DataOps-platform/deploy/edge

Enterprise edge deployment contract

This directory is an engineering deployment contract, not an enterprise UAT record. Its highest state is ENGINEERING_COMPLETE_ENTERPRISE_EDGE_UAT_BLOCKED; enterprise source, network, and security/legal evidence remain TBD_EXTERNAL.

The container initiates pull-only HTTPS/mTLS traffic. It exposes no inbound control port. The network team must restrict egress to the exact control and approved proxy origins in edge.env; DNS wildcard, direct HTTP, arbitrary proxy, and arbitrary command execution are forbidden. Compose hardens the runtime with a non-root UID, read-only root filesystem, all capabilities dropped, no-new-privileges, bounded CPU/memory/PIDs/logs, and minimal mounts.

Private keys, control credentials, CA/CRL material, and Ed25519 task/release public-key sets are mounted from operator-owned directories. Run init with the approved numeric runtime UID/GID and set the same EDGE_RUNTIME_UID/GID in the environment; Compose reuses those values for the process and writable tmpfs. The client key is always secrets/client.key, with the complete secrets directory mounted read-only at /run/edge/secrets. These materials are not embedded in Compose or environment examples. Certificate and signing mounts are read-only. Queue, local artifacts, and verified releases are the only writable persistent mounts. 原始数据和近期明细 remain local; only the approved 数据分级 summaries leave the edge under 默认拒绝 policy.

Local render check

Set temporary absolute directories and a syntactically valid immutable image, then run docker compose --env-file <operator-env> -f docker-compose.edge.yml config. This validates interpolation only. It does not start a real enterprise source or prove firewall behavior.

Installation, CSR, 证书轮换, 证书撤销, v1-to-v2 migration, 断网/重连, 取消, 诊断, 备份/恢复, upgrade and 回滚 steps are in the edge operations runbook. In the release archive the same file is at dataops-platform/docs/runbooks/EDGE_GATEWAY_OPERATIONS.md. CRL distribution and firewall approval are enterprise responsibilities.

release-check copies a fully verified manifest and artifact into the fsync-backed releases/verified/<manifest_digest>/ bundle. rollback revalidates both current and target Ed25519 manifests and artifact hashes, then atomically commits releases/current.json; an intent/history record supports deterministic recovery if the process stops during the directory-fsync window.