LOG_DIR = path.join(baseDir, 'logs');
   dockerEnv.BLOCKLET_CACHE_DIR = path.join(baseDir, 'cache');
-  dockerEnv.BLOCKLET_APP_SHARE_DIR = options.env.BLOCKLET_APP_SHARE_DIR.replace(serverDir, baseDir);
-  dockerEnv.BLOCKLET_SHARE_DIR = options.env.BLOCKLET_SHARE_DIR.replace(serverDir, baseDir);
-  dockerEnv.BLOCKLET_DOCKER_NAME = name;
+  dockerEnv.BLOCKLET_APP_SHARE_DIR = replaceDir(nextOptions.env.BLOCKLET_APP_SHARE_DIR);
+  dockerEnv.BLOCKLET_SHARE_DIR = replaceDir(nextOptions.env.BLOCKLET_SHARE_DIR);
   dockerEnv.BLOCKLET_HOST = 'host.docker.internal';
   dockerEnv.USING_DOCKER = 'true';
   dockerEnv.LOCAL_USER_ID = process.getuid();
 
   let nodeModulesName = 'node_modules';
   let installScript = '';
-  if (
-    existsSync(path.join(options.env.BLOCKLET_APP_DIR, 'package.json')) &&
-    existsSync(path.join(options.env.BLOCKLET_APP_DIR, 'blocklet-compact.js'))
-  ) {
-    const packageJson = JSON.parse(await fs.readFile(path.join(options.env.BLOCKLET_APP_DIR, 'package.json'), 'utf-8'));
+  const appDir = nextOptions.env.BLOCKLET_APP_DIR;
+  const packageJsonPath = path.join(appDir, 'package.json');
+  const compactJsPath = path.join(appDir, 'blocklet-compact.js');
+
+  if (dockerInfo.installNodeModules && existsSync(packageJsonPath) && existsSync(compactJsPath)) {
+    const packageJson = JSON.parse(await fs.readFile(packageJsonPath, 'utf-8'));
     if (packageJson.dependencies || packageJson.devDependencies) {
-      dockerEnv.BLOCKLET_APP_PACKAGE_JSON = JSON.stringify(packageJson);
       nodeModulesName = 'docker_node_modules';
-      installScript = 'pnpm install --unsafe-perm --fetch-timeout=60000 --fetch-retries=5 && ';
+      installScript = 'pnpm install --unsafe-perm --fetch-timeout=60000 --fetch-retries=5';
     }
   }
 
-  dockerEnv = JSON.parse(JSON.stringify(dockerEnv).replace(new RegExp(serverDir, 'g'), baseDir));
-  dockerEnv.DOCKER_HOST_SERVER_DIR = serverDir;
-  const envVars = stringifyEnvFile(dockerEnv);
-  const dockerEnvFile = path.join(
-    serverDir,
-    'tmp',
-    'docker',
-    options.env.BLOCKLET_REAL_NAME,
-    COMPONENT_DOCKER_ENV_FILE_NAME
-  );
+  // Replace all occurrences of serverDir with baseDir in dockerEnv
+  const dockerEnvString = JSON.stringify(dockerEnv).replace(new RegExp(serverDir, 'g'), baseDir);
+  const updatedDockerEnv = JSON.parse(dockerEnvString);
+
+  updatedDockerEnv.DOCKER_HOST_SERVER_DIR = serverDir;
+  const envVars = stringifyEnvFile(updatedDockerEnv);
+  const dockerTempDir = path.join(serverDir, 'tmp', 'docker', nextOptions.env.BLOCKLET_REAL_NAME);
+  const dockerEnvFile = path.join(dockerTempDir, COMPONENT_DOCKER_ENV_FILE_NAME);
   await mkdirpWithPermissions(path.dirname(dockerEnvFile));
   await fs.writeFile(dockerEnvFile, envVars);
 
-  const runScript = /(npm|yarn|pnpm|bun)/g.test(options.script) ? options.script : `node ${options.script}`;
-  const networkHost = '--network host';
-  const diskSize =
-    options.env.BLOCKLET_DOCKER_DISK_SIZE !== '0g' ? `--storage-opt size=${options.env.BLOCKLET_DOCKER_DISK_SIZE}` : '';
+  let runScript = dockerInfo.script || '';
+  if (!runScript && dockerInfo.installNodeModules) {
+    runScript = /(npm|yarn|pnpm|bun)/g.test(nextOptions.script) ? nextOptions.script : `node ${nextOptions.script}`;
+  }
 
-  options.args = [];
-  options.namespace = 'blocklets_docker';
+  const diskSizeOption =
+    nextOptions.env.BLOCKLET_DOCKER_DISK_SIZE !== '0g'
+      ? `--storage-opt size=${nextOptions.env.BLOCKLET_DOCKER_DISK_SIZE}`
+      : '';
+
+  nextOptions.args = [];
+  nextOptions.namespace = 'blocklets_docker';
   const uid = process.getuid();
   const gid = process.getgid();
 
@@ -112,43 +147,43 @@ async function parseDockerOptionsFromPm2(input, nodeInfo) {
       target: path.join(baseDir, 'blocklets'),
       canEdit: false,
     },
-    { source: options.env.BLOCKLET_APP_DIR, target: dockerEnv.BLOCKLET_APP_DIR, canEdit: true },
-    { source: options.env.BLOCKLET_DATA_DIR, target: dockerEnv.BLOCKLET_DATA_DIR, canEdit: true },
-    { source: options.env.BLOCKLET_LOG_DIR, target: dockerEnv.BLOCKLET_LOG_DIR, canEdit: true },
-    { source: options.env.BLOCKLET_CACHE_DIR, target: dockerEnv.BLOCKLET_CACHE_DIR, canEdit: true },
+    { source: nextOptions.env.BLOCKLET_APP_DIR, target: dockerEnv.BLOCKLET_APP_DIR, canEdit: true },
+    { source: nextOptions.env.BLOCKLET_DATA_DIR, target: dockerEnv.BLOCKLET_DATA_DIR, canEdit: true },
+    { source: nextOptions.env.BLOCKLET_LOG_DIR, target: dockerEnv.BLOCKLET_LOG_DIR, canEdit: true },
+    { source: nextOptions.env.BLOCKLET_CACHE_DIR, target: dockerEnv.BLOCKLET_CACHE_DIR, canEdit: true },
     {
-      source: path.join(options.env.BLOCKLET_APP_DIR, nodeModulesName),
+      source: path.join(nextOptions.env.BLOCKLET_APP_DIR, nodeModulesName),
       target: path.join(dockerEnv.BLOCKLET_APP_DIR, 'node_modules'),
       canEdit: true,
     },
     {
-      source: path.join(options.env.BLOCKLET_SHARE_DIR),
-      target: path.join(dockerEnv.BLOCKLET_SHARE_DIR),
+      source: nextOptions.env.BLOCKLET_SHARE_DIR,
+      target: dockerEnv.BLOCKLET_SHARE_DIR,
       canEdit: false,
     },
     {
-      source: path.join(options.env.BLOCKLET_APP_SHARE_DIR),
-      target: path.join(dockerEnv.BLOCKLET_APP_SHARE_DIR),
+      source: nextOptions.env.BLOCKLET_APP_SHARE_DIR,
+      target: dockerEnv.BLOCKLET_APP_SHARE_DIR,
       canEdit: true,
     },
     {
-      source: path.join(options.env.BLOCKLET_APP_DATA_DIR, '.config'),
+      source: path.join(nextOptions.env.BLOCKLET_APP_DATA_DIR, '.config'),
       target: path.join(dockerEnv.BLOCKLET_APP_DATA_DIR, '.config'),
       canEdit: false,
     },
     {
-      source: path.join(options.env.BLOCKLET_APP_DATA_DIR, '.assets'),
+      source: path.join(nextOptions.env.BLOCKLET_APP_DATA_DIR, '.assets'),
       target: path.join(dockerEnv.BLOCKLET_APP_DATA_DIR, '.assets'),
       canEdit: false,
     },
     {
-      source: path.join(options.env.BLOCKLET_APP_DATA_DIR, '.projects'),
+      source: path.join(nextOptions.env.BLOCKLET_APP_DATA_DIR, '.projects'),
       target: path.join(dockerEnv.BLOCKLET_APP_DATA_DIR, '.projects'),
       canEdit: true,
     },
     {
-      source: path.join(options.env.BLOCKLET_APP_DATA_DIR),
-      target: path.join(dockerEnv.BLOCKLET_APP_DATA_DIR),
+      source: nextOptions.env.BLOCKLET_APP_DATA_DIR,
+      target: dockerEnv.BLOCKLET_APP_DATA_DIR,
       canEdit: false,
     },
   ].filter((v) => {
@@ -158,49 +193,65 @@ async function parseDockerOptionsFromPm2(input, nodeInfo) {
     sourceDirs.add(v.source);
     return true;
   });
-  let mount = '';
+
+  // Ensure necessary directories exist
   for (const bindMount of bindMounts) {
     if (!existsSync(bindMount.source)) {
       // eslint-disable-next-line no-await-in-loop
       await mkdirpWithPermissions(bindMount.source);
     }
-    mount += ` -v ${bindMount.source}:${bindMount.target}:${bindMount.canEdit ? 'rw' : 'ro'} `;
   }
-  await mkdirpWithPermissions(path.join(options.env.BLOCKLET_APP_DIR, 'node_modules'));
+  await mkdirpWithPermissions(path.join(nextOptions.env.BLOCKLET_APP_DIR, 'node_modules'));
 
-  // 在 mac 系统上，停止后等待 2 秒，不然 orbstack 会崩溃
+  // Construct volume arguments
+  const volumes = bindMounts
+    .map(({ source, target, canEdit }) => `-v ${source}:${target}:${canEdit ? 'rw' : 'ro'}`)
+    .join(' ');
+
+  // On macOS, wait 2 seconds after stopping to prevent Orbstack from crashing
   const awaitRestart = os.platform() === 'linux' ? '' : 'sleep 2 &&';
 
-  options.script = `
+  createScripts({
+    rootCommands: [
+      `echo "start ${meta.name} in docker: ${dockerInfo.network}"`,
+      `mkdir -p ${baseDir} || :`,
+      `mkdir -p ${path.join(baseDir, 'blocklets')} || :`,
+      `mkdir -p ${dockerEnv.BLOCKLET_APP_DIR} || :`,
+      `mkdir -p ${dockerEnv.BLOCKLET_APP_DATA_DIR} || :`,
+      `mkdir -p ${dockerEnv.BLOCKLET_LOG_DIR} || :`,
+      `mkdir -p ${dockerEnv.BLOCKLET_CACHE_DIR} || :`,
+      'mkdir -p /.local || :',
+      `chown ${uid}:${gid} /.local`,
+      `chown ${uid}:${gid} ${baseDir}`,
+      `chown ${uid}:${gid} /`,
+    ],
+    userCommands: [`cd ${dockerEnv.BLOCKLET_APP_DIR}`, installScript, runScript],
+    uid,
+    gid,
+    shell: dockerInfo.shell,
+    baseDir,
+    scriptDir: dockerTempDir,
+  });
+
+  nextOptions.script = `
   docker rm -fv ${name} > /dev/null 2>&1 || true && \
   ${awaitRestart} \
   docker run --name ${name} \
-  ${mount} \
-  ${diskSize} \
+  ${volumes} \
+  ${dockerInfo.volumes || ''} \
+  -v ${dockerTempDir}:${path.join(baseDir, 'dockerTemp')}:rw \
+  ${diskSizeOption} \
   --cpus="${dockerEnv.BLOCKLET_DOCKER_CPUS}" \
   --memory="${dockerEnv.BLOCKLET_DOCKER_MEMORY}" \
   --env-file ${dockerEnvFile} \
-  ${networkHost} \
-  ${DOCKER_IMAGE_NAME} \
-  sh -c '
-    mkdir -p /.local || : && \
-    chown ${uid}:${gid} /.local && \
-    chown ${uid}:${gid} ${baseDir} && \
-    chown ${uid}:${gid} / && \
-    exec su-exec ${uid}:${gid} sh -c "
-    cd ${dockerEnv.BLOCKLET_APP_DIR} && \
-    ${installScript} \
-    ${runScript}
-    "
-  '`;
-
-  options.env = {
-    USING_DOCKER: 'true',
-  };
+  ${dockerInfo.network} \
+  ${dockerInfo.image} ${dockerInfo.command || ''} \
+  ${dockerInfo.runBaseScript ? `sh ${path.join(baseDir, 'dockerTemp', 'root_script.sh')}` : ''}
+  `;
 
-  options.exec_mode = 'fork_mode';
+  nextOptions.exec_mode = 'fork_mode';
 
-  return options;
+  return nextOptions;
 }
 
 module.exports = parseDockerOptionsFromPm2;

package/lib/util/launcher.js

@@ -282,7 +282,7 @@ const setupAppOwner = async ({ node, sessionId, justCreate = false, context }) =
   // create app owner passport
   const passport = createUserPassport(vc, { role });
 
-  // add app owner to database
+  // add app owner to database, app owner can't federated account, so it can't have sourceAppPid field
   const doc = await node.loginUser({
     teamDid: appDid,
     user: {

package/package.json

@@ -3,7 +3,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "1.16.32",
+  "version": "1.16.33-beta-20241001-015316-119b726d",
   "description": "",
   "main": "lib/index.js",
   "files": [
@@ -19,19 +19,19 @@
   "author": "wangshijun <wangshijun2010@gmail.com> (http://github.com/wangshijun)",
   "license": "Apache-2.0",
   "dependencies": {
-    "@abtnode/analytics": "1.16.32",
-    "@abtnode/auth": "1.16.32",
-    "@abtnode/certificate-manager": "1.16.32",
-    "@abtnode/constant": "1.16.32",
-    "@abtnode/cron": "1.16.32",
-    "@abtnode/logger": "1.16.32",
-    "@abtnode/models": "1.16.32",
-    "@abtnode/queue": "1.16.32",
-    "@abtnode/rbac": "1.16.32",
-    "@abtnode/router-provider": "1.16.32",
-    "@abtnode/static-server": "1.16.32",
-    "@abtnode/timemachine": "1.16.32",
-    "@abtnode/util": "1.16.32",
+    "@abtnode/analytics": "1.16.33-beta-20241001-015316-119b726d",
+    "@abtnode/auth": "1.16.33-beta-20241001-015316-119b726d",
+    "@abtnode/certificate-manager": "1.16.33-beta-20241001-015316-119b726d",
+    "@abtnode/constant": "1.16.33-beta-20241001-015316-119b726d",
+    "@abtnode/cron": "1.16.33-beta-20241001-015316-119b726d",
+    "@abtnode/logger": "1.16.33-beta-20241001-015316-119b726d",
+    "@abtnode/models": "1.16.33-beta-20241001-015316-119b726d",
+    "@abtnode/queue": "1.16.33-beta-20241001-015316-119b726d",
+    "@abtnode/rbac": "1.16.33-beta-20241001-015316-119b726d",
+    "@abtnode/router-provider": "1.16.33-beta-20241001-015316-119b726d",
+    "@abtnode/static-server": "1.16.33-beta-20241001-015316-119b726d",
+    "@abtnode/timemachine": "1.16.33-beta-20241001-015316-119b726d",
+    "@abtnode/util": "1.16.33-beta-20241001-015316-119b726d",
     "@arcblock/did": "1.18.135",
     "@arcblock/did-auth": "1.18.135",
     "@arcblock/did-ext": "^1.18.135",
@@ -42,13 +42,13 @@
     "@arcblock/pm2-events": "^0.0.5",
     "@arcblock/validator": "^1.18.135",
     "@arcblock/vc": "1.18.135",
-    "@blocklet/constant": "1.16.32",
-    "@blocklet/env": "1.16.32",
-    "@blocklet/meta": "1.16.32",
-    "@blocklet/resolver": "1.16.32",
-    "@blocklet/sdk": "1.16.32",
-    "@blocklet/store": "1.16.32",
-    "@did-space/client": "^0.5.44",
+    "@blocklet/constant": "1.16.33-beta-20241001-015316-119b726d",
+    "@blocklet/env": "1.16.33-beta-20241001-015316-119b726d",
+    "@blocklet/meta": "1.16.33-beta-20241001-015316-119b726d",
+    "@blocklet/resolver": "1.16.33-beta-20241001-015316-119b726d",
+    "@blocklet/sdk": "1.16.33-beta-20241001-015316-119b726d",
+    "@blocklet/store": "1.16.33-beta-20241001-015316-119b726d",
+    "@did-space/client": "^0.5.47",
     "@fidm/x509": "^1.2.1",
     "@ocap/mcrypto": "1.18.135",
     "@ocap/util": "1.18.135",
@@ -105,5 +105,5 @@
     "jest": "^29.7.0",
     "unzipper": "^0.10.11"
   },
-  "gitHead": "6b6c0abc72e892179a61d6daf7b17e884526db0b"
+  "gitHead": "5cac4c3579c14ebae18810b1f27ecbc63603088d"
 }