From 7082ffb72310ecb56e5ff7242c95849db0a44466 Mon Sep 17 00:00:00 2001 From: JianFeeeee Date: Thu, 1 Oct 2026 20:59:34 +0800 Subject: [PATCH] =?UTF-8?q?fix(packaging):=20=E5=8E=BB=E6=8E=89=E9=87=8D?= =?UTF-8?q?=E5=A4=8D=E7=9A=84=E5=8A=A0=E5=9B=BA=E5=9D=97=EF=BC=8C=E5=B9=B6?= =?UTF-8?q?=E5=90=8C=E6=AD=A5=E7=BA=BF=E4=B8=8A=E5=8D=95=E5=85=83=E7=9A=84?= =?UTF-8?q?=E7=A1=AE=E5=88=87=E5=86=85=E5=AE=B9?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 上一版把线上单元拷进来后又追加了一份英文注释的加固指令，导致 NoNewPrivileges / ProtectSystem / SystemCallFilter 等在同一个 unit 里 出现两次。systemd 对重复指令取最后一个，行为上不会坏，但文件本身是错的 （读的人会以为有两套加固），且 packaged 与 deployed 不再一致。 现在 packaged/llmsproxy.service 与线上 /etc/systemd/system/llmsproxy.service 逐字节相同，每条指令只出现一次。 --- packaging/llmsproxy.service | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/packaging/llmsproxy.service b/packaging/llmsproxy.service index 26a689c..90b846d 100644 --- a/packaging/llmsproxy.service +++ b/packaging/llmsproxy.service @@ -4,16 +4,15 @@ After=network.target [Service] Type=simple -# Memory tuning (measured on this deployment, see README "内存占用"): +# Memory tuning (measured, see README "内存占用"): # MALLOC_ARENA_MAX=2 caps glibc per-thread malloc arenas. LuaJIT allocates # through cgo -> glibc malloc, and glibc defaults to 8*nproc arenas, so every # OS thread that touches malloc reserved its own ~1 MB arena that is never # returned. Measured: 8-12 arenas -> 0. # GOGC=50 halves the Go heap growth target. On its own it does NOT help (the # saved heap is immediately eaten by extra glibc arenas); combined with -# MALLOC_ARENA_MAX it cut settled RSS by ~19% (24.7 MB -> 19.9 MB on a test -# instance). This gateway is I/O bound (1min10s CPU per 9h), so the extra GC -# cycles are free. +# MALLOC_ARENA_MAX it cut settled RSS by ~19%. This gateway is I/O bound, so +# the extra GC cycles are free. Environment=GOGC=50 Environment=MALLOC_ARENA_MAX=2 ExecStart=/usr/local/bin/llmsproxy -config /etc/llmsproxy/config.yaml @@ -32,10 +31,10 @@ RestartSec=5 # 需求的变更，不该和加固混在一起。 # # 下面每一条都在一个独立探针单元（临时端口 + 独立 runtime_file/adapter_dir） -# 上真实验证过：鉴权 401/200 正常、发一次真实 /v1/chat/completions 走通 -# （证明 LuaJIT 适配器路径没被 seccomp 打断）、审计文件可写可轮转、连续重启 3 次 -# 与 kill -9 后行为符合预期。systemd 对非法指令值不报错只"忽略"，所以逐条实测 -# 是唯一可靠做法。 +# 上真实验证过：鉴权 401/200 正常、发一次真实 /v1/chat/completions 走通（证明 +# LuaJIT 适配器路径没被 seccomp 打断）、审计文件可写可轮转、连续重启 3 次与 +# kill -9 后行为符合预期。systemd 对非法指令值不报错只"忽略"，逐条实测是唯一 +# 可靠做法。 NoNewPrivileges=yes # 读路径全部落在 /etc/llmsproxy；写路径经核对只有 config.yaml / runtime.json / # audit.jsonl / adapters/*.lua / master.key，全在该目录下（internal/{config,gateway,