Bot 的電腦 can run under gVisor: its own kernel, Chromium's sandbox back on
容器隔離 in 設定 › 電腦: standard (runc, the container is the only wall, Chromium runs
--no-sandbox) or hardened (runsc: a virtualized kernel, all capabilities dropped but the few
the desktop needs, ANYBOT_BOX_SANDBOX=1 turns Chromium's own sandbox back on). Box image v7.
deploy/mac/gvisor-vm.sh makes a Lima VM with Docker + gVisor for a Mac (started at login),
gvisor-migrate.sh moves the box's files and logins there.
Checked and finished before committing:
- the hardened choice is offered only on a Docker host that has runsc; a box set to it on a
host without it opens the standard way and says so (it used to not start at all)
- the settings row shows what the box really runs on, and when 更新 is needed
- no swap only under gVisor (a standard box keeps Docker's default)
- the migrate script sees the running Mac app ("AnyBot", not "anybot")
- the VM script starts an existing VM by name, checks runsc and the kernel from the Mac
- the version test says 7
Real run in the Lima VM: desktop, VNC, numbered controls, xdotool and screenshots work; no
Chromium process has --no-sandbox, renderers run with seccomp and their own namespaces.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uirha2RVfSYmrhqNnqx9Z4
2026-11-06 16:03:25 +00:00
|
|
|
|
#!/usr/bin/env bash
|
|
|
|
|
|
# 把 Bot 的電腦整個搬到 gVisor VM:box 的全部檔案與瀏覽器登入都在 home 資料卷
|
|
|
|
|
|
# (anybot-box-home,Chromium 的 profile 也在裡面),整卷複製過去後,
|
|
|
|
|
|
# AnyBot 在 VM 上掛同名資料卷開機=檔案、登入、桌面設定全部跟著走。
|
|
|
|
|
|
# 所有 Bot 共用這一台、這一份登入與檔案:不分帳號,資料夾照常共用。
|
|
|
|
|
|
#
|
|
|
|
|
|
# 先完全退出 AnyBot 應用程式,然後:
|
|
|
|
|
|
# ./gvisor-migrate.sh 搬過去(本機這份保留,當備份)
|
|
|
|
|
|
# ./gvisor-migrate.sh --check 只比對兩邊,不動資料
|
|
|
|
|
|
set -euo pipefail
|
|
|
|
|
|
VM=anybot-gvisor
|
|
|
|
|
|
VOL=anybot-box-home
|
|
|
|
|
|
VMHOST="unix://$HOME/.lima/$VM/sock/docker.sock"
|
|
|
|
|
|
|
|
|
|
|
|
command -v docker >/dev/null 2>&1 || { echo "找不到 docker 指令"; exit 1; }
|
|
|
|
|
|
if [ -n "${DOCKER_HOST:-}" ]; then
|
2026-11-06 16:19:56 +00:00
|
|
|
|
echo "現在環境裡有 DOCKER_HOST=${DOCKER_HOST}(要從本機 Docker 搬出,請用普通終端機跑)"; exit 1
|
Bot 的電腦 can run under gVisor: its own kernel, Chromium's sandbox back on
容器隔離 in 設定 › 電腦: standard (runc, the container is the only wall, Chromium runs
--no-sandbox) or hardened (runsc: a virtualized kernel, all capabilities dropped but the few
the desktop needs, ANYBOT_BOX_SANDBOX=1 turns Chromium's own sandbox back on). Box image v7.
deploy/mac/gvisor-vm.sh makes a Lima VM with Docker + gVisor for a Mac (started at login),
gvisor-migrate.sh moves the box's files and logins there.
Checked and finished before committing:
- the hardened choice is offered only on a Docker host that has runsc; a box set to it on a
host without it opens the standard way and says so (it used to not start at all)
- the settings row shows what the box really runs on, and when 更新 is needed
- no swap only under gVisor (a standard box keeps Docker's default)
- the migrate script sees the running Mac app ("AnyBot", not "anybot")
- the VM script starts an existing VM by name, checks runsc and the kernel from the Mac
- the version test says 7
Real run in the Lima VM: desktop, VNC, numbered controls, xdotool and screenshots work; no
Chromium process has --no-sandbox, renderers run with seccomp and their own namespaces.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uirha2RVfSYmrhqNnqx9Z4
2026-11-06 16:03:25 +00:00
|
|
|
|
fi
|
2026-11-06 16:19:56 +00:00
|
|
|
|
docker volume inspect "$VOL" >/dev/null 2>&1 || { echo "本機找不到資料卷 ${VOL}(box 還沒建立過?)"; exit 1; }
|
Bot 的電腦 can run under gVisor: its own kernel, Chromium's sandbox back on
容器隔離 in 設定 › 電腦: standard (runc, the container is the only wall, Chromium runs
--no-sandbox) or hardened (runsc: a virtualized kernel, all capabilities dropped but the few
the desktop needs, ANYBOT_BOX_SANDBOX=1 turns Chromium's own sandbox back on). Box image v7.
deploy/mac/gvisor-vm.sh makes a Lima VM with Docker + gVisor for a Mac (started at login),
gvisor-migrate.sh moves the box's files and logins there.
Checked and finished before committing:
- the hardened choice is offered only on a Docker host that has runsc; a box set to it on a
host without it opens the standard way and says so (it used to not start at all)
- the settings row shows what the box really runs on, and when 更新 is needed
- no swap only under gVisor (a standard box keeps Docker's default)
- the migrate script sees the running Mac app ("AnyBot", not "anybot")
- the VM script starts an existing VM by name, checks runsc and the kernel from the Mac
- the version test says 7
Real run in the Lima VM: desktop, VNC, numbered controls, xdotool and screenshots work; no
Chromium process has --no-sandbox, renderers run with seccomp and their own namespaces.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Uirha2RVfSYmrhqNnqx9Z4
2026-11-06 16:03:25 +00:00
|
|
|
|
limactl list "$VM" --format '{{.Status}}' 2>/dev/null | grep -q Running || { echo "VM $VM 沒在跑,先跑 gvisor-vm.sh"; exit 1; }
|
|
|
|
|
|
# The Mac app's process is "AnyBot" and `anybot --serve` is "anybot": match either case.
|
|
|
|
|
|
if pgrep -ix anybot >/dev/null 2>&1; then
|
|
|
|
|
|
echo "AnyBot 還在跑:請先從選單完全退出(它會把 box 叫醒、資料卷會一直在用)。"; exit 1
|
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
|
|
echo "本機 box 的檔案:$(docker run --rm -v "$VOL":/h alpine:3.20 sh -c 'find /h | wc -l') 個項目、$(docker run --rm -v "$VOL":/h alpine:3.20 sh -c 'du -sh /h | cut -f1')"
|
|
|
|
|
|
|
|
|
|
|
|
if [ "${1:-}" = "--check" ]; then
|
|
|
|
|
|
echo "VM 上的檔案:$(DOCKER_HOST=$VMHOST docker run --rm -v "$VOL":/h alpine:3.20 sh -c 'find /h 2>/dev/null | wc -l') 個項目"
|
|
|
|
|
|
exit 0
|
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
|
|
echo "停止本機的 box(容器留在本機當備份,不刪)…"
|
|
|
|
|
|
docker stop anybot-box anybot-box-home-holder >/dev/null 2>&1 || true
|
|
|
|
|
|
|
|
|
|
|
|
echo "VM 上準備同名資料卷…"
|
|
|
|
|
|
DOCKER_HOST=$VMHOST docker volume create "$VOL" >/dev/null
|
|
|
|
|
|
|
|
|
|
|
|
echo "搬移中(本機 → VM,同一條管線直送,不落地)…"
|
|
|
|
|
|
# 兩邊都是 Linux,檔案擁有者(uid 1000 = box 裡的 bot 使用者)直接對得上。
|
|
|
|
|
|
docker run --rm -v "$VOL":/h -w /h alpine:3.20 tar -cf - . \
|
|
|
|
|
|
| DOCKER_HOST=$VMHOST docker run --rm -i -v "$VOL":/h -w /h alpine:3.20 tar -xf -
|
|
|
|
|
|
|
|
|
|
|
|
echo "核對…"
|
|
|
|
|
|
DOCKER_HOST=$VMHOST docker run --rm -v "$VOL":/h alpine:3.20 sh -c 'echo "VM 上的檔案:$(find /h | wc -l) 個項目、$(du -sh /h | cut -f1)"'
|
|
|
|
|
|
|
|
|
|
|
|
cat <<EOF
|
|
|
|
|
|
|
|
|
|
|
|
搬好了。接著在 AnyBot(重新開啟)設定 › 電腦 › 在哪裡執行:
|
|
|
|
|
|
1. Docker 主機:填 $VMHOST → 套用
|
|
|
|
|
|
2. 容器隔離:選 強隔離(gVisor)
|
|
|
|
|
|
電腦卡片按「建立/更新」:VM 上會先建映像檔(第一次下載套件,幾分鐘),
|
|
|
|
|
|
開機後檔案與登入就是原本那些——所有 Bot 共用同一台、同一份,沒變。
|
|
|
|
|
|
本機那份 box 和資料卷都留著當備份;確認 VM 上都正常後想刪再刪:
|
|
|
|
|
|
docker rm -f anybot-box anybot-box-home-holder; docker volume rm $VOL
|
|
|
|
|
|
EOF
|