🐤 Sync 2026-08-25 20:39:13

luci-app-shadowrt/root/usr/libexec/istorec/shadowrt.sh

@@ -8,6 +8,7 @@ do_install() {
 	local id="`uci get shadowrt.@instance[0].id 2>/dev/null`"
 	local data="`uci get shadowrt.@instance[0].data 2>/dev/null`"
 	local mnt="`uci get shadowrt.@instance[0].mnt 2>/dev/null`"
+	local dind="`uci get shadowrt.@instance[0].dind 2>/dev/null`"
 	local proto=`uci get shadowrt.@instance[0].proto 2>/dev/null`
 	local address=`uci get shadowrt.@instance[0].address 2>/dev/null`
 	local gateway=`uci get shadowrt.@instance[0].gateway 2>/dev/null`
@@ -47,7 +48,7 @@ do_install() {
 		echo "WARNING: $data/$id already exists, may use old data." >&2
 	fi
 
-	local config="{\"id\":\"$id\",\"data\":\"$data\",\"mnt\":\"$mnt\",\"proto\":\"$proto\",\"address\":\"$address\",\"gateway\":\"$gateway\",\"dns\":\"$dns\",\"dhcp_server\":\"$dhcp_server\",\"ports\":\"$ports\"}"
+	local config="{\"id\":\"$id\",\"data\":\"$data\",\"mnt\":\"$mnt\",\"dind\":\"$dind\",\"proto\":\"$proto\",\"address\":\"$address\",\"gateway\":\"$gateway\",\"dns\":\"$dns\",\"dhcp_server\":\"$dhcp_server\",\"ports\":\"$ports\"}"
 
 	local cmd="docker run --restart=unless-stopped -d \
 		--stop-signal SIGINT \
@@ -56,7 +57,6 @@ do_install() {
 		--security-opt apparmor=unconfined \
 		--cap-add=SYS_ADMIN \
 		--cap-add=SYS_CHROOT \
-		--cap-drop=MKNOD \
 		--cap-add=LEASE \
 		--cap-add=SETGID \
 		--cap-add=SETUID \
@@ -75,6 +75,12 @@ do_install() {
 		--label 'com.shadowrt.config=$config' \
 		-v '$data/$id/overlay:/overlay:rw' "
 
+	if [ "$dind" = "1" -o "$dind" = "on" ]; then
+		cmd="$cmd -e DIND=on"
+	else
+		cmd="$cmd --cap-drop=MKNOD"
+	fi
+
 	[ -n "$proto" ] && cmd="$cmd -e IP_PROTO=$proto"
 	if [ "$proto" = "static" ]; then
 		[ -n "$address" ] && cmd="$cmd -e IP_ADDRESS=$address"
@@ -143,6 +149,7 @@ do_clone() {
 		echo "$config_json" | jsonfilter -e 'id=$.id' \
 			-e 'data=$.data' \
 			-e 'mnt=$.mnt' \
+			-e 'dind=$.dind' \
 			-e 'proto=$.proto' \
 			-e 'address=$.address' \
 			-e 'gateway=$.gateway' \
@@ -182,11 +189,12 @@ do_reset_network() {
 				/bin/config_generate
 				/bin/sh -c ". /rom/etc/uci-defaults/zzz-dockerenv"
 				/bin/sh -c '. /rom/etc/uci-defaults/12_network-generate-ula'
+				/bin/sh -c '. /rom/etc/uci-defaults/14_network-generate-duid'
 				/etc/init.d/network restart
 				sleep 2
 			EOF
 		else
-			echo 'rm -f etc/uci-defaults/zzz-dockerenv etc/uci-defaults/12_network-generate-ula'
+			echo 'rm -f etc/uci-defaults/zzz-dockerenv etc/uci-defaults/12_network-generate-ula etc/uci-defaults/14_network-generate-duid'
 		fi
 	} | sh -c "$shell"
 }

luci-app-shadowrt/root/usr/share/shadowrt/container/s1-chroot-patchrom.sh

@@ -2,10 +2,15 @@
 
 mkdir -p /var/lock
 
-for service in adb-enablemodem appfilter dockerd gpio_switch hd-idle \
+ADD_SERVICES=
+
+[ "on" = "$DIND" ] || ADD_SERVICES="$ADD_SERVICES dockerd"
+
+for service in adb-enablemodem appfilter gpio_switch hd-idle \
 	kmods kmods-unload lcdsimple led lm-sensors luci-fan \
 	mdadm modemmanager odhcpd smartd sysfixtime sysfsutils sysntpd \
 	tuning_net umount usbmode usbmuxd wan_drop zprintk zram \
+	$ADD_SERVICES \
 	log
 do
 	[ -x /etc/init.d/$service ] && /etc/init.d/$service disable

luci-app-shadowrt/root/usr/share/shadowrt/container/s1-unshared.sh

@@ -15,6 +15,8 @@ mount --make-private /overlay
 mount -t tmpfs -o ro,relatime tmpfs /sys/block
 mount -t tmpfs -o size=1M tmpfs /tmp
 
+[ "on" = "$DIND" ] && mount -o rw,remount /sys/fs/cgroup
+
 # make all private except /mnt
 mkdir -p $PATCHROM
 mount --bind / $PATCHROM
@@ -66,6 +68,9 @@ umount $PATCHROM/tmp/shadowrt
 umount $PATCHROM/tmp
 rm -rf /tmp/tmp
 
+export -n DIND
+unset DIND
+
 set_default_ip()
 {
 	local ip=$1