Refresh metadata and workflows

.github/workflows/auto-release.yml

@@ -24,13 +24,16 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y fonts-noto-cjk fonts-noto-cjk-extra
 
-      - name: Install mdpress (latest)
+      - name: Install mdpress 0.7.10
+        env:
+          MDPRESS_VERSION: "0.7.10"
+          MDPRESS_SHA256: "17e53e455996940bbbce64c69c43b3fb543f1501e03b74cf0434074efebd2db4"
         run: |
-          LATEST_TAG=$(curl -fsSL -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ github.token }}" https://api.github.com/repos/yeasy/mdpress/releases/latest | jq -r .tag_name)
+          archive="/tmp/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz"
-          VERSION="${LATEST_TAG#v}"
+          echo "Installing mdpress ${MDPRESS_VERSION}"
-          echo "Installing mdpress $VERSION"
+          curl -fsSL "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" -o "$archive"
-          curl -fsSL "https://github.com/yeasy/mdPress/releases/download/$LATEST_TAG/mdpress_${VERSION}_linux_amd64.tar.gz" -o /tmp/mdpress.tar.gz
+          echo "${MDPRESS_SHA256}  $archive" | sha256sum -c -
-          tar xzf /tmp/mdpress.tar.gz -C /tmp mdpress
+          tar xzf "$archive" -C /tmp mdpress
           sudo mv /tmp/mdpress /usr/local/bin/
           mdpress --version
 

.github/workflows/ci.yaml

@@ -24,17 +24,20 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y fonts-noto-cjk fonts-noto-cjk-extra
-      - name: Install mdpress (latest)
+      - name: Install mdpress 0.7.10
+        env:
+          MDPRESS_VERSION: "0.7.10"
+          MDPRESS_SHA256: "17e53e455996940bbbce64c69c43b3fb543f1501e03b74cf0434074efebd2db4"
         run: |
-          LATEST_TAG=$(curl -fsSL -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ github.token }}" https://api.github.com/repos/yeasy/mdpress/releases/latest | jq -r .tag_name)
+          archive="/tmp/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz"
-          VERSION="${LATEST_TAG#v}"
+          echo "Installing mdpress ${MDPRESS_VERSION}"
-          echo "Installing mdpress $VERSION"
+          curl -fsSL "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" -o "$archive"
-          curl -fsSL "https://github.com/yeasy/mdPress/releases/download/$LATEST_TAG/mdpress_${VERSION}_linux_amd64.tar.gz" -o mdpress.tar.gz
+          echo "${MDPRESS_SHA256}  $archive" | sha256sum -c -
-          tar xzf mdpress.tar.gz
+          tar xzf "$archive"
           sudo mv mdpress /usr/local/bin/
           mdpress --version
       - name: Build site
-        run: mdpress build --format site
+        run: npm run build
       - name: Build PDF
         run: mdpress build --format pdf --output docker_practice.pdf
       - name: Upload PDF as artifact

.github/workflows/dependabot-automerge.yml

@@ -4,6 +4,7 @@ on: pull_request
 permissions:
   contents: write
   pull-requests: write
+  checks: read
 
 jobs:
   dependabot:
@@ -12,15 +13,36 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v3
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
-      - name: Approve a PR
+
+      - name: Confirm required checks are configured
+        if: >
+          steps.metadata.outputs.package-ecosystem == 'github_actions' &&
+          contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type)
+        run: |
+          REQUIRED=$(gh api "repos/${GITHUB_REPOSITORY}/branches/${{ github.event.pull_request.base.ref }}/protection/required_status_checks" --jq '((.contexts // []) | length) + ((.checks // []) | length)' 2>/dev/null || echo 0)
+          if [ "$REQUIRED" -eq 0 ]; then
+            echo "No required status checks configured on the base branch; refusing Dependabot auto-merge."
+            exit 1
+          fi
+        env:
+          GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
+
+      - name: Approve low-risk Dependabot PR
+        if: >
+          steps.metadata.outputs.package-ecosystem == 'github_actions' &&
+          contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type)
         run: gh pr review --approve "$PR_URL"
         env:
           PR_URL: ${{github.event.pull_request.html_url}}
           GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
-      - name: Enable auto-merge for Dependabot PRs
+
+      - name: Enable auto-merge for low-risk Dependabot PRs
+        if: >
+          steps.metadata.outputs.package-ecosystem == 'github_actions' &&
+          contains(fromJSON('["version-update:semver-patch","version-update:semver-minor"]'), steps.metadata.outputs.update-type)
         run: gh pr merge --auto --merge "$PR_URL"
         env:
           PR_URL: ${{github.event.pull_request.html_url}}

.github/workflows/preview-pdf.yml

@@ -31,13 +31,16 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y fonts-noto-cjk fonts-noto-cjk-extra
 
-      - name: Install mdpress (latest)
+      - name: Install mdpress 0.7.10
+        env:
+          MDPRESS_VERSION: "0.7.10"
+          MDPRESS_SHA256: "17e53e455996940bbbce64c69c43b3fb543f1501e03b74cf0434074efebd2db4"
         run: |
-          LATEST_TAG=$(curl -fsSL -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ github.token }}" https://api.github.com/repos/yeasy/mdpress/releases/latest | jq -r .tag_name)
+          archive="/tmp/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz"
-          VERSION="${LATEST_TAG#v}"
+          echo "Installing mdpress ${MDPRESS_VERSION}"
-          echo "Installing mdpress $VERSION"
+          curl -fsSL "https://github.com/yeasy/mdPress/releases/download/v${MDPRESS_VERSION}/mdpress_${MDPRESS_VERSION}_linux_amd64.tar.gz" -o "$archive"
-          curl -fsSL "https://github.com/yeasy/mdPress/releases/download/$LATEST_TAG/mdpress_${VERSION}_linux_amd64.tar.gz" -o /tmp/mdpress.tar.gz
+          echo "${MDPRESS_SHA256}  $archive" | sha256sum -c -
-          tar xzf /tmp/mdpress.tar.gz -C /tmp mdpress
+          tar xzf "$archive" -C /tmp mdpress
           sudo mv /tmp/mdpress /usr/local/bin/
           mdpress --version
 

14_kubernetes_setup/14.1_kubeadm.md

@@ -140,7 +140,7 @@ $ sysctl --system
 
 #### 修改 `kubelet.service`（可选：IPVS 模式）
 
-> **注意**：kube-proxy 的 IPVS 模式已在 Kubernetes 1.35 中被标记为弃用，并在 **Kubernetes 1.36 中正式移除**。新部署应使用默认的 iptables 模式或 nftables 模式（Kubernetes 1.31+ 可用）。以下 IPVS 配置仅供 1.35 及更早版本的旧环境参考。
+> **注意**：kube-proxy 的 IPVS 模式已在 Kubernetes 1.35 中被标记为弃用；Kubernetes 1.36 文档仍将其列为已弃用模式，并推荐迁移到 nftables。新部署应使用默认的 iptables 模式或 nftables 模式（Kubernetes 1.33+ 稳定）。以下 IPVS 配置仅供旧环境参考。
 
 `/etc/systemd/system/kubelet.service.d/10-proxy-ipvs.conf` 写入以下内容
 

14_kubernetes_setup/14.2_kubeadm-docker.md

@@ -171,7 +171,7 @@ $ sysctl --system
 
 #### 修改 `kubelet.service`（可选：IPVS 模式）
 
-> **注意**：kube-proxy 的 IPVS 模式已在 Kubernetes 1.35 中被标记为弃用，并在 **Kubernetes 1.36 中正式移除**。新部署应使用默认的 iptables 模式或 nftables 模式（Kubernetes 1.31+ 可用）。以下 IPVS 配置仅供 1.35 及更早版本的旧环境参考。
+> **注意**：kube-proxy 的 IPVS 模式已在 Kubernetes 1.35 中被标记为弃用；Kubernetes 1.36 文档仍将其列为已弃用模式，并推荐迁移到 nftables。新部署应使用默认的 iptables 模式或 nftables 模式（Kubernetes 1.33+ 稳定）。以下 IPVS 配置仅供旧环境参考。
 
 `/etc/systemd/system/kubelet.service.d/10-proxy-ipvs.conf` 写入以下内容
 

18_security/18.6_image_security.md

@@ -77,7 +77,7 @@ Snyk 提供了商业级的安全扫描服务，特别适合企业环境。
 
 **特点：**
 
-- 支持开源漏洞和许可证扫描
+- 支持开源漏洞、许可证扫描和修复建议
 - 与多个 Git 平台深度集成（GitHub、GitLab、Bitbucket）
 - 提供修复建议和自动化修复 PR
 - 支持 Kubernetes 部署后安全监控
@@ -114,7 +114,7 @@ $ docker scout quickview myapp:latest
 | Docker 集成 | ✓（原生） | 需安装 | 需安装 | 需安装 |
 | 零依赖 | ✗ | ✓ | ✗ | ✗ |
 | 离线模式 | ✗ | ✓ | ✓ | ✗ |
-| 许可证扫描 | ✓ | ✗ | ✓ | ✓ |
+| 许可证扫描 | ✓ | ✓ | ✓ | ✓ |
 | 自动修复建议 | ✓ | ✗ | ✗ | ✓ |
 | 开源免费 | 部分 | ✓ | ✓ | 部分 |
 | IDE 集成 | ✓ | ✓ | ✓ | ✓ |

CHANGELOG.md

@@ -1,5 +1,31 @@
 # 修订记录
 
+* 1.9.2 2026-05-16
+  * 刷新 Docker 生态说明，更新 Fedora CoreOS、Podman、containerd 等章节中的维护状态
+  * 修复镜像事实、演示 TLS 密钥等后续审阅发现的问题
+
+* 1.9.1 2026-05-08
+  * 使用 `browser-actions/setup-chrome` 替代 Ubuntu runner 上不稳定的 Chromium snap 安装
+  * 修正 Docker Engine 29 日期、TLS 协议、healthcheck 与交互式调试示例
+
+* 1.9.0 2026-05-02
+  * 更新 Docker Engine 29、nginx、MySQL 8.4 LTS、Node.js 22 LTS 与 Kubernetes 相关版本说明
+  * 补充 ipvlan、nftables、Gateway API、Docker Scout、镜像安全与供应链安全内容
+  * 修复 Docker Hub 限流、etcdctl API、Compose healthcheck、Docker Debug 等时效性内容
+
+* 1.8.0 2026-04-27
+  * 补全 Dockerfile 指令参考与多处章节编号、标题层级、代码块和表格格式
+  * 增加预览 PDF 自动发布流程，修复 mdpress 端口和导出相关配置
+
+* 1.7.5 2026-04-05
+  * 将失效的 AtomHub 镜像替换为可用镜像源
+
+* 1.7.4 2026-03-31
+  * 修复标题层级格式
+
+* 1.7.3 2026-03-29
+  * 修复 Wikipedia URL 编码
+
 * 1.7.2 2026-03-28
   * 修正 macOS、Windows、Compose 与 Kubernetes 章节中的时效性内容和错误前提
   * 收缩越界网络内容，补充 bind mount、tmpfs 与端口映射的关键限制说明

SUMMARY.md

@@ -1,6 +1,6 @@
 ## 目录
 
-* [前言](README.md)
+* [Docker 从入门到实践](README.md)
 * [修订记录](CHANGELOG.md)
 * [如何贡献](CONTRIBUTING.md)
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "docker_practice",
-  "version": "1.7.2",
+  "version": "1.9.2",
   "description": "docker_practice",
   "main": "index.js",
   "devDependencies": {
@@ -9,7 +9,7 @@
     "vuepress-theme-hope": "^1.0.0"
   },
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1",
+    "test": "node scripts/check_metadata.js",
     "mdpress:help": "mdpress --help",
     "build": "rm -rf _site _site_site && mdpress build --format site --output _site && rm -rf _site && mv _site_site _site",
     "serve": "mdpress serve",
@@ -23,7 +23,7 @@
     "url": "git+https://github.com/yeasy/docker_practice.git"
   },
   "author": "",
-  "license": "ISC",
+  "license": "CC-BY-NC-SA-4.0",
   "bugs": {
     "url": "https://github.com/yeasy/docker_practice/issues"
   },

scripts/check_metadata.js

@@ -0,0 +1,15 @@
+const fs = require('fs');
+
+const pkg = JSON.parse(fs.readFileSync('package.json', 'utf8'));
+const changelog = fs.readFileSync('CHANGELOG.md', 'utf8');
+const readme = fs.readFileSync('README.md', 'utf8');
+
+const topVersion = changelog.match(/^\* ([0-9]+\.[0-9]+\.[0-9]+)\b/m)?.[1];
+
+if (pkg.version !== topVersion) {
+  throw new Error(`package.json version ${pkg.version} does not match CHANGELOG ${topVersion}`);
+}
+
+if (pkg.license !== 'CC-BY-NC-SA-4.0' || !readme.includes('CC BY-NC-SA 4.0')) {
+  throw new Error('package.json license must match README license');
+}