初始化 Panda RPKI v0.1.0 开源候选版本

docs/docker.md

@@ -0,0 +1,84 @@
+# Docker and Compose
+
+Run commands from the project root. A Linux Docker engine is required for the
+documented deployment and integration tests.
+
+```bash
+docker build -f docker/Dockerfile -t panda-rpki:v0.1.0 .
+```
+
+The image defaults to an unprivileged user and includes CA certificates,
+`rsync` and `/usr/bin/time`. Compose uses a read-only root filesystem and a
+temporary `/tmp`. Host input mounts are read-only; state and outputs are writable.
+
+## Single anchor
+
+```bash
+mkdir -p state output
+export INPUT_DIR="$PWD/input" STATE_DIR="$PWD/state" OUTPUT_DIR="$PWD/output"
+export TAL_FILE=anchor.tal TA_FILE=anchor.cer
+export PUID="$(id -u)" PGID="$(id -g)"
+docker compose -f docker/compose.yaml run --build --rm validator
+```
+
+Supply absolute host paths as above. Relative Compose paths are resolved from
+the Compose file's directory, which is `docker/`. Build context is explicitly
+the project root. `PANDA_RPKI_RRDP_SYNC_MODE` defaults to `auto`.
+
+## All five regional anchors
+
+Follow [Prepare all five RIR trust anchors](trust-anchors.md) to download and
+check each TAL and matching certificate under `input/`, then run:
+
+```bash
+mkdir -p state output
+export INPUT_DIR="$PWD/input" STATE_DIR="$PWD/state" OUTPUT_DIR="$PWD/output"
+export PUID="$(id -u)" PGID="$(id -g)"
+export AFRINIC_TAL_FILE=afrinic.tal AFRINIC_TA_FILE=afrinic.cer
+export APNIC_TAL_FILE=apnic.tal APNIC_TA_FILE=apnic.cer
+export ARIN_TAL_FILE=arin.tal ARIN_TA_FILE=arin.cer
+export LACNIC_TAL_FILE=lacnic.tal LACNIC_TA_FILE=lacnic.cer
+export RIPE_TAL_FILE=ripe.tal RIPE_TA_FILE=ripe.cer
+docker compose -f docker/compose.all5.yaml run --build --rm validator
+```
+
+| Template variable | Default | Applies to |
+| --- | --- | --- |
+| `PANDA_RPKI_WORKERS` | 8 | all5 and daemon object workers |
+| `PANDA_RPKI_REPO_WORKERS` | 8 | all5 and daemon transport workers |
+| `PANDA_RPKI_WORKER_QUEUE_CAPACITY` | 256 | all5 object queue |
+| `PANDA_RPKI_HTTP_TIMEOUT_SECS` | 600 | all5 HTTP timeout (native CLI default is 300) |
+| `PANDA_RPKI_RRDP_SYNC_MODE` | auto | single-anchor and all5 |
+
+The all5 CCR is `OUTPUT_DIR/all5.ccr`; the single-anchor CCR is
+`OUTPUT_DIR/result.ccr`. Reuse `STATE_DIR` and select new `OUTPUT_DIR` values
+to retain multiple cycles. These templates take no bundled RIR input files.
+
+## Daemon service
+
+```bash
+mkdir -p data/daemon
+export INPUT_DIR="$PWD/input" DAEMON_DIR="$PWD/data/daemon"
+export TAL_FILE=anchor.tal TA_FILE=anchor.cer
+export PUID="$(id -u)" PGID="$(id -g)"
+export PANDA_RPKI_INTERVAL_SECS=600 PANDA_RPKI_RETAIN_RUNS=10
+docker compose -f docker/compose.daemon.yaml up -d --build
+docker compose -f docker/compose.daemon.yaml logs -f validator
+# Stop gracefully; persistent host data remains available.
+docker compose -f docker/compose.daemon.yaml stop
+```
+
+Defaults: interval 60 seconds, retain 10, `PANDA_RPKI_RUN_TIMEOUT_SECS=0`
+(disabled), log level `info`, log format `json`. The daemon template passes
+`PANDA_RPKI_LOG_LEVEL` and `PANDA_RPKI_LOG_FORMAT` into the container.
+It restarts unless stopped and allows 40 seconds for shutdown, exceeding the
+controller's default 30-second grace plus termination wait.
+
+For multiple anchors, append TAL/TA pairs after `--` in the daemon service's
+command. For other validator options, edit that same list. A finite run can
+be invoked with `docker compose run --rm validator daemon ...` using the
+[daemon CLI](command-line-reference.md#daemon); use `--max-runs` before `--`.
+
+Compose variables are expanded into arguments; only the two documented log
+environment variables are read directly by the binary. For single-anchor/all5
+logs, pass them with `docker compose run -e PANDA_RPKI_LOG_LEVEL=debug ...`.