22 53 80 631 3128 3306 5432 6010 6081 6082 6379 8080 8144 8145 8148 33055 33060 43709 51000

directus-12-5_directus-net -> 10.89.33.0/24
beanstalkd-net             -> 10.89.56.0/24
concourse-831-net          -> 10.89.58.0/24
pyroscope-2-4-stack_pyroscope-net -> 10.89.62.0/24

denied: requested access to the resource is denied

docker pull gocd/gocd-server:v26.1.0
docker pull gocd/gocd-agent-ubuntu-24.04:v26.1.0

curl -s -u admin:q1w2e3r4 http://localhost:8146/go/api/version -H 'Accept: application/vnd.go.cd.v1+json'

{
  "_links" : {
    "self" : {
      "href" : "http://localhost:8146/go/api/version"
    },
    "doc" : {
      "href" : "https://api.gocd.org/26.1.0/#version"
    }
  },
  "version" : "26.1.0",
  "build_number" : "22803",
  "git_sha" : "55b7b460510bb739c1ae6d226ff7fb650596dca2",
  "full_version" : "26.1.0 (22803-55b7b460510bb739c1ae6d226ff7fb650596dca2)",
  "commit_url" : "https://github.com/gocd/gocd/commit/55b7b460510bb739c1ae6d226ff7fb650596dca2"
}

sudo mkdir -p /opt/data/ops/gocd
sudo mkdir -p /opt/data/gocd/godata /opt/data/gocd/agent-godata
sudo chown -R "$(id -un)":"$(id -gn)" /opt/data/ops/gocd
cd /opt/data/ops/gocd

sudo chown -R 1000:0 /opt/data/gocd/godata /opt/data/gocd/agent-godata

name: gocd-26.1.0-stack

services:
  gocd-server:
    image: gocd/gocd-server:v26.1.0
    container_name: gocd-26.1.0-server
    hostname: gocd-server
    ports:
      - "8146:8153"    # Web UI 与 agent 接入（HTTP）
    environment:
      GOCD_SERVER_JVM_OPTS: "-Xms256m -Xmx512m"
    volumes:
      - /opt/data/gocd/godata:/godata
    networks:
      gocd-net:
        ipv4_address: 10.89.63.10
    restart: unless-stopped

  gocd-agent:
    image: gocd/gocd-agent-ubuntu-24.04:v26.1.0
    container_name: gocd-26.1.0-agent
    hostname: gocd-agent
    environment:
      GO_SERVER_URL: "http://gocd-server:8153/go"
      GOCD_AGENT_JVM_OPTS: "-Xms256m -Xmx512m"
    volumes:
      - /opt/data/gocd/agent-godata:/godata
    depends_on:
      - gocd-server
    networks:
      gocd-net:
        ipv4_address: 10.89.63.11
    restart: unless-stopped

networks:
  gocd-net:
    driver: bridge
    name: gocd-net
    ipam:
      config:
        - subnet: 10.89.63.0/24

cd /opt/data/ops/gocd
docker compose up -d

 Container gocd-26.1.0-server Creating
 Container gocd-26.1.0-server Created
 Container gocd-26.1.0-agent Creating
 Container gocd-26.1.0-agent Created
 Container gocd-26.1.0-server Starting
 Container gocd-26.1.0-server Started
 Container gocd-26.1.0-agent Starting
 Container gocd-26.1.0-agent Started

docker compose ps

NAME                 IMAGE                                  COMMAND                   SERVICE       CREATED          STATUS          PORTS
gocd-26.1.0-agent    gocd/gocd-agent-ubuntu-24.04:v26.1.0   "tini-static -g -- /…"   gocd-agent    59 seconds ago   Up 58 seconds
gocd-26.1.0-server   gocd/gocd-server:v26.1.0               "tini-static -g -- /…"   gocd-server   59 seconds ago   Up 58 seconds   0.0.0.0:8146->8153/tcp, [::]:8146->8153/tcp

docker network inspect gocd-net --format '{{range .IPAM.Config}}{{.Subnet}}{{end}}'

10.89.63.0/24

curl -sI http://localhost:8146/go/auth/login | head -5

HTTP/1.1 200 OK
Date: Tue, 20 Oct 2026 07:09:49 GMT
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN

python3 -c "import bcrypt; print(bcrypt.hashpw(b'q1w2e3r4', bcrypt.gensalt(rounds=10, prefix=b'2a')).decode())"

$2a$10$rDlCydKPpOrf2GQukX9A/O8N.Cck/4rbU45bskdUW/RNziBxuusje

printf 'admin:%s\n' '$2a$10$rDlCydKPpOrf2GQukX9A/O8N.Cck/4rbU45bskdUW/RNziBxuusje' | sudo tee /opt/data/gocd/godata/config/password.properties
sudo chown 1000:0 /opt/data/gocd/godata/config/password.properties

<security>
  <authConfigs>
    <authConfig id="9f2b1c3d4e5f6a7b8c9d0e1f2a3b4c5d" pluginId="cd.go.authentication.passwordfile">
      <property>
        <key>PasswordFilePath</key>
        <value>/godata/config/password.properties</value>
      </property>
    </authConfig>
  </authConfigs>
  <admins>
    <user>admin</user>
  </admins>
</security>

2026-10-20 06:50:38,054 [configFileReload-1] INFO  go.config.ConfigAwareMessageAgent:95 - Config file changed at 2026-10-20T06:50:37.085Z

# 正确密码 → 200
curl -s -o /dev/null -w '%{http_code}\n' -u admin:q1w2e3r4 http://localhost:8146/go/api/version -H 'Accept: application/vnd.go.cd.v1+json'

200

# 错误密码 → 401
curl -s -w '\nhttp=%{http_code}\n' -u admin:wrongpass http://localhost:8146/go/api/agents -H 'Accept: application/vnd.go.cd.v7+json'

{
  "message": "Invalid credentials. Either your username and password are incorrect, or there is a problem with your browser cookies. Please check with your administrator."
}
http=401

curl -s -u admin:q1w2e3r4 http://localhost:8146/go/api/agents -H 'Accept: application/vnd.go.cd.v7+json' | python3 -m json.tool | head -30

{
    "_links": {
        "self": {
            "href": "http://localhost:8146/go/api/agents"
        },
        "doc": {
            "href": "https://api.gocd.org/26.1.0/#agents"
        },
        "find": {
            "href": "http://localhost:8146/go/api/agents/:uuid"
        }
    },
    "_embedded": {
        "agents": [
            {
                "uuid": "701e7549-18d9-49b1-bf9f-5778fadea2c1",
                "hostname": "gocd-agent",
                "ip_address": "10.89.63.11",
                "sandbox": "/go-working-dir",
                "agent_state": "Idle",
                "agent_config_state": "Pending",
                ...
            }
        ]
    }
}

curl -s -w '\nhttp=%{http_code}\n' -X PATCH -u admin:q1w2e3r4 \
  http://localhost:8146/go/api/agents/701e7549-18d9-49b1-bf9f-5778fadea2c1 \
  -H 'Accept: application/vnd.go.cd.v7+json' -H 'If-Match: *' \
  -H 'Content-Type: application/json' \
  -d '{"agent_config_state": "Enabled"}'

{
  "_links" : {
    "self" : {
      "href" : "http://localhost:8146/go/api/agents/701e7549-18d9-49b1-bf9f-5778fadea2c1"
    },
    ...
  },
  "uuid" : "701e7549-18d9-49b1-bf9f-5778fadea2c1",
  "hostname" : "gocd-agent",
  ...
}
http=200

curl -s -u admin:q1w2e3r4 http://localhost:8146/go/api/agents -H 'Accept: application/vnd.go.cd.v7+json' | python3 -c "import json,sys; d=json.load(sys.stdin); print(json.dumps([{'hostname':a['hostname'],'agent_config_state':a['agent_config_state'],'agent_state':a['agent_state']} for a in d['_embedded']['agents']]))"

[{"hostname": "gocd-agent", "agent_config_state": "Enabled", "agent_state": "Idle"}]

cd /opt/data/gocd/godata
git init --bare materials/demo-app.git
cd /tmp && rm -rf demo-app && mkdir demo-app && cd demo-app
git init -b main
echo "hello gocd demo v1" > app.txt
git add app.txt && git commit -m "initial commit"
git remote add origin /opt/data/gocd/godata/materials/demo-app.git
git push origin main

[main (root-commit) bef2ada] initial commit
 Author: root <myquzuo@163.com>
 1 file changed, 1 insertion(+)
 create mode 100644 app.txt
To /opt/data/gocd/godata/materials/demo-app.git
 * [new branch]      main -> main

<pipelines>
  <pipeline name="hello-cd">
    <timer>0 0 5 ? * *</timer>
    <materials>
      <git url="/godata/materials/demo-app.git" branch="main" />
    </materials>
    <stage name="build-stage">
      <jobs>
        <job name="run-echo">
          <tasks>
            <exec command="echo">
              <arg>hello-from-gocd</arg>
              <runif status="passed" />
            </exec>
          </tasks>
        </job>
      </jobs>
    </stage>
  </pipeline>
</pipelines>

curl -s -u admin:q1w2e3r4 http://localhost:8146/go/api/admin/pipeline_groups/defaultGroup -H 'Accept: application/vnd.go.cd.v1+json' | python3 -m json.tool | grep -A3 '"pipelines"'

{
    "name": "defaultGroup",
    "pipelines": [
        "hello-cd"
    ],
    ...
}

# 不带确认头 → 400
curl -s -w '\nhttp=%{http_code}\n' -X POST -u admin:q1w2e3r4 \
  http://localhost:8146/go/api/pipelines/hello-cd/schedule \
  -H 'Accept: application/vnd.go.cd.v1+json'

{
  "message" : "Missing required header 'X-GoCD-Confirm' with value 'true'"
}
http=400

# 带确认头 → 202 受理
curl -s -w '\nhttp=%{http_code}\n' -X POST -u admin:q1w2e3r4 \
  http://localhost:8146/go/api/pipelines/hello-cd/schedule \
  -H 'Accept: application/vnd.go.cd.v1+json' -H 'X-GoCD-Confirm: true'

{
  "message" : "Request to schedule pipeline hello-cd accepted"
}
http=202

curl -s -u admin:q1w2e3r4 http://localhost:8146/go/api/pipelines/hello-cd/history -H 'Accept: application/vnd.go.cd.v1+json' | python3 -m json.tool | grep -E '"counter"|"result"|"state"|"trigger_message"|"name"'

{
    "name": "hello-cd",
    "counter": 2,
    "trigger_message": "Forced by admin",
    "stages": [
        {
            "result": "Passed",
            "status": "Passed",
            "name": "build-stage",
            "jobs": [
                {
                    "name": "run-echo",
                    "state": "Completed",
                    "result": "Passed"
                }
            ]
        }
    ]
},
{
    "name": "hello-cd",
    "counter": 1,
    "trigger_message": "modified by ops <ops@quzuo.net>",
    ...
}

curl -s -u admin:q1w2e3r4 http://localhost:8146/go/files/hello-cd/2/build-stage/1/run-echo/cruise-output/console.log | tail -12

##|06:56:16.434 [go] Start to build hello-cd/2/build-stage/1/run-echo on gocd-agent [/go-working-dir]
!!|06:56:16.443 [go] Task: echo hello-from-gocd
&1|06:56:16.445 hello-from-gocd
?0|06:56:16.495 [go] Task status: passed (52 ms)
j0|06:56:16.507 [go] Current job status: passed
ar|06:56:16.515 [go] Start to upload hello-cd/2/build-stage/1/run-echo on gocd-agent [/go-working-dir]
ex|06:56:16.515 [go] Job completed hello-cd/2/build-stage/1/run-echo on gocd-agent [/go-working-dir]

total 32
drwxr-xr-x 8 yahui root 4096 10月 20 14:42 .
drwxr-xr-x 4 root  root 4096 10月 20 14:25 ..
drwxr-xr-x 3 yahui root 4096 10月 20 14:51 artifacts
drwxr-xr-x 2 yahui root 4096 10月 20 14:46 config
drwxr-xr-x 4 yahui root 4096 10月 20 14:26 db
drwxr-xr-x 2 yahui root 4096 10月 20 15:07 logs
drwxr-xr-x 3 yahui root 4096 10月 20 14:42 materials
drwxr-xr-x 4 yahui root 4096 10月 20 14:26 plugins

docker exec gocd-26.1.0-server sh -c "ps aux | grep '[j]ava' | head -2" | grep -oE '\-Xms[0-9]+m|\-Xmx[0-9]+m|\-XX:MaxMetaspaceSize=[0-9]+m'

-Xms512m
-Xmx1024m
-XX:MaxMetaspaceSize=400m
-Xms256m
-Xmx512m

docker exec gocd-26.1.0-agent sh -c "ps aux | grep '[j]ava'" | tail -1 | grep -oE '\-Xms[0-9]+m|\-Xmx[0-9]+m'

-Xms128m
-Xmx256m
-Xms256m
-Xmx512m

<?xml version="1.0" encoding="utf-8"?>
<cruise xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="cruise-config.xsd" schemaVersion="139">
  <server agentAutoRegisterKey="75f89f53-bea5-4bcd-b05e-a25d18365ee9" webhookSecret="42886f95-d960-445e-8432-f6931466e057" serverId="fdb12fb8-532d-4c8c-87f8-6947361dd82d" tokenGenerationKey="96ee4c80-8397-43c1-aca7-7ea6ef206721">
    <security>
      <authConfigs>
        <authConfig id="9f2b1c3d4e5f6a7b8c9d0e1f2a3b4c5d" pluginId="cd.go.authentication.passwordfile">
          <property>
            <key>PasswordFilePath</key>
            <value>/godata/config/password.properties</value>
          </property>
        </authConfig>
      </authConfigs>
      <admins>
        <user>admin</user>
      </admins>
    </security>
    <artifacts>
      <artifactsDir>artifacts</artifactsDir>
    </artifacts>
  </server>
  <pipelines>
    <pipeline name="hello-cd">
      <timer>0 0 5 ? * *</timer>
      <materials>
        <git url="/godata/materials/demo-app.git" branch="main" />
      </materials>
      <stage name="build-stage">
        <jobs>
          <job name="run-echo">
            <tasks>
              <exec command="echo">
                <arg>hello-from-gocd</arg>
                <runif status="passed" />
              </exec>
            </tasks>
          </job>
        </jobs>
      </stage>
    </pipeline>
  </pipelines>
</cruise>

params? → trackingtool? → timer? → environmentvariables? → dependencies* → materials → stage+

docker network create -d bridge --subnet 10.89.64.0/24 gocd-run-net

b8da58664a11fdf43647965f2bd7bffde138c2465c9938238d53eb37abf3f164

docker run -d --name gocd-26.1.0-run-server --hostname gocd-server \
  -p 8147:8153 \
  -e GOCD_SERVER_JVM_OPTS="-Xms256m -Xmx512m" \
  -v /opt/data/quzuo/tmp/gocd/run-data/godata:/godata \
  --network gocd-run-net \
  gocd/gocd-server:v26.1.0

fe22f859d90baf0f22989d1895f47e4f3c966178696733c26226dbcc4ccd2188

docker run -d --name gocd-26.1.0-run-agent --hostname gocd-agent \
  -e GO_SERVER_URL="http://gocd-server:8153/go" \
  -e GOCD_AGENT_JVM_OPTS="-Xms256m -Xmx512m" \
  -v /opt/data/quzuo/tmp/gocd/run-data/agent-godata:/godata \
  --network gocd-run-net \
  gocd/gocd-agent-ubuntu-24.04:v26.1.0

5f60fbed4e2e835dba017336762bed78574ef3e8efd3dad6297aaed49f5ea6fb

curl -s -u admin:q1w2e3r4 http://localhost:8147/go/api/version -H 'Accept: application/vnd.go.cd.v1+json'

{
  "message": "Basic authentication credentials are not required, since security has been disabled on this server."
}

curl -s http://localhost:8147/go/api/agents -H 'Accept: application/vnd.go.cd.v7+json' | python3 -c "import json,sys; d=json.load(sys.stdin); print(json.dumps([{'uuid':a['uuid'],'hostname':a['hostname'],'agent_state':a['agent_config_state'],'status':a['agent_state'],'ip':a['ip_address']} for a in d['_embedded']['agents']], indent=1))"

[
 {
  "uuid": "f83d3301-8020-40b7-9d9f-599e9c541685",
  "hostname": "gocd-agent",
  "agent_state": "Pending",
  "status": "Unknown",
  "ip": "10.89.64.3"
 }
]

docker rm -f gocd-26.1.0-run-server gocd-26.1.0-run-agent
docker network rm gocd-run-net
rm -rf /opt/data/quzuo/tmp/gocd/run-data

curl -s -w '\nhttp=%{http_code}\n' -X POST -u admin:q1w2e3r4 http://localhost:8146/go/api/pipelines/hello-cd/pause -H 'Accept: application/vnd.go.cd.v1+json' -H 'X-GoCD-Confirm: true' -H 'Content-Type: application/json' -d '{"pauseCause":"api-test"}'

{
  "message" : "Pipeline 'hello-cd' paused successfully."
}
http=200

curl -s -X POST -u admin:q1w2e3r4 http://localhost:8146/go/api/pipelines/hello-cd/unpause -H 'Accept: application/vnd.go.cd.v1+json' -H 'X-GoCD-Confirm: true' -w '\nhttp=%{http_code}\n'

{
  "message" : "Pipeline 'hello-cd' unpaused successfully."
}
http=200

#!/usr/bin/env python3
# 从 docker.1ms.run 手动拉镜像：manifest -> blobs -> OCI layout tar -> docker load
import json, os, sys, subprocess, hashlib, time, urllib.request, urllib.error, shutil

REG = 'https://docker.1ms.run'

class NoRedirect(urllib.request.HTTPRedirectHandler):
    def redirect_request(self, req, fp, code, msg, headers, newurl):
        return None

def http(url, headers=None, dest=None, retries=5):
    req = urllib.request.Request(url)
    req.add_header('User-Agent', 'curl/8.5.0')   # 部分 CDN 拦截 python-urllib 默认 UA
    for k, v in (headers or {}).items():
        req.add_header(k, v)
    last = None
    for i in range(retries):
        try:
            with urllib.request.urlopen(req, timeout=1200) as r:
                data = r.read()
            if dest:
                open(dest, 'wb').write(data)
                return len(data)
            return data
        except Exception as e:
            last = e
            time.sleep(3)
    raise RuntimeError(f'GET failed {url}: {last}')

def main(image, outdir):
    repo, tag = image.split(':')
    os.makedirs(f'{outdir}/blobs/sha256', exist_ok=True)
    tok = json.loads(http(f'{REG}/openapi/v1/auth/token?service=docker.1ms.run&scope=repository:{repo}:pull'))
    token = tok.get('token') or tok.get('access_token')
    H = {'Authorization': f'Bearer {token}'}
    ACC = ('application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.list.v2+json, '
           'application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json')
    idx_raw = http(f'{REG}/v2/{repo}/manifests/{tag}', {**H, 'Accept': ACC})
    idx = json.loads(idx_raw)
    if 'manifests' in idx:  # index -> 取 amd64/linux
        man_digest = next(m['digest'] for m in idx['manifests']
                          if m.get('platform', {}).get('architecture') == 'amd64'
                          and m.get('platform', {}).get('os') == 'linux')
        man_raw = http(f'{REG}/v2/{repo}/manifests/{man_digest}', {**H, 'Accept': ACC})
    else:
        man_raw = idx_raw
        man_digest = 'sha256:' + hashlib.sha256(man_raw).hexdigest()
    man = json.loads(man_raw)
    cfg = man['config']['digest']
    layers = [l['digest'] for l in man['layers']]
    total = sum(l['size'] for l in man['layers'])
    print(f'image {image}: config {cfg[:20]}.. layers={len(layers)} total={total/1e6:.1f}MB', flush=True)

    def blob_path(d):
        return f"{outdir}/blobs/sha256/{d.split(':')[1]}"

    def fetch(d, what):
        p = blob_path(d)
        if os.path.exists(p) and os.path.getsize(p) > 0:
            print(f'  skip {what} {d[:20]}.. ({os.path.getsize(p)/1e6:.1f}MB cached)', flush=True)
            return
        tmp = p + '.part'
        for i in range(8):
            try:
                loc = None
                r = urllib.request.Request(f'{REG}/v2/{repo}/blobs/{d}', headers=H)
                r.add_header('User-Agent', 'curl/8.5.0')
                try:   # 30x 跳转的签名 URL 不能再带 Authorization，手动分离两次请求
                    with urllib.request.build_opener(NoRedirect).open(r, timeout=300) as resp:
                        if resp.status in (301, 302, 307, 308):
                            loc = resp.headers['Location']
                except urllib.error.HTTPError as e:
                    if e.code in (301, 302, 307, 308):
                        loc = e.headers['Location']
                    else:
                        raise
                if loc:
                    lr = urllib.request.Request(loc, headers={'User-Agent': 'curl/8.5.0'})
                    with urllib.request.urlopen(lr, timeout=1800) as resp, open(tmp, 'wb') as f:
                        shutil.copyfileobj(resp, f, 1 << 20)
                else:
                    with urllib.request.urlopen(r, timeout=1800) as resp, open(tmp, 'wb') as f:
                        shutil.copyfileobj(resp, f, 1 << 20)
                os.rename(tmp, p)
                print(f'  got {what} {d[:20]}.. ({os.path.getsize(p)/1e6:.1f}MB)', flush=True)
                return
            except Exception as e:
                print(f'  retry {i+1} {what} {d[:20]}..: {e}', flush=True)
                time.sleep(5)
        raise RuntimeError(f'blob fetch failed {d}')

    fetch(cfg, 'config')
    for i, d in enumerate(layers):
        fetch(d, f'layer{i+1}/{len(layers)}')

    # 组装 OCI layout（manifest 用原始字节保 digest 一致）并打成根级 tar 供 docker load
    open(f'{outdir}/oci-layout', 'w').write('{"imageLayoutVersion":"1.0.0"}')
    open(f'{outdir}/blobs/sha256/{man_digest.split(":")[1]}', 'wb').write(man_raw)
    index = {'schemaVersion': 2, 'mediaType': 'application/vnd.oci.image.index.v1+json',
             'manifests': [{'mediaType': 'application/vnd.oci.image.manifest.v1+json',
                            'digest': man_digest, 'size': os.path.getsize(blob_path(man_digest)),
                            'annotations': {'io.containerd.image.name': f'docker.io/{repo}:{tag}',
                                            'org.opencontainers.image.ref.name': f'{repo}:{tag}'}}]}
    open(f'{outdir}/index.json', 'w').write(json.dumps(index))
    tar = f'{outdir}.tar'
    subprocess.run(['tar', '-C', outdir, '-cf', tar, '.'], check=True)
    print(f'layout tar: {tar} ({os.path.getsize(tar)/1e6:.1f}MB)', flush=True)

if __name__ == '__main__':
    main(sys.argv[1], sys.argv[2])

docker load -i oci-server.tar
docker load -i oci-agent.tar

cd /opt/data/ops/gocd
docker compose stop gocd-agent
sudo rm /opt/data/gocd/agent-godata/config/token
docker compose start gocd-agent