mirror of
https://github.com/pgsty/minio.git
synced 2026-08-09 07:43:29 +03:00
Feng Ruohang
6613c2a3cb
The test and verification scripts invoked ./minio and pulled their tooling from upstream infrastructure with no integrity check. Every `curl | tar` of a client or an old server binary was an unverified execution path in a script that regularly runs as a privileged user, and several fetched a floating "latest". Two installers replace all of it: - install-mcli.sh resolves a pinned pgsty/mc release, downloads the archive and its checksum manifest, requires exactly one valid manifest entry for the asset, verifies it, and installs. MCLI_BIN with a mandatory MCLI_SHA256 lets an offline or air-gapped run supply its own binary, still checksum-checked. - install-verified-fixture.sh takes source, expected SHA-256 and target, and refuses anything that does not match. Sources may be a URL or a local file. Every script that previously downloaded mc now calls install-mcli.sh. The three places that genuinely need an upstream artifact - the old MinIO server binary for the LDAP IAM upgrade-import test, the 2021 mc for the three-site replication test, and the functional-tests.sh fixture - go through install-verified-fixture.sh with the digest recorded inline. Those dl.min.io URLs remain on purpose: they are historical upstream artifacts needed to prove upgrade compatibility, and they are now pinned and verified rather than trusted. The scripts otherwise switch to ./silo, silo.service, the silo container and compose service names, and SILO_CONFIG_DIR. run-multi-site-minio-idp.sh is renamed to run-multi-site-silo-idp.sh with the Makefile target following. buildscripts/minio-upgrade.sh keeps its name and its `minio server` argv - it exists to test the MinIO-to-Silo upgrade, so the old side must stay old - but it is now pinned to an image digest rather than a tag, and its `docker system prune` and `docker volume prune` calls are removed. Those ran unfiltered against the developer's whole Docker installation; the resiliency tests had the same problem and lose their prune and `docker ps -q` sweeps too. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
83 lines
1.9 KiB
Plaintext
83 lines
1.9 KiB
Plaintext
[main]
|
|
summary=Maximum server performance for Silo
|
|
|
|
[vm]
|
|
transparent_hugepage=madvise
|
|
|
|
[sysfs]
|
|
/sys/kernel/mm/transparent_hugepage/defrag=defer+madvise
|
|
/sys/kernel/mm/transparent_hugepage/khugepaged/max_ptes_none=0
|
|
|
|
[cpu]
|
|
force_latency=1
|
|
governor=performance
|
|
energy_perf_bias=performance
|
|
min_perf_pct=100
|
|
|
|
[sysctl]
|
|
fs.xfs.xfssyncd_centisecs=72000
|
|
net.core.busy_read=50
|
|
net.core.busy_poll=50
|
|
kernel.numa_balancing=1
|
|
|
|
# Do not use swap at all
|
|
vm.swappiness=0
|
|
vm.vfs_cache_pressure=50
|
|
|
|
# Start writeback at 3% memory
|
|
vm.dirty_background_ratio=3
|
|
# Force writeback at 10% memory
|
|
vm.dirty_ratio=10
|
|
|
|
# Quite a few memory map
|
|
# areas may be consumed
|
|
vm.max_map_count=524288
|
|
|
|
# Default is 500000 = 0.5ms
|
|
kernel.sched_migration_cost_ns=5000000
|
|
|
|
# stalled hdd io threads
|
|
kernel.hung_task_timeout_secs=85
|
|
|
|
# network tuning for bigger throughput
|
|
net.core.netdev_max_backlog=250000
|
|
net.core.somaxconn=16384
|
|
net.ipv4.tcp_syncookies=0
|
|
net.ipv4.tcp_max_syn_backlog=16384
|
|
net.core.wmem_max=4194304
|
|
net.core.rmem_max=4194304
|
|
net.core.rmem_default=4194304
|
|
net.core.wmem_default=4194304
|
|
net.ipv4.tcp_rmem="4096 87380 4194304"
|
|
net.ipv4.tcp_wmem="4096 65536 4194304"
|
|
|
|
# Reduce CPU utilization
|
|
net.ipv4.tcp_timestamps=0
|
|
|
|
# Increase throughput
|
|
net.ipv4.tcp_sack=1
|
|
|
|
# Low latency mode for TCP
|
|
net.ipv4.tcp_low_latency=1
|
|
|
|
# The following variable is used to tell the kernel how
|
|
# much of the socket buffer space should be used for TCP
|
|
# window size, and how much to save for an application buffer.
|
|
net.ipv4.tcp_adv_win_scale=1
|
|
|
|
# disable RFC2861 behavior
|
|
net.ipv4.tcp_slow_start_after_idle = 0
|
|
|
|
# Fix faulty network setups
|
|
net.ipv4.tcp_mtu_probing=1
|
|
net.ipv4.tcp_base_mss=1280
|
|
|
|
# Disable ipv6
|
|
net.ipv6.conf.all.disable_ipv6=1
|
|
net.ipv6.conf.default.disable_ipv6=1
|
|
net.ipv6.conf.lo.disable_ipv6=1
|
|
|
|
[bootloader]
|
|
# Avoid firing timers for all CPUs at the same time. This is irrelevant for
|
|
# full nohz systems
|
|
cmdline=skew_tick=1 |