StackStorm Docker Compose 部署指南

目标：在一台 Ubuntu 22.04 服务器上，使用官方 st2-docker 编排把 StackStorm 3.9.0 全栈（含 MongoDB、RabbitMQ、Redis、Web UI）从零部署到可登录、可执行动作，覆盖配置口令、镜像拉取、启动验证、资源水位、常见排障与卸载升级。本文全部命令与输出均在真实环境逐条实测，环境为 Ubuntu 22.04.4 LTS + Docker 29.8.1 + Docker Compose v5.5.1，StackStorm 版本 3.9.0。

一、环境信息

项目	值
服务器	VMware 虚拟机
IP 地址	192.168.146.128
操作系统	Ubuntu 22.04.4 LTS（内核 6.8.0-138-generic）
CPU / 内存	12 核 / 31 GB（`nproc`、`free -h` 实测）
磁盘	/ 分区 786G，已用 276G，可用 475G（`df -h /opt` 实测）
Docker	29.8.1
Docker Compose	v5.5.1
StackStorm 版本	3.9.0（2026-10-19 实查的最新稳定 Release）
对外端口	8123（Web UI）
网段规划	st2-docker_private=10.89.51.0/24、st2-docker_public=10.89.52.0/24

宿主机规格实测回显：

nproc
free -h | head -2
df -h /opt | tail -1

===CPU===
12
===MEM===
               total        used        free      shared  buff/cache   available
Mem:            31Gi        22Gi       500Mi       534Mi       8.1Gi       7.5Gi
===DISK===
/dev/sda3       786G  276G  475G  37% /

二、组件与版本选型

官方 st2-docker 编排共定义 18 个服务：14 个 st2 组件服务 + 3 个外部依赖（MongoDB/RabbitMQ/Redis）+ 1 个一次性密钥初始化作业。部署时全部使用官方镜像，版本与 ST2_VERSION 对齐：

服务	镜像	角色说明
st2web	stackstorm/st2web:3.9.0	Web UI 与 nginx 统一入口（对外 80 端口，本部署映射到宿主 8123）
st2api	stackstorm/st2api:3.9.0	REST API 服务（9101）
st2auth	stackstorm/st2auth:3.9.0	认证服务（9100），读取 htpasswd 口令文件
st2stream	stackstorm/st2stream:3.9.0	事件流 API（9102）
st2actionrunner	stackstorm/st2actionrunner:3.9.0	动作执行器
st2rulesengine	stackstorm/st2rulesengine:3.9.0	规则引擎
st2sensorcontainer	stackstorm/st2sensorcontainer:3.9.0	传感器容器（常驻事件监听）
st2scheduler	stackstorm/st2scheduler:3.9.0	调度器
st2workflowengine	stackstorm/st2workflowengine:3.9.0	Orquesta 工作流引擎
st2timersengine	stackstorm/st2timersengine:3.9.0	定时器引擎
st2notifier	stackstorm/st2notifier:3.9.0	通知器
st2garbagecollector	stackstorm/st2garbagecollector:3.9.0	历史数据清理
st2client	stackstorm/st2actionrunner:3.9.0	CLI 客户端入口（复用 actionrunner 镜像）
st2chatops	stackstorm/st2chatops:3.9.0	ChatOps 服务（默认未启用，退出码 0）
st2makesecrets	stackstorm/st2actionrunner:3.9.0	一次性作业：生成数据存储加密密钥
mongo	mongo:4.4	数据存储
rabbitmq	rabbitmq:3.12	消息总线
redis	redis:7.2	协调/队列

说明：官方 st2-docker 的 docker-compose.yml 未写 container_name 与 mem_limit，本部署在原文件基础上为每个服务补充了 container_name: stackstorm-3.9.0-<service>（便于复查）与 mem_limit（防单服务内存失控），并为两个自定义网络显式指定了子网。下文第三节给出适配后的完整 compose 全文。

三、部署步骤

3.1 获取官方编排仓库

git clone https://github.com/StackStorm/st2-docker.git
cd st2-docker

实测回显：

Cloning into 'st2-docker'...

仓库当前 master 提交（2026-10-19 实查）：

git log -1 --format='%H %ci %s'

7e877763bb6434534058ed7671f271315781ff04 2024-11-13 12:51:17 +0100 Merge pull request #266 from InsulaVentus/adapt-gh-workflow-to-docker-compose-v2

⚠️ 若 GitHub 直连缓慢或失败，走代理克隆：git -c http.proxy=http://192.168.1.62:7897 clone https://github.com/StackStorm/st2-docker.git。

3.2 配置 .env

在仓库根目录创建 .env，指定版本、对外端口与时区：

cat > .env <<'EOF'
ST2_VERSION=3.9.0
ST2_EXPOSE_HTTP=8123
TZ=Asia/Shanghai
EOF
cat .env

实测回显：

ST2_VERSION=3.9.0
ST2_EXPOSE_HTTP=8123
TZ=Asia/Shanghai

三个变量的作用：

ST2_VERSION：全部 stackstorm/* 镜像的标签，决定整套平台版本；
ST2_EXPOSE_HTTP：st2web 对宿主机暴露的端口（官方默认 127.0.0.1:80 仅本机访问；写纯端口号则绑定所有网卡）；
TZ：st2client/st2chatops 的时区。

3.3 配置 Web/CLI 登录口令

认证口令文件在 files/htpasswd（挂载进 st2auth），格式为 htpasswd 的 apr1 哈希。使用 openssl 生成（ apr1 即 Apache MD5 哈希）：

openssl passwd -apr1 q1w2e3r4

实测回显（每次盐值随机，哈希不同属正常）：

$apr1$4ppbpsEw$vDGai.P8x.hssEzD0NjNO1

将哈希写入口令文件（本文统一使用示例账号 st2admin / q1w2e3r4）：

cat > files/htpasswd <<'EOF'
# /etc/st2/htpasswd
# st2admin:q1w2e3r4
st2admin:$apr1$4ppbpsEw$vDGai.P8x.hssEzD0NjNO1
EOF
cat files/htpasswd

实测回显：

# /etc/st2/htpasswd
# st2admin:q1w2e3r4
st2admin:$apr1$4ppbpsEw$vDGai.P8x.hssEzD0NjNO1

同步配置 CLI 客户端凭据文件 files/st2-cli.conf（挂载为 st2client 的 ~/.st2/config），这样容器内 CLI 可免交互认证：

cat > files/st2-cli.conf <<'EOF'
# /root/.st2/config
[credentials]
username = st2admin
password = q1w2e3r4
EOF
cat files/st2-cli.conf

实测回显：

# /root/.st2/config
[credentials]
username = st2admin
password = q1w2e3r4

⚠️ 官方默认口令为 st2admin / Ch@ngeMe，改完 htpasswd 后务必同步 st2-cli.conf，否则 CLI 登录 401。生产环境务必替换为强口令。

3.4 compose 全文

以下是本部署实际使用的 docker-compose.yml 全文（官方文件 + container_name/mem_limit/子网适配），直接覆盖仓库根目录同名文件即可复现：

version: '3'

services:
  st2web:
    image: ${ST2_IMAGE_REPO:-stackstorm/}st2web:${ST2_VERSION:-latest}
    container_name: stackstorm-3.9.0-st2web
    mem_limit: 128m
    restart: on-failure
    environment:
      ST2_AUTH_URL: ${ST2_AUTH_URL:-http://st2auth:9100/}
      ST2_API_URL: ${ST2_API_URL:-http://st2api:9101/}
      ST2_STREAM_URL: ${ST2_STREAM_URL:-http://st2stream:9102/}
      ST2WEB_HTTPS: ${ST2WEB_HTTPS:-0}
    depends_on:
      - st2auth
      - st2api
      - st2stream
    healthcheck:
      test: ["CMD", "/st2web-healthcheck.sh"]
      interval: 30s
      timeout: 1s
      retries: 1
    volumes:
      - ./scripts/st2web-healthcheck.sh:/st2web-healthcheck.sh
      # If you want to use a custom st2web config, edit ./files/config.js accordingly and
      # uncomment the line below
      #- ./files/config.js:/opt/stackstorm/static/webui/config.js:ro
    ports:
      - "${ST2_EXPOSE_HTTP:-127.0.0.1:80}:80"
      # - "${ST2_EXPOSE_HTTPS:-127.0.0.1:443}:443"
      # more work would be needed with certificate generate to make https work.
    networks:
      - private
      - public
  st2makesecrets:
    image: ${ST2_IMAGE_REPO:-stackstorm/}st2actionrunner:${ST2_VERSION:-latest}
    container_name: stackstorm-3.9.0-st2makesecrets
    mem_limit: 64m
    restart: on-failure
    networks:
      - private
    volumes:
      - ./scripts/makesecrets.sh:/makesecrets.sh
      - stackstorm-keys:/etc/st2/keys:rw
    command: /makesecrets.sh
  st2api:
    image: ${ST2_IMAGE_REPO:-stackstorm/}st2api:${ST2_VERSION:-latest}
    container_name: stackstorm-3.9.0-st2api
    mem_limit: 320m
    restart: on-failure
    depends_on:
      - mongo
      - rabbitmq
      - redis
      - st2makesecrets
    networks:
      - private
    environment:
      ST2_AUTH_URL: ${ST2_AUTH_URL:-http://st2auth:9100/}
      ST2_API_URL: ${ST2_API_URL:-http://st2api:9101/}
      ST2_STREAM_URL: ${ST2_STREAM_URL:-http://st2stream:9102/}
    volumes:
      - ./files/st2.docker.conf:/etc/st2/st2.docker.conf:ro
      - ./files/st2.user.conf:/etc/st2/st2.user.conf:ro
      - stackstorm-keys:/etc/st2/keys:ro
      - stackstorm-packs-configs:/opt/stackstorm/configs:rw
      - stackstorm-packs:/opt/stackstorm/packs:rw
      - ./files/rbac:/opt/stackstorm/rbac:rw
      - ${ST2_PACKS_DEV:-./packs.dev}:/opt/stackstorm/packs.dev:rw
  st2stream:
    image: ${ST2_IMAGE_REPO:-stackstorm/}st2stream:${ST2_VERSION:-latest}
    container_name: stackstorm-3.9.0-st2stream
    mem_limit: 160m
    restart: on-failure
    depends_on:
      - st2api
    networks:
      - private
    volumes:
      - ./files/st2.docker.conf:/etc/st2/st2.docker.conf:ro
      - ./files/st2.user.conf:/etc/st2/st2.user.conf:ro
  st2scheduler:
    image: ${ST2_IMAGE_REPO:-stackstorm/}st2scheduler:${ST2_VERSION:-latest}
    container_name: stackstorm-3.9.0-st2scheduler
    mem_limit: 160m
    restart: on-failure
    depends_on:
      - redis
      - st2api
    networks:
      - private
    volumes:
      - ./files/st2.docker.conf:/etc/st2/st2.docker.conf:ro
      - ./files/st2.user.conf:/etc/st2/st2.user.conf:ro
  st2workflowengine:
    image: ${ST2_IMAGE_REPO:-stackstorm/}st2workflowengine:${ST2_VERSION:-latest}
    container_name: stackstorm-3.9.0-st2workflowengine
    mem_limit: 256m
    restart: on-failure
    depends_on:
      - redis
      - st2api
    networks:
      - private
    volumes:
      - ./files/st2.docker.conf:/etc/st2/st2.docker.conf:ro
      - ./files/st2.user.conf:/etc/st2/st2.user.conf:ro
      - stackstorm-keys:/etc/st2/keys:ro
  st2auth:
    image: ${ST2_IMAGE_REPO:-stackstorm/}st2auth:${ST2_VERSION:-latest}
    container_name: stackstorm-3.9.0-st2auth
    mem_limit: 160m
    restart: on-failure
    depends_on:
      - st2api
    networks:
      - private
    volumes:
      - ./files/st2.docker.conf:/etc/st2/st2.docker.conf:ro
      - ./files/st2.user.conf:/etc/st2/st2.user.conf:ro
      - ./files/htpasswd:/etc/st2/htpasswd:ro
  st2actionrunner:
    image: ${ST2_IMAGE_REPO:-stackstorm/}st2actionrunner:${ST2_VERSION:-latest}
    container_name: stackstorm-3.9.0-st2actionrunner
    mem_limit: 256m
    restart: on-failure
    depends_on:
      - redis
      - st2api
    networks:
      - private
    volumes:
      - ./files/st2.docker.conf:/etc/st2/st2.docker.conf:ro
      - ./files/st2.user.conf:/etc/st2/st2.user.conf:ro
      - stackstorm-packs-configs:/opt/stackstorm/configs:rw
      - stackstorm-packs:/opt/stackstorm/packs:rw
      - ${ST2_PACKS_DEV:-./packs.dev}:/opt/stackstorm/packs.dev:rw
      - stackstorm-virtualenvs:/opt/stackstorm/virtualenvs:rw
      - stackstorm-ssh:/home/stanley/.ssh
      # Action runner needs access to keys since action definitions (Jinja
      # templates) can reference secrets
      - stackstorm-keys:/etc/st2/keys:ro
  st2garbagecollector:
    image: ${ST2_IMAGE_REPO:-stackstorm/}st2garbagecollector:${ST2_VERSION:-latest}
    container_name: stackstorm-3.9.0-st2garbagecollector
    mem_limit: 128m
    restart: on-failure
    depends_on:
      - st2api
    networks:
      - private
    volumes:
      - ./files/st2.docker.conf:/etc/st2/st2.docker.conf:ro
      - ./files/st2.user.conf:/etc/st2/st2.user.conf:ro
  st2notifier:
    image: ${ST2_IMAGE_REPO:-stackstorm/}st2notifier:${ST2_VERSION:-latest}
    container_name: stackstorm-3.9.0-st2notifier
    mem_limit: 128m
    restart: on-failure
    depends_on:
      - redis
      - st2api
    networks:
      - private
    volumes:
      - ./files/st2.docker.conf:/etc/st2/st2.docker.conf:ro
      - ./files/st2.user.conf:/etc/st2/st2.user.conf:ro
  st2rulesengine:
    image: ${ST2_IMAGE_REPO:-stackstorm/}st2rulesengine:${ST2_VERSION:-latest}
    container_name: stackstorm-3.9.0-st2rulesengine
    mem_limit: 256m
    restart: on-failure
    depends_on:
      - st2api
    networks:
      - private
    volumes:
      - ./files/st2.docker.conf:/etc/st2/st2.docker.conf:ro
      - ./files/st2.user.conf:/etc/st2/st2.user.conf:ro
  st2sensorcontainer:
    image: ${ST2_IMAGE_REPO:-stackstorm/}st2sensorcontainer:${ST2_VERSION:-latest}
    container_name: stackstorm-3.9.0-st2sensorcontainer
    mem_limit: 256m
    restart: on-failure
    depends_on:
      - st2api
    networks:
      - private
    volumes:
      - ./files/st2.docker.conf:/etc/st2/st2.docker.conf:ro
      - ./files/st2.user.conf:/etc/st2/st2.user.conf:ro
      - stackstorm-virtualenvs:/opt/stackstorm/virtualenvs:ro
      - stackstorm-packs:/opt/stackstorm/packs:ro
      - stackstorm-packs-configs:/opt/stackstorm/configs:ro
      - ${ST2_PACKS_DEV:-./packs.dev}:/opt/stackstorm/packs.dev:ro
  st2timersengine:
    image: ${ST2_IMAGE_REPO:-stackstorm/}st2timersengine:${ST2_VERSION:-latest}
    container_name: stackstorm-3.9.0-st2timersengine
    mem_limit: 128m
    restart: on-failure
    depends_on:
      - st2api
    networks:
      - private
    volumes:
      - ./files/st2.docker.conf:/etc/st2/st2.docker.conf:ro
  st2client:
    image: ${ST2_IMAGE_REPO:-stackstorm/}st2actionrunner:${ST2_VERSION:-latest}
    container_name: stackstorm-3.9.0-st2client
    mem_limit: 128m
    restart: on-failure
    depends_on:
      - st2auth
      - st2api
      - st2stream
    command: /st2client-startup.sh
    networks:
      - private
    environment:
      ST2CLIENT: 1
      ST2_AUTH_URL: ${ST2_AUTH_URL:-http://st2auth:9100/}
      ST2_API_URL: ${ST2_API_URL:-http://st2api:9101/}
      ST2_STREAM_URL: ${ST2_STREAM_URL:-http://st2stream:9102/}
      TZ: ${TZ:-UTC}
    volumes:
      - ./files/st2.docker.conf:/etc/st2/st2.docker.conf:ro
      - ./files/st2.user.conf:/etc/st2/st2.user.conf:ro
      # Technically, client container doesn't need or should have access to the
      # keys in prod setup, but here we make it available to end user for
      # testing and transparency reasons since this setup is primarily mean to
      # be used for testing and development.
      - stackstorm-keys:/etc/st2/keys:ro
      - stackstorm-packs-configs:/opt/stackstorm/configs:rw
      - stackstorm-packs:/opt/stackstorm/packs:rw
      - ./files/rbac:/opt/stackstorm/rbac:rw
      - ${ST2_PACKS_DEV:-./packs.dev}:/opt/stackstorm/packs.dev:rw
      - ./files/st2-cli.conf:/root/.st2/config
      - ./scripts/st2client-startup.sh:/st2client-startup.sh
  st2chatops:
    image: ${ST2_IMAGE_REPO:-stackstorm/}st2chatops:${ST2_VERSION:-latest}
    container_name: stackstorm-3.9.0-st2chatops
    mem_limit: 128m
    restart: on-failure:5
    depends_on:
      - st2api
      - st2auth
      - st2stream
    command: /st2chatops-startup.sh
    networks:
      - private
    environment:
      ST2_AUTH_URL: ${ST2_AUTH_URL:-http://st2auth:9100/}
      ST2_API_URL: ${ST2_API_URL:-http://st2api:9101/}
      ST2_STREAM_URL: ${ST2_STREAM_URL:-http://st2stream:9102/}
      ST2_API_KEY: ${ST2_API_KEY:-change-to-your-st2-api-key}
      TZ: ${TZ:-UTC}
      # enable chatops by setting this variable to any non-zero value
      # and enable/set your hubot adapter specific variables below
      ST2_CHATOPS_ENABLE: ${ST2_CHATOPS_ENABLE:-0}
      # Custom hubot adapter ENV variables to pass through which will override st2chatops.env defaults.
      # See https://github.com/StackStorm/st2chatops/blob/master/st2chatops.env
      # for the full list of supported adapters and example ENV variables.
      HUBOT_ADAPTER: ${HUBOT_ADAPTER:-slack}
      HUBOT_LOG_LEVEL: ${HUBOT_LOG_LEVEL:-debug}
      HUBOT_SLACK_TOKEN: ${HUBOT_SLACK_TOKEN:-}
    volumes:
      - ./scripts/st2chatops-startup.sh:/st2chatops-startup.sh
  # external services
  mongo:
    image: mongo:4.4
    container_name: stackstorm-3.9.0-mongo
    mem_limit: 512m
    restart: on-failure
    networks:
      - private
    volumes:
      - stackstorm-mongodb:/data/db
  rabbitmq:
    image: rabbitmq:3.12
    container_name: stackstorm-3.9.0-rabbitmq
    mem_limit: 256m
    restart: on-failure
    networks:
      - private
    volumes:
      - stackstorm-rabbitmq:/var/lib/rabbitmq
  redis:
    image: redis:7.2
    container_name: stackstorm-3.9.0-redis
    mem_limit: 128m
    restart: on-failure
    networks:
      - private
    volumes:
      - stackstorm-redis:/data

volumes:
    stackstorm-mongodb:
    stackstorm-rabbitmq:
    stackstorm-redis:
    stackstorm-packs:
    stackstorm-packs-configs:
    stackstorm-keys:
    stackstorm-virtualenvs:
    stackstorm-ssh:

networks:
  public:
    driver: bridge
    ipam:
      config:
        - subnet: 10.89.52.0/24
  private:
    driver: bridge
    ipam:
      config:
        - subnet: 10.89.51.0/24

⚠️ 网段说明：官方原文件网络未指定子网，由 Docker 自动分配。本环境约定自定义网络必须显式指定 --subnet 且避开 192.168.0.0/16 与 100.64.0.0/16（避免抢占宿主机局域网路由），故按序取用 10.89.51.0/24 与 10.89.52.0/24。若你的环境这两个网段已被占用，改成其他 10.89.x.0/24 空闲槽位即可。

3.5 拉取镜像

docker compose pull

实测回显（本文复演时镜像已在本机缓存，首次部署会先显示各层下载进度）：

 Image stackstorm/st2api:3.9.0 Pulling
 Image stackstorm/st2scheduler:3.9.0 Pulling
 Image mongo:4.4 Pulling
 Image stackstorm/st2web:3.9.0 Pulling
 Image stackstorm/st2garbagecollector:3.9.0 Pulling
 Image stackstorm/st2sensorcontainer:3.9.0 Pulling
 Image stackstorm/st2actionrunner:3.9.0 Pulling
 Image redis:7.2 Pulling
 Image rabbitmq:3.12 Pulling
 Image stackstorm/st2stream:3.9.0 Pulling
 Image stackstorm/st2chatops:3.9.0 Pulling
 Image stackstorm/st2notifier:3.9.0 Pulling
 Image stackstorm/st2workflowengine:3.9.0 Pulling
 Image stackstorm/st2rulesengine:3.9.0 Pulling
 Image stackstorm/st2auth:3.9.0 Pulling
 Image stackstorm/st2timersengine:3.9.0 Pulling
 Image mongo:4.4 Pulled
 Image stackstorm/st2web:3.9.0 Pulled
 Image stackstorm/st2scheduler:3.9.0 Pulled
 Image rabbitmq:3.12 Pulled
 Image stackstorm/st2chatops:3.9.0 Pulled
 Image stackstorm/st2stream:3.9.0 Pulled
 Image stackstorm/st2auth:3.9.0 Pulled
 Image stackstorm/st2actionrunner:3.9.0 Pulled
 Image stackstorm/st2sensorcontainer:3.9.0 Pulled
 Image stackstorm/st2workflowengine:3.9.0 Pulled
 Image stackstorm/st2rulesengine:3.9.0 Pulled
 Image stackstorm/st2timersengine:3.9.0 Pulled
 Image stackstorm/st2api:3.9.0 Pulled
 Image stackstorm/st2notifier:3.9.0 Pulled
 Image stackstorm/st2garbagecollector:3.9.0 Pulled
 Image redis:7.2 Pulled

3.6 启动全栈

docker compose up -d

实测回显：

 Network st2-docker_private Creating
 Network st2-docker_public Creating
 Network st2-docker_private Created
 Network st2-docker_public Created
 Container stackstorm-3.9.0-mongo Creating
 Container stackstorm-3.9.0-st2makesecrets Creating
 Container stackstorm-3.9.0-redis Creating
 Container stackstorm-3.9.0-rabbitmq Creating
 Container stackstorm-3.9.0-mongo Created
 Container stackstorm-3.9.0-redis Created
 Container stackstorm-3.9.0-rabbitmq Created
 Container stackstorm-3.9.0-st2makesecrets Created
 Container stackstorm-3.9.0-st2api Creating
 Container stackstorm-3.9.0-st2api Created
 Container stackstorm-3.9.0-st2garbagecollector Creating
 Container stackstorm-3.9.0-st2stream Creating
 Container stackstorm-3.9.0-st2auth Creating
 Container stackstorm-3.9.0-st2notifier Creating
 Container stackstorm-3.9.0-st2actionrunner Creating
 Container stackstorm-3.9.0-st2timersengine Creating
 Container stackstorm-3.9.0-st2sensorcontainer Creating
 Container stackstorm-3.9.0-st2scheduler Creating
 Container stackstorm-3.9.0-st2workflowengine Creating
 Container stackstorm-3.9.0-st2rulesengine Creating
 Container stackstorm-3.9.0-st2rulesengine Created
 Container stackstorm-3.9.0-st2notifier Created
 Container stackstorm-3.9.0-st2stream Created
 Container stackstorm-3.9.0-st2scheduler Created
 Container stackstorm-3.9.0-st2garbagecollector Created
 Container stackstorm-3.9.0-st2workflowengine Created
 Container stackstorm-3.9.0-st2actionrunner Created
 Container stackstorm-3.9.0-st2timersengine Created
 Container stackstorm-3.9.0-st2auth Created
 Container stackstorm-3.9.0-st2client Creating
 Container stackstorm-3.9.0-st2web Creating
 Container stackstorm-3.9.0-st2chatops Creating
 Container stackstorm-3.9.0-st2sensorcontainer Created
 Container stackstorm-3.9.0-st2chatops Created
 Container stackstorm-3.9.0-st2web Created
 Container stackstorm-3.9.0-st2client Created
 Container stackstorm-3.9.0-redis Starting
 Container stackstorm-3.9.0-rabbitmq Starting
 Container stackstorm-3.9.0-mongo Starting
 Container stackstorm-3.9.0-st2makesecrets Starting
 Container stackstorm-3.9.0-redis Started
 Container stackstorm-3.9.0-rabbitmq Started
 Container stackstorm-3.9.0-mongo Started
 Container stackstorm-3.9.0-st2makesecrets Started
 Container stackstorm-3.9.0-st2api Starting
 Container stackstorm-3.9.0-st2api Started
 Container stackstorm-3.9.0-st2rulesengine Starting
 Container stackstorm-3.9.0-st2scheduler Starting
 Container stackstorm-3.9.0-st2garbagecollector Starting
 Container stackstorm-3.9.0-st2notifier Starting
 Container stackstorm-3.9.0-st2auth Starting
 Container stackstorm-3.9.0-st2timersengine Starting
 Container stackstorm-3.9.0-st2sensorcontainer Starting
 Container stackstorm-3.9.0-st2actionrunner Starting
 Container stackstorm-3.9.0-st2workflowengine Starting
 Container stackstorm-3.9.0-st2stream Starting
 Container stackstorm-3.9.0-st2rulesengine Started
 Container stackstorm-3.9.0-st2scheduler Started
 Container stackstorm-3.9.0-st2garbagecollector Started
 Container stackstorm-3.9.0-st2notifier Started
 Container stackstorm-3.9.0-st2auth Started
 Container stackstorm-3.9.0-st2timersengine Started
 Container stackstorm-3.9.0-st2sensorcontainer Started
 Container stackstorm-3.9.0-st2workflowengine Started
 Container stackstorm-3.9.0-st2actionrunner Started
 Container stackstorm-3.9.0-st2stream Started
 Container stackstorm-3.9.0-st2chatops Starting
 Container stackstorm-3.9.0-st2client Starting
 Container stackstorm-3.9.0-st2web Starting
 Container stackstorm-3.9.0-st2chatops Started
 Container stackstorm-3.9.0-st2client Started
 Container stackstorm-3.9.0-st2web Started

⚠️ 启动时 compose 会输出 the attribute 'version' is obsolete 警告，是 compose v2 对文件中 version: '3' 行的提示，不影响功能；介意可删除文件首行 version: '3'。

3.7 查看运行状态

docker compose ps

实测回显（启动约 1 分钟后；16 个常驻服务 Up）：

NAME                                   IMAGE                                  STATUS
stackstorm-3.9.0-mongo                 mongo:4.4                              Up About a minute
stackstorm-3.9.0-rabbitmq              rabbitmq:3.12                          Up About a minute
stackstorm-3.9.0-redis                 redis:7.2                              Up About a minute
stackstorm-3.9.0-st2actionrunner       stackstorm/st2actionrunner:3.9.0       Up About a minute
stackstorm-3.9.0-st2api                stackstorm/st2api:3.9.0                Up About a minute
stackstorm-3.9.0-st2auth               stackstorm/st2auth:3.9.0               Up About a minute
stackstorm-3.9.0-st2client             stackstorm/st2actionrunner:3.9.0       Up About a minute
stackstorm-3.9.0-st2garbagecollector   stackstorm/st2garbagecollector:3.9.0   Up About a minute
stackstorm-3.9.0-st2notifier           stackstorm/st2notifier:3.9.0           Up About a minute
stackstorm-3.9.0-st2rulesengine        stackstorm/st2rulesengine:3.9.0        Up About a minute
stackstorm-3.9.0-st2scheduler          stackstorm/st2scheduler:3.9.0          Up About a minute
stackstorm-3.9.0-st2sensorcontainer    stackstorm/st2sensorcontainer:3.9.0    Up About a minute
stackstorm-3.9.0-st2stream             stackstorm/st2stream:3.9.0             Up About a minute
stackstorm-3.9.0-st2timersengine       stackstorm/st2timersengine:3.9.0       Up About a minute
stackstorm-3.9.0-st2web                stackstorm/st2web:3.9.0                Up About a minute (unhealthy)
stackstorm-3.9.0-st2workflowengine     stackstorm/st2workflowengine:3.9.0     Up About a minute

⚠️ st2web 显示 (unhealthy) 是官方健康检查脚本的版本适配问题，不影响功能（Web UI 正常、登录正常），根因与修复见「五、常见问题与排障」5.1 节。

四、部署验证

4.1 CLI 登录

进入 st2client 服务的命令行（后续所有 st2 命令都在该服务中执行，本文写作 docker compose exec st2client st2 ...）：

docker compose exec st2client st2 login st2admin -p q1w2e3r4

实测回显（口令与 3.3 节 htpasswd 一致）：

Logged in as st2admin

Note: You didn't use --write-password option so the password hasn't been stored in the client config and you will need to login again in 24 hours when the auth token expires.
As an alternative, you can run st2 login command with the "--write-password" flag, but keep it mind this will cause it to store the password in plain-text in the client config file (~/.st2/config).

由于 3.3 节已把凭据写入 files/st2-cli.conf，直接执行 docker compose exec st2client st2 --version 无需再手动登录：

docker compose exec st2client st2 --version

实测回显：

st2 3.9.0, on Python 3.10.12

4.2 Web UI 探活

curl -s -o /dev/null -w 'HTTP %{http_code}\n' http://127.0.0.1:8123/

实测回显：

HTTP 200

浏览器访问 http://<服务器IP>:8123/，使用 st2admin / q1w2e3r4 登录即可进入 Web UI。

4.3 网络与子网核验

确认两个自定义网络落在规划的子网：

docker network inspect st2-docker_private --format '{{range .IPAM.Config}}{{.Subnet}}{{end}}'
docker network inspect st2-docker_public --format '{{range .IPAM.Config}}{{.Subnet}}{{end}}'

实测回显：

10.89.51.0/24
10.89.52.0/24

确认默认路由未被影响（宿主机到局域网网关仍走物理网卡 ens33）：

ip route get 192.168.1.62

实测回显：

192.168.1.62 via 192.168.146.2 dev ens33 src 192.168.146.128 uid 0

4.4 资源占用水位

docker stats --no-stream --format '{{.Name}}\t{{.MemUsage}}\t{{.MemPerc}}\t{{.CPUPerc}}' | grep stackstorm | sort

实测回显（空载部署完成后约 1 分钟；mem_limit 为 3.4 节 compose 中的配置值）：

stackstorm-3.9.0-mongo  79.08MiB / 512MiB       15.45%  0.65%
stackstorm-3.9.0-rabbitmq       131.9MiB / 256MiB       51.54%  0.39%
stackstorm-3.9.0-redis  3.746MiB / 128MiB       2.93%   0.10%
stackstorm-3.9.0-st2actionrunner        80.04MiB / 256MiB       31.27%  0.08%
stackstorm-3.9.0-st2api 91.36MiB / 320MiB       28.55%  0.07%
stackstorm-3.9.0-st2auth        89.43MiB / 160MiB       55.89%  0.05%
stackstorm-3.9.0-st2client      2.691MiB / 128MiB       2.10%   0.00%
stackstorm-3.9.0-st2garbagecollector    67.04MiB / 128MiB       52.37%  0.05%
stackstorm-3.9.0-st2notifier    75.7MiB / 128MiB        59.14%  0.14%
stackstorm-3.9.0-st2rulesengine 68.08MiB / 256MiB       26.59%  0.06%
stackstorm-3.9.0-st2scheduler   79.29MiB / 160MiB       49.56%  1.04%
stackstorm-3.9.0-st2sensorcontainer     100.8MiB / 256MiB       39.38%  0.17%
stackstorm-3.9.0-st2stream      85.32MiB / 160MiB       53.33%  0.05%
stackstorm-3.9.0-st2timersengine        76.12MiB / 128MiB       59.47%  0.09%
stackstorm-3.9.0-st2web 17.59MiB / 128MiB       13.74%  0.00%
stackstorm-3.9.0-st2workflowengine      78.86MiB / 256MiB       30.80%  0.08%

16 个常驻服务实际内存合计约 1.1 GB（另有 st2makesecrets/st2chatops 两个一次性服务执行完即退出），2 核 2GB 的测试规格可以跑起来，但按官方建议生产环境按 4 核 16GB+ 规划。

五、常见问题与排障

5.1 st2web 一直显示 unhealthy

现象：docker compose ps 中 st2web 长期显示 Up xx minutes (unhealthy)，但 Web UI 与登录全部正常。

根因定位：查看健康检查脚本 scripts/st2web-healthcheck.sh（官方随仓库提供，挂载进 st2web）。脚本对下游服务做两轮探测：

第一轮直连各服务（预期返回 404 视为存活）：

DOWNSTREAM_API_STATUS=$(curl --write-out "%{http_code}\n" --silent --output /dev/null $ST2_API_URL/v1)
if [ "${DOWNSTREAM_API_STATUS}" != "404" ]; then
  echo "st2api downstream failure"; exit 1;
fi

第二轮经本机 nginx 反代（预期 401/404）。在 st2web 内逐项实测六个探测点：

docker compose exec st2web bash -c \
'curl --write-out "%{http_code}\n" --silent --output /dev/null $ST2_API_URL/v1; \
 curl --write-out "%{http_code}\n" --silent --output /dev/null $ST2_STREAM_URL/v1/stream; \
 curl --write-out "%{http_code}\n" --silent --output /dev/null $ST2_AUTH_URL/v1'

实测回显：

401
401
404

docker compose exec st2web /st2web-healthcheck.sh; echo "exit=$?"

实测回显：

st2api downstream failure
exit=1

结论：脚本第一轮预期直连 $ST2_API_URL/v1 返回 404，但 3.9.0 的 st2api/st2stream 在认证中间件前置下实际返回 401；而经 nginx 的第二轮探测（api=401、stream=401、auth=404）全部符合预期。即服务本身完全正常，是官方脚本对直连返回码的预期过时导致恒为 unhealthy。

修复（可选）：把脚本中直连 st2api/st2stream 的预期码从 404 改为 401（保持 st2auth 的 404 不变），然后重启 st2web：

sed -i 's|if \[ "${DOWNSTREAM_API_STATUS}" != "404" \]|if [ "${DOWNSTREAM_API_STATUS}" != "401" ]|; s|if \[ "${DOWNSTREAM_STREAM_STATUS}" != "404" \]|if [ "${DOWNSTREAM_STREAM_STATUS}" != "401" ]|' scripts/st2web-healthcheck.sh
docker restart stackstorm-3.9.0-st2web

等待一个健康检查周期（interval 30s）后验证：

docker ps --filter name=stackstorm-3.9.0-st2web --format '{{.Names}}\t{{.Status}}'
docker compose exec st2web /st2web-healthcheck.sh; echo "exit=$?"

实测回显：

stackstorm-3.9.0-st2web Up 46 seconds (healthy)
exit=0

不修改脚本也不影响使用，可仅作已知问题记录。

5.2 st2makesecrets / st2chatops 显示 Exited (0)

docker compose ps -a | grep -E 'makesecrets|chatops'

实测回显：

stackstorm-3.9.0-st2chatops            stackstorm/st2chatops:3.9.0            Exited (0)
stackstorm-3.9.0-st2makesecrets        stackstorm/st2actionrunner:3.9.0       Exited (0)

两者均为预期行为：st2makesecrets 是一次性作业（生成数据存储加密密钥 /etc/st2/keys/datastore_key.json，脚本检测到密钥已存在即直接退出）；st2chatops 在 .env 未设置 ST2_CHATOPS_ENABLE=1 及聊天适配器令牌时启动脚本直接退出。不占用资源，无需处理；要启用 ChatOps 时再配置对应变量后 docker compose up -d st2chatops。

5.3 首次拉取镜像慢或超时

st2 各组件镜像单只压缩层 200–600 MB（st2chatops 619 MB、st2actionrunner 约 934 MB 解压后），整套首次拉取约 5–7 GB。若 Docker Hub 直连缓慢，为 Docker 守护进程配置代理（/etc/systemd/system/docker.service.d/http-proxy.conf 设置 HTTPS_PROXY 后 systemctl daemon-reload && systemctl restart docker），或先在有网络的机器 docker compose pull 后 docker save/docker load 迁移。

5.4 端口 8123 被占用

ST2_EXPOSE_HTTP 指定的宿主端口若已被占用，up -d 时 st2web 会启动失败并提示 Bind for 0.0.0.0:8123 failed: port is already allocated。换一个空闲端口改 .env 后重新 docker compose up -d st2web 即可。

5.5 改了 htpasswd 但 CLI 登录 401

htpasswd 与 files/st2-cli.conf 必须成对修改：htpasswd 供 st2auth 校验，st2-cli.conf 供 CLI 免交互登录。只改一边就会出现「Web 能登 CLI 报 401」或相反的错位。修改后无需重建全部服务，挂载文件在服务重启后生效：docker compose restart st2auth st2client。

六、升级与多版本

整套栈的版本由 .env 中 ST2_VERSION 一个变量控制。升级流程：

# 1. 修改 .env 中的 ST2_VERSION 为目标版本
# 2. 拉取新版本镜像
docker compose pull
# 3. 重建全部服务（数据卷保留）
docker compose up -d

说明：

数据落在命名卷（stackstorm-mongodb、stackstorm-rabbitmq、stackstorm-redis、stackstorm-packs 等），up -d 重建服务不会丢数据；
跨大版本升级前先读官方 Upgrade Notes（如 3.9.0 要求 Python 3.8–3.11、MongoDB 基线 7.0、[database] 配置项 ssl_* 改名 tls_*），确认当前数据卷内组件版本兼容目标版本；
回退：把 ST2_VERSION 改回旧版本执行 pull + up -d 即可，但注意新版 MongoDB 数据文件向前兼容、不一定向后兼容，跨库版本回退前先备份数据卷。

七、卸载与清理

停止并移除本栈全部服务（保留数据卷）：

docker compose down

实测回显：

 Container stackstorm-3.9.0-st2workflowengine  Stopping
 Container stackstorm-3.9.0-st2web Stopping
 Container stackstorm-3.9.0-st2chatops Stopped
 Container stackstorm-3.9.0-st2chatops Removed
 Container stackstorm-3.9.0-st2web Stopped
 Container stackstorm-3.9.0-st2web Removed
 Container stackstorm-3.9.0-st2api Stopping
 Container stackstorm-3.9.0-st2api Removed
 Container stackstorm-3.9.0-mongo Stopping
 Container stackstorm-3.9.0-mongo Removed
 Network st2-docker_private Removing
 Network st2-docker_public Removing
 Network st2-docker_private Removed
 Network st2-docker_public Removed

（篇幅所限仅节选首尾，实际输出覆盖全部 18 个服务的 Stopping/Stopped/Removing/Removed 序列。）

如需连同数据卷一起清理（彻底删除动作执行历史、注册内容与密钥，不可恢复）：

docker compose down -v

如需同时删除镜像：

docker compose down -v --rmi all

仓库目录（含 .env、htpasswd、适配后的 compose 全文）按需备份后删除：cd .. && rm -rf st2-docker。

八、参考链接

官方 st2-docker 仓库：https://github.com/StackStorm/st2-docker
官方 Docker 部署文档：https://docs.stackstorm.com/install/docker.html
System Requirements：https://docs.stackstorm.com/install/system_requirements.html
认证与 htpasswd：https://docs.stackstorm.com/authentication.html
镜像空间：https://hub.docker.com/u/stackstorm
下一篇实操：《StackStorm 快速入门与实战示例》
CLI 全量参考：《StackStorm st2 CLI 命令与工具详解》
版本与选型背景：《StackStorm 3.9.0 介绍与选型指南》