https://farrow.pgsty.com/zh/ Recent content on Farrow Hugo zh-CN Tue, 25 Aug 2026 00:00:00 +0800 https://farrow.pgsty.com/zh/blog/release/rc6-owner-scoped-20260825/ Tue, 25 Aug 2026 00:00:00 +0800 https://farrow.pgsty.com/zh/blog/release/rc6-owner-scoped-20260825/ <div class="td-callout td-callout--caution" role="note"> <div class="td-callout__title"><i class="td-callout__icon fa-solid fa-circle-xmark" aria-hidden="true"></i><span class="td-callout__label">注意</span></div> <div class="td-callout__body"> <p>Farrow 之前的历史记录。本页保留前任候选的准确身份，不证明当前 Farrow 二进制或路径。 当前边界见<a href="https://farrow.pgsty.com/zh/docs/about/status/">当前状态</a>。</p> </div> </div><p>Piglet <code>1.0.0-rc.6</code> 是单一 Native-QEMU 路径的 Owner-scope 本地开发候选。它在两条 Tier 1 宿主上关闭了要求的 Quick 与准确四节点 <code>full</code> 场景，并加入 Durable 特权网络事务。 它刻意不是公开 Release。</p> https://farrow.pgsty.com/zh/blog/release/development-snapshot-20260824/ Mon, 24 Aug 2026 00:00:00 +0800 https://farrow.pgsty.com/zh/blog/release/development-snapshot-20260824/ <div class="td-callout td-callout--caution" role="note"> <div class="td-callout__title"><i class="td-callout__icon fa-solid fa-circle-xmark" aria-hidden="true"></i><span class="td-callout__label">注意</span></div> <div class="td-callout__body"> <p>Farrow 之前的历史记录。本页名称、命令、路径、Hash 与结论只描述前任快照；当前行为以 <a href="https://farrow.pgsty.com/zh/docs/about/status/">Farrow 状态</a>和使用指南为准。</p> </div> </div><p>Piglet 的 2026-08-24 源码快照已经远不止最初的 QEMU Spike。它现在提供一套连贯本地 VM 产品： 零配置 Quick、固定地址私有实验室、13 份 Piglet 自有 Profile、可审计 Pigsty Inventory 边界、 显式持久化/状态迁移、诊断与可复现 Release Toolchain。</p> https://farrow.pgsty.com/zh/docs/start/installation/ Mon, 01 Jan 0001 00:00:00 +0000 https://farrow.pgsty.com/zh/docs/start/installation/ <h2 id="当前可用的安装方式">当前可用的安装方式 </h2> <p>从当前工作区构建：</p> <div class="td-code td-code--untitled" id="td-code-0178d652-fence-0" data-td-code data-td-code-auto-id data-td-language="bash" data-td-line-count="5"> <div class="td-code__viewport" id="td-code-0178d652-fence-0-viewport" data-td-code-viewport><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="nb">cd</span> /path/to/farrow </span></span><span class="line"><span class="cl">make build </span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">PATH</span><span class="o">=</span><span class="s2">&#34;</span><span class="nv">$PWD</span><span class="s2">/bin:</span><span class="nv">$PATH</span><span class="s2">&#34;</span> </span></span><span class="line"><span class="cl">farrow version </span></span><span class="line"><span class="cl">farrow doctor</span></span></code></pre></div></div> </div> <p>目前没有公开的 v1 软件包。不要用来源不明的二进制替换同一次构建产生的 <code>farrow</code> 与 <code>farrow-hosts-helper</code>。</p> https://farrow.pgsty.com/zh/docs/reference/configuration/ Mon, 01 Jan 0001 00:00:00 +0000 https://farrow.pgsty.com/zh/docs/reference/configuration/ <h2 id="发现顺序">发现顺序 </h2> <p>依次查找：显式 <code>-f</code>、当前目录的 <code>farrow.yml</code>、<code>farrow.yaml</code>、<code>pigsty.yml</code>、 <code>pigsty.yaml</code>。所有文件名都使用同一种 Pigsty 兼容 YAML Inventory。</p> https://farrow.pgsty.com/zh/docs/about/design/ Mon, 01 Jan 0001 00:00:00 +0000 https://farrow.pgsty.com/zh/docs/about/design/ <h2 id="一个有用的抽象">一个有用的抽象 </h2> <p>Farrow 把一份 Pigsty Inventory 启动成一套本地 QEMU deployment。它刻意不再拥有 project marker、项目注册表、租约模型、Provider Layer 或第二种配置格式。</p> https://farrow.pgsty.com/zh/docs/about/status/ Mon, 01 Jan 0001 00:00:00 +0000 https://farrow.pgsty.com/zh/docs/about/status/ <p>Farrow 仍是 pre-1.0。源码测试、带日期的真机重放、软件包、发布、CI 与线上站点是不同门禁。</p> <h2 id="最近一次有记录的真机重放2026-08-27">最近一次有记录的真机重放：2026-08-27 </h2> <p>该矩阵只属于当天真正执行过的准确 Checkpoint；后续源码或文档修改不会自动继承真机证明。</p> https://farrow.pgsty.com/zh/docs/start/tutorial/ Mon, 01 Jan 0001 00:00:00 +0000 https://farrow.pgsty.com/zh/docs/start/tutorial/ <h2 id="1-创建实验环境">1. 创建实验环境 </h2> <div class="td-code td-code--untitled" id="td-code-37e40210-fence-0" data-td-code data-td-code-auto-id data-td-language="bash" data-td-line-count="6"> <div class="td-code__viewport" id="td-code-37e40210-fence-0-viewport" data-td-code-viewport><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">mkdir -p ~/lab </span></span><span class="line"><span class="cl"><span class="nb">cd</span> ~/lab </span></span><span class="line"><span class="cl"><span class="nb">export</span> <span class="nv">FARROW_REPO</span><span class="o">=</span>https://m0/farrow <span class="c1"># 离开开发网络后替换为可达镜像</span> </span></span><span class="line"><span class="cl">farrow setup --dry-run </span></span><span class="line"><span class="cl">farrow setup --yes </span></span><span class="line"><span class="cl">farrow up</span></span></code></pre></div></div> </div> <p>目录中没有配置时，setup 会写入单节点 <code>farrow.yml</code>：</p> https://farrow.pgsty.com/zh/docs/reference/cli/ Mon, 01 Jan 0001 00:00:00 +0000 https://farrow.pgsty.com/zh/docs/reference/cli/ <div class="td-code td-code--untitled" id="td-code-6c390c92-fence-0" data-td-code data-td-code-auto-id data-td-language="text" data-td-line-count="1"> <div class="td-code__viewport" id="td-code-6c390c92-fence-0-viewport" data-td-code-viewport><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">farrow [--json|--yaml] [--verbose] &lt;command&gt; [flags] [node...]</span></span></code></pre></div></div> </div> <p>已安装的二进制是当前版本最准确的参考。每一条可见命令都自带操作边界与可复制样例：</p> <div class="td-code td-code--untitled" id="td-code-6c390c92-fence-1" data-td-code data-td-code-auto-id data-td-language="bash" data-td-line-count="3"> <div class="td-code__viewport" id="td-code-6c390c92-fence-1-viewport" data-td-code-viewport><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">farrow --help </span></span><span class="line"><span class="cl">farrow setup --help </span></span><span class="line"><span class="cl">farrow image pull --help</span></span></code></pre></div></div> </div> <p>文本模式下，直接运行 <code>farrow</code> 或 <code>farrow image</code> 这样的命名空间会展示上下文帮助并成功 退出；JSON/YAML 模式下，空命名空间返回结构化用法错误。显式 <code>--help</code> 始终输出供人阅读的 帮助文本。</p> https://farrow.pgsty.com/zh/docs/about/engineering/ Mon, 01 Jan 0001 00:00:00 +0000 https://farrow.pgsty.com/zh/docs/about/engineering/ <h2 id="仓库边界">仓库边界 </h2> <p>Farrow 源码仓库只保留代码、测试、构建/打包定义、法律声明与简短入口 README。本网站是 用户、设计、运维与发布文档的唯一权威位置。原始 Review 记录、历史 Scratch Inventory、 Demo 目录、生成二进制与 Release 输出树都不是源码输入，不应提交。</p> https://farrow.pgsty.com/zh/docs/reference/images/ Mon, 01 Jan 0001 00:00:00 +0000 https://farrow.pgsty.com/zh/docs/reference/images/ <p>Farrow 使用一份签名静态 Catalog 与不可变 qcow2 工件。更新 Catalog 不需要发布新的 Farrow 二进制，但二进制决定信任哪些签名公钥与镜像安全规则。</p> <div class="td-callout td-callout--warning" role="note"> <div class="td-callout__title"><i class="td-callout__icon fa-solid fa-triangle-exclamation" aria-hidden="true"></i><span class="td-callout__label">警告</span></div> <div class="td-callout__body"> <p>EL7 标记为 <code>deprecated</code>；其余内置镜像均为 <code>testing</code>，不是 <code>supported</code>。<code>up</code> 打印的警告是刻意保留的；拉取成功只证明完整性，不代表生产支持承诺。</p> https://farrow.pgsty.com/zh/docs/start/operations/ Mon, 01 Jan 0001 00:00:00 +0000 https://farrow.pgsty.com/zh/docs/start/operations/ <h2 id="检查与访问">检查与访问 </h2> <div class="td-code td-code--untitled" id="td-code-04ceab33-fence-0" data-td-code data-td-code-auto-id data-td-language="bash" data-td-line-count="5"> <div class="td-code__viewport" id="td-code-04ceab33-fence-0-viewport" data-td-code-viewport><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">farrow status </span></span><span class="line"><span class="cl">farrow ssh meta </span></span><span class="line"><span class="cl">farrow <span class="nb">exec</span> node-1 -- hostname </span></span><span class="line"><span class="cl">farrow logs meta --source serial </span></span><span class="line"><span class="cl">farrow ss <span class="c1"># 安装 SSH 别名，之后可直接 ssh meta</span></span></span></code></pre></div></div> </div> <p>应用状态位于 <code>~/.farrow</code>，这些命令可在任意目录执行。 Status 会显示持久化的 Guest 架构与加速器，因此 TCG 永远不是不可见回退。 <code>plan</code>、<code>up</code>、<code>reload</code>、<code>recreate</code> 依次优先使用 <code>-f</code>、当前目录发现的 Inventory， 两者都没有时才回退到已应用规格；<code>validate</code> 始终需要文件。</p> https://farrow.pgsty.com/zh/docs/start/troubleshooting/ Mon, 01 Jan 0001 00:00:00 +0000 https://farrow.pgsty.com/zh/docs/start/troubleshooting/ <p>先做只读检查：</p> <div class="td-code td-code--untitled" id="td-code-4c86eed7-fence-0" data-td-code data-td-code-auto-id data-td-language="bash" data-td-line-count="3"> <div class="td-code__viewport" id="td-code-4c86eed7-fence-0-viewport" data-td-code-viewport><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">farrow doctor --json </span></span><span class="line"><span class="cl">farrow network status --json </span></span><span class="line"><span class="cl">farrow status --json</span></span></code></pre></div></div> </div> <h2 id="找不到配置">找不到配置 </h2> <p>第一次部署时，在 <code>farrow.yml</code>/<code>pigsty.yml</code> 所在目录运行 <code>plan</code>、<code>up</code>、<code>validate</code>， 或传入 <code>-f /path/to/file</code>。状态存在后，<code>plan</code>、<code>up</code>、<code>reload</code>、<code>recreate</code> 可回退到 已应用规格；status、start、stop、SSH 与 destroy 始终使用已应用状态。如果 <code>status</code> 也打印同样消息，所选 <code>FARROW_HOME</code> 中没有已应用状态。</p> https://farrow.pgsty.com/zh/docs/reference/image-pipeline/ Mon, 01 Jan 0001 00:00:00 +0000 https://farrow.pgsty.com/zh/docs/reference/image-pipeline/ <p><code>packaging/image-pipeline/</code> 接受一份已下载的不可变 qcow2 与独立获得的 SHA-256。它绝不 下载、上传、修改 Farrow 运行时/网络状态、读取签名密钥，也不会把镜像标成 <code>supported</code>。</p> <h2 id="模式">模式 </h2> <ul> <li><code>validate</code>：复制并重哈希，强制 qcow2 检查，校验单元素 Backing Chain，运行 <code>qemu-img check</code>，输出明确不可发布的证据 Bundle；不会修改 Guest 凭据。</li> <li><code>offline</code>：额外在 Staged Copy 上使用 libguestfs <code>virt-customize --no-network</code> 与 <code>virt-cat</code>。它拒绝无关 UID/GID 88 占用，归一化锁定的 <code>dba</code>/<code>admin</code> 身份，关闭密码与 Root SSH，清理密钥/历史/Host Identity/cloud-init Cache，恢复定向 SELinux Label， 并回读确定性 Marker。</li> </ul> <div class="td-code td-code--untitled" id="td-code-6ad97bac-fence-0" data-td-code data-td-code-auto-id data-td-language="bash" data-td-line-count="14"> <div class="td-code__viewport" id="td-code-6ad97bac-fence-0-viewport" data-td-code-viewport><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl"><span class="nv">SOURCE_DATE_EPOCH</span><span class="o">=</span><span class="m">1787486400</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl">./packaging/image-pipeline/build.sh <span class="se">\ </span></span></span><span class="line"><span class="cl"> --mode validate <span class="se">\ </span></span></span><span class="line"><span class="cl"> --source /absolute/source.qcow2 <span class="se">\ </span></span></span><span class="line"><span class="cl"> --expected-sha256 &lt;digest&gt; <span class="se">\ </span></span></span><span class="line"><span class="cl"> --output /absolute/new/evidence-directory <span class="se">\ </span></span></span><span class="line"><span class="cl"> --name u24 --release 20260801.0.0 --arch amd64 <span class="se">\ </span></span></span><span class="line"><span class="cl"> --source-user ubuntu --boot uefi <span class="se">\ </span></span></span><span class="line"><span class="cl"> --source-uri https://immutable.example/source.qcow2 <span class="se">\ </span></span></span><span class="line"><span class="cl"> --artifact-url <span class="s1">&#39;https://images.example/u24/{sha256}.qcow2&#39;</span> <span class="se">\ </span></span></span><span class="line"><span class="cl"> --license NOASSERTION <span class="se">\ </span></span></span><span class="line"><span class="cl"> --source-date-epoch <span class="s2">&#34;</span><span class="nv">$SOURCE_DATE_EPOCH</span><span class="s2">&#34;</span> <span class="se">\ </span></span></span><span class="line"><span class="cl"> --manifest-version <span class="m">2026082801</span></span></span></code></pre></div></div> </div> <p>Source/Output 必须是绝对路径；Source 必须 Canonical、普通、非符号链接、复制期间稳定， 且不超过 16 GiB；Output 必须不存在。Builder 使用相邻排它锁、0700 Staging 与一次最终 Rename；失败只删除受保护的 Staging。</p>