git.busybox.net is gone — every path under it 404s, including /busybox/ — so
the earlier sweep replaced the dead repo link with https://busybox.net/. That
is byte-identical to the 官网 bullet directly above it, leaving two bullets
with different labels and the same URL, and a 官方仓库 label describing a page
that is not a repository.
Points it at the official source-download index instead and relabels it
源码下载. Verified 200.
The guard added earlier could never trigger. tools/render_mermaid.py has no
nonzero exit path — its own docstring said "Exits 0 even if some/all fail
(non-fatal)" — so `if ! render_mermaid.py ...; then exit 1; fi` never ran its
body, and a build that rendered zero diagrams still passed. Reproduced by
running the script with no Chrome on PATH: it printed the fallback warning and
exited 0.
Adds a --strict flag that exits 1 when Chrome is missing or any diagram fails
to render, and passes it from every workflow invocation. The default stays
lenient so local mobile-reader builds keep working, which is what the exit-0
behaviour was actually for.
Verified both directions: with no Chrome, --strict exits 1 and the default
exits 0; against the real book with Chrome, --strict renders every diagram and
exits 0.
Follows the devDependency removal. The build has been mdPress-only since
1.7.0 and nothing referenced these:
- .vuepress/ (config.js + .gitignore). The mirror it configured is still
live, but no workflow in this repo builds or deploys it, so this was a
recipe nobody ran. Local .vuepress/dist/ (400 files of Feb-2026 build
output, never tracked) was removed from the working tree too — with its
.gitignore gone it would otherwise have shown up as untracked noise.
- docker-compose.yml: the vuepress-offline service, plus the now-unused
&mdpress-offline anchor that existed only to feed it.
- README: the 'docker run ... :vuepress' one-liner. That tag was last
pushed 2022-06-25, so readers following it got a four-year-old snapshot
of the book. 'mdpress serve' immediately above it still works.
- CODEOWNERS, .zhlintignore and check_project_rules.py entries for the
deleted directory, and the check-link allowlist entry for the mirror
(no content links to it).
The CHANGELOG entry recording the original CI removal is left alone — it
is history.
Verified: npm test passes (3 + 35), check_project_rules passes 202 files,
docker-compose.yml still parses with no dangling YAML aliases.
The build moved to mdPress in 1.7.0 ('移除遗留的 vuepress 构建，统一使用
mdpress'), but the VuePress devDependencies stayed. Nothing references them:
build/serve/start/pdf all call mdpress, and the only occurrence of vuepress
in code is '.vuepress' inside check_project_rules.py's ignore list. Pages
still ran 'npm ci', so every deploy installed the whole VuePress tree as
dead weight.
They were also the entire source of the repo's 91 Dependabot alerts. The
lockfile carried two copies of several packages; the vulnerable ones were
all VuePress's (dompurify 2.4.3, highlight.js 9.18.5, katex 0.15.6,
mermaid 9.4.3) while mermaid-cli's copies are above every patched
threshold. Removing the three devDependencies drops 16 of the 20 flagged
packages from the tree entirely and leaves the other four at safe versions.
.vuepress/config.js is deliberately kept — the mirror site it configures is
still live, and whether to archive it is a separate decision.
Verified: npm test passes (3 + 35 tests) and check_project_rules passes
202 files.
- 12.3: daemon.json has no top-level cgroup-driver key; use exec-opts
native.cgroupdriver (values cgroupfs/systemd) per official dockerd reference
- 12.2: USER namespace is not enabled by default; requires userns-remap
(aligns with 18.1)
- 14.1: cgroup v1 deprecation and kubelet default-fail happen in v1.35, not
v1.36 (per kubernetes.io cgroups doc)
- 15_etcd: maintenance window updated after etcd v3.7.0 release (2026-07-08)
to 3.6/3.7
- 3.9.6: fix dangling sentence order in registry migration note
- tools: add 'from __future__ import annotations' so PEP 604 annotations run
on Python 3.9 (fixes npm test)
Renders Mermaid to SVG via the workflow's Chrome, pandoc --mathml, assembles a
single self-contained responsive HTML reader, and attaches <repo>-<tag>.html to
the GitHub Release next to the PDF. Non-blocking (continue-on-error).
The app and django compose demos used ADD for plain local files, but the
book's in-text versions of the same examples (11.3_usage.md, 11.6_django.md)
and its own guidance (7.2/7.3, appendix best_practices) all use COPY. Align
the demos with the documented practice.
Follow-ups to the 9 secret-hardening commits (each verified against
docs.docker.com / vendor docs; one outright new bug found and fixed):
- 11.6: eb5e4397 changed settings.py to a hard os.environ lookup but the
web service never receives POSTGRES_PASSWORD (only db does; DATABASE_URL
is set but never read) -> step-6 'docker compose up' crashed with
KeyError. Pass the var to web; harden the leftover literal password in
the 配置详解 snippet that contradicted the new guidance two lines down;
blank line after the inserted sentence (bold heading merged into the
paragraph); dev/prod table no longer claims dev uses 明文 passwords
- 11.8: FAQ still told readers to check passwords in .env after the same
file banned passwords in .env -> point at secrets/db_password.txt;
backup sidecar env vars updated to tiredofit/db-backup 4.x interface
(DB01_* + DB01_PASS_FILE + DB01_BACKUP_INTERVAL - the unprefixed DB_*
names are ignored by current :latest; verified against upstream README)
- demo/wordpress: compose now references secrets files that ship nowhere
-> add README with the creation commands from 11.8; demo/django: align
with the hardened 11.6 (env-injected password, passed to web too)
- 04_image multistage demos: go build without go.mod fails on module-mode
Go (reproduced by reviewer on go1.26) -> add 'go mod init helloworld'
matching the 7.17 doc pattern in all three Dockerfiles
- 21.7: init script reworked init-db.sql -> init-db.sh per the official
image's env-reading .sh hook - removes the baked 'secure_password' AND
the CREATE DATABASE myappdb collision with POSTGRES_DB that aborted
first-boot init (ON_ERROR_STOP); compose passes APP_DB_PASSWORD;
microservices init.sql mount annotated schema-only (POSTGRES_USER:
appuser would collide with CREATE USER); Dockerfile-redis healthcheck
now authenticates via REDISCLI_AUTH read from redis.conf (plain
redis-cli ping gets NOAUTH against requirepass - same class as the
compose sibling eb5e4397 already fixed); dev-container dev/dev creds
annotated local-only
- 19.3: Grafana admin password 'admin' sat directly under the newly added
security warning -> env-injected like the rest of the stack
This 7-line file was never in SUMMARY.md and its content is a strict
subset of the current 17.1_coreos_intro.md. It looks like a draft
that survived the chapter rename to NN.M_topic.md convention.
Removed so the directory only contains files reachable from the ToC.
yeasy
github-actions[bot]andGitHub
dependabot[bot]andGitHub
