Skip to content

docs(docker): document the non-root PD, Store and Server images - #1

Draft
byteayan wants to merge 37 commits into
masterfrom
claude/docker-non-root-user
Draft

byteayan wants to merge 37 commits into
masterfrom
claude/docker-non-root-user

Conversation

@byteayan

Copy link
Copy Markdown
Owner

Fork copy for CI. The real PR is opened on apache/hugegraph-doc from this branch. This branch is based on current apache/hugegraph-doc master (69d32b0); this fork's master is behind upstream, so this view also lists upstream commits.

Purpose of the PR

apache/hugegraph#3381 makes the PD, Store and Server images run as the non-root user hugegraph (UID/GID 10001). This is the paired documentation PR. Changes apply to the latest (master) docs only.

Main Changes

English and Chinese: chown step in the PD and Store bind-mount examples, preload-script note for the Server, a Permission denied troubleshooting entry in the Docker cluster guide, and the Helm fsGroup upgrade step.

Verifying these changes

  • bash dist/validate-links.sh passes; git diff --check is clean. Not built locally with Hugo.

Generated by Claude Code

byteayan and others added 30 commits September 30, 2026 16:50
TODO: hubble needs update separately
* feat: upgrade OINK and improve documentation UX

- adopt native bilingual blog and documentation components
- integrate OINK 1.2 appearance and navigation contracts
- harden theme upgrade snapshots and component security checks
- verify browser interactions and desktop/mobile layouts

* fix: constrain native recording configuration

- match the pinned OINK shortcode configuration schema
- reject unsupported audio and driver resource options
- validate native poster and marker types with regressions

* fix: wait for chart rendering before capture

- wait for the native ECharts renderer to finish
- preserve chart animations and original performance data
- verify final column heights in both language captures

* fix: address OINK review findings

- isolate release themes and validate root module imports
- validate native component sinks and marker structures
- align master startup flow and improve mobile dark maps
- keep terminal recording optional and document authoring

* fix: align sidebar icons across sections

- show explicitly configured icons on leaf sections
- add bilingual about and component section icons
- verify icon slots and label alignment in both languages

* docs: clarify terminal recording dimensions

- use the current terminal size in the recording command
- explain resizing before recording
- distinguish player cropping from recording dimensions

* fix: replace the default blog cover

- use the supplied HugeGraph and Apache artwork
- remove the generated cover and update bilingual defaults
- align historical assets and image validation

* fix: equalize homepage action buttons

- use equal grid columns for homepage actions
- retain compact desktop sizing
- constrain mobile actions to the available width

* fix: keep configuration tables readable

- preserve technical table identifiers on desktop
- add bilingual parameter layout and scrolling checks
- label the RocksDB configuration and show line numbers

* fix: preserve readonly checks and chart tooltips

- isolate Hugo graph lock writes from the checkout
- confine chart tooltips with bilingual touch checks
- disable animations in navigation evidence captures

* fix: validate native chart option variants

- cover effective option roots and active image resources
- validate actual tooltip HTML and CSS colour sources
- document unsupported colour callbacks and retain inert data

* fix: enable native global code line numbers

Enable global inline numbers with native lexer fallback.\nRemove ordinary code titles and normalize language fences.\nKeep the taxonomy rail above the footer and verify both locales.

* fix: harden upgrades and native component UX

- Verify the isolated production module graph.
- Check tooltip inputs and restrict Markmap resources.
- Keep FileTree notes and PD tables readable.
- Preserve white home button text in dark mode.

* fix: render the listener example as a fence

- Remove the top-level indentation in the Chinese guide.
- Preserve the valid English list example.
- Guard native line numbers and exclude fence markers.
Use native quiet output for the module graph.
Exercise warm and empty Hugo caches in CI.
Add real cold-cache and strict-output regressions.
- document nil and empty edge label properties
- distinguish HTTP status from Go request errors
- check HTTP and Gremlin status in the example
- clear required deployment check contexts
- retain existing pull request review protection
- keep site build and preview workflows running
Release validation uses Java 17 and one shared validator for CI and local runs. Package versions and RC paths are separate inputs. Publishing stays in nocode; this PR uses public candidates and verification keys, with no signing, uploading or Maven staging changes.
Add a comprehensive bilingual guide for the 1.8.0 Shared-Foundation Migration (consolidating duplicated Core and Struct components into unified shared modules), and update plugin development and contributor build instructions.
…apache#509)

Paired docs for apache/hugegraph#3258, which needs a website update before it merges. That PR makes hugegraph-server.sh always pass -XX:+HeapDumpOnOutOfMemoryError, -XX:HeapDumpPath and -XX:ErrorFile pointing at logs/, including when JAVA_OPTIONS is set, and sets STDOUT_MODE=true in the HStore hugegraph/server image.
Add bilingual Helm installation and operations pages for the chart's easy defaults. Installation, browser/API access and common internal-cluster settings come first; credentials, storage, upgrade and recovery details are kept on a separate operations page.

Paired chart changes: apache/hugegraph#3338. Merge the chart and website updates together.
The Helm quickstart currently starts with a source checkout. It now installs a published Chart from GHCR or Docker Hub, with matching English and Chinese instructions. Trials follow the latest version with --devel; a short tip explains how to pin a version for production or reproducible installs.
Update bilingual documentation for Loader concurrent import protection and LOADING mode ownership:

Document the new /mode/owners RESTful APIs and handle lifecycle.
Clarify Loader fallback boundaries and operational recovery steps.
- require Helm 3.10 for chart rendering
- preserve chart version and values for configuration changes
- keep private image registry prefixes free of duplicate paths
PD exports hg_store_state{store,state} and hg_store_leader_count{store}
on /actuator/prometheus from apache/hugegraph#3357. List them on the PD
quickstart page, EN and CN, next to the other hg_* meters.
Co-authored-by: Rabari Mihir <169349389+Mihir-Rabari@users.noreply.github.com>
Previous guidance did not distinguish HTTP activation permissions from access to the live Arthas agent. This PR updates English and Chinese documentation together with apache/hugegraph#2945.
Source prevalidation installs a local Server SDK, so it cannot demonstrate that a newly uploaded Maven candidate is consumable. Add an opt-in use_staging_sdk flag that uses one explicit Apache HugeGraph staging repository for initial packaging and subsequent isolated rebuilds.

Server uses package instead of install in this mode. Existing SDK origin and per-module hash checkers validate the first Toolchain package as well as rebuilt packages. The default same-source flow and signed RC verification remain unchanged. No new script or dependency.
Upgrade the site from OINK 1.2.0 to 1.3.1 and replace the local readability patches with upstream behavior. FileTree uses wrap=true; technical configuration tables use .td-table--wide; Markmap colours and footer clearance come from the theme. HugeGraph branding, the Slate default and the Paper/Slate reader menu are preserved.
imbajin and others added 4 commits October 18, 2026 21:15
The Hubble quick start now covers Text2GQL in the existing English and Chinese guides: natural-language queries, built-in and temporary models, editable Prompts, and query history. The standalone and distributed guides follow the current 1.8.0 master baseline.

Use native OINK Steps for import and deployment, group related cluster screenshots in a Gallery, and fold secondary settings into Details. Remove repeated screenshots and keep node identifiers readable on mobile. Contributor guidance explains when Gallery and Expo are appropriate and which image-loading optimizations each provides.

The README also replaces the broken DeepWiki image and shows the OINK version from go.mod.
…ache#538)

apache/hugegraph#3368 gives the Ping that opens a raft connection its
own option, raft.rpc-connect-timeout (default 1000 ms), and the
install-snapshot RPC another, raft.rpc-install-snapshot-timeout
(default 0, which uses raft.rpc-timeout). raft.rpc-timeout also becomes
the deadline of the ReadIndex wait before id allocation. Update the
Raft table of the PD quickstart, EN and CN, and note that 1.7.0 has
neither new option.

Co-authored-by: imbajin <jin@apache.org>
Archived documentation currently sends Ask AI questions to the latest language group. This change selects the exact version and language group for latest, 1.7, and 1.5. A future version such as 1.8 needs only another configuration entry.

With AI enabled, latest must have complete EN/CN groups or the build fails. Historical versions without an index keep their Ask AI entry and show a local availability message without querying another version. Version labels follow the page being viewed. Consent and disabled-AI behavior remain covered by regressions.
Images built from current master run as UID/GID 10001. Add a chown step to
the PD and Store bind-mount examples, a troubleshooting entry for volumes
written by older root images, and the Helm fsGroup upgrade step, in English
and Chinese.

Pairs with apache/hugegraph#3381.
@github-actions

Copy link
Copy Markdown

@codecov-ai-reviewer review

apache/hugegraph#3381 applies the PD and Store fsGroup in the chart
templates, so an upgrade with --reuse-values no longer needs explicit
--set flags. Drop them from the English and Chinese upgrade notes.
Mirror apache/hugegraph#3381: switch PD and Store to the 10001 images in
the same rollout that first applies fsGroup, and use a one-time
fsGroupChangePolicy=Always rollout when root images already ran with it.
Mirror apache/hugegraph#3381: set the 10001 image tags in the one-time
fsGroupChangePolicy=Always upgrade, and show the follow-up upgrade that
sets the policy back to OnRootMismatch.
@byteayan
byteayan force-pushed the claude/docker-non-root-user branch from 68ce476 to f777f3a Compare October 21, 2026 07:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Feature] Run the PD, Store and Server images as a non-root user

5 participants