PentAGI 如何搭建独立 Worker 节点dind TLS、OPA 授权与 seccomp 加固流程【免费下载链接】pentagiFully autonomous AI Agents system capable of performing complex penetration testing tasks项目地址: https://gitcode.com/GitHub_Trending/pe/pentagi如果你的 PentAGI 主节点要执行真实的渗透测试任务官方建议把 agent 的执行环境隔离到一台独立服务器上——主节点只负责管理worker 节点承担所有容器操作。这篇文章按照仓库中的 Worker Node Setup 指南 走一遍完整流程在 worker 节点上配置 host Docker 的 TLS 远程 API:2376再部署一个三层加固的 Docker-in-Dockerdind:3376TLS OPA 授权插件 seccomp 内核过滤然后把证书和连接配置接回主节点最终让 PentAGI 的 worker 容器全部运行在这个受控沙箱里。适用前提主节点和 worker 节点各一台 Ubuntu 服务器能互相访问私有网络主节点负责跑 PentAGI 容器worker 节点负责跑pentagi-terminal-N工作容器及其嵌套容器。架构与连接模式worker 节点上运行两个 Docker 守护进程Host Docker:2376TLSPentAGI 通过它创建工作容器pentagi-terminal-Ndind:3376TLS OPA seccompagent 在 worker 容器内执行docker run时实际打到的端点所有嵌套容器创建请求都会经过授权策略检查。两种连接模式指南中推荐Standard模式链路特点Standard推荐PentAGI → Host Docker →创建 worker→ worker 经 TLS 访问 dindagent 保留完整 Docker 能力每个嵌套容器都受 dind 授权策略约束DirectPentAGI 直接连 dind 创建 workerworker 本身成为嵌套容器策略同样约束它host bind-mount 被拒绝因此必须禁用 Docker Access 且 Work Directory 留空agent 也没有嵌套 Docker指南专门解释了为什么 worker 容器通过 TLS 端点而不是挂载 socket 访问 dind挂载一个尚不存在的 socket 文件时Docker 会在节点重启后把它物化成一个目录导致 dind 无法在重启后绑定 socket而如果改挂 host daemon 的 socket 来规避这个竞态等于把整个 host Docker 交给了自主运行的 agent可以起特权容器、挂载/接管节点。指向tcp://${PRIVATE_IP}:3376两端都不存在这些问题且客户端证书是只读挂载agent 能用但不能改写。准备变量与两节点安装 Docker在 worker 节点上先定义本次搭建要用的变量PRIVATE_IP换成 worker 节点实际 IPexport PRIVATE_IP192.168.10.10 # Replace with your worker node IP export METRICS_IP127.0.0.1 # Bind address for metrics ports 8080 / 9100 / 9323 / 9324METRICS_IP默认127.0.0.1指标端口只对 worker 节点本机可见只有需要远程 Prometheus 抓取时才改成${PRIVATE_IP}。Docker 必须在两个节点上都安装按官方 Ubuntu 安装方式执行在每个节点分别运行# Add Dockers official GPG key sudo apt-get update sudo apt-get install ca-certificates curl sudo install -m 0755 -d /etc/apt/keyrings sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc sudo chmod ar /etc/apt/keyrings/docker.asc # Add Docker repository to APT sources echo \ deb [arch$(dpkg --print-architecture) signed-by/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \ $(. /etc/os-release echo ${UBUNTU_CODENAME:-$VERSION_CODENAME}) stable | \ sudo tee /etc/apt/sources.list.d/docker.list /dev/null sudo apt-get update # Install Docker CE and plugins sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin第一步Host Docker 开启 TLS:2376生成 host Docker 的证书# Install easy-rsa for certificate management sudo apt install easy-rsa # Create PKI infrastructure for host docker sudo mkdir -p /etc/easy-rsa/docker-host cd /etc/easy-rsa/docker-host sudo /usr/share/easy-rsa/easyrsa init-pki sudo /usr/share/easy-rsa/easyrsa build-ca nopass # Generate server certificate with SAN extensions export EASYRSA_EXTRA_EXTSsubjectAltName alt_names [alt_names] DNS.1 localhost DNS.2 docker DNS.3 docker-host IP.1 127.0.0.1 IP.2 ${PRIVATE_IP} sudo -E /usr/share/easy-rsa/easyrsa build-server-full server nopass # Confirm with yes unset EASYRSA_EXTRA_EXTS # Generate client certificate sudo /usr/share/easy-rsa/easyrsa build-client-full client nopass # Confirm with yes # Copy server certificates to Docker directory sudo mkdir -p /etc/docker/certs/server sudo install -m 0444 pki/ca.crt /etc/docker/certs/server/ca.pem sudo install -m 0444 pki/issued/server.crt /etc/docker/certs/server/cert.pem sudo install -m 0400 pki/private/server.key /etc/docker/certs/server/key.pem # Copy client certificates for remote access sudo mkdir -p /etc/docker/certs/client sudo install -m 0444 pki/ca.crt /etc/docker/certs/client/ca.pem sudo install -m 0444 pki/issued/client.crt /etc/docker/certs/client/cert.pem sudo install -m 0400 pki/private/client.key /etc/docker/certs/client/key.pem两个容易踩的坑文档都明确标注了build-server-full前必须exportSAN 扩展且执行时用sudo -E让EASYRSA_EXTRA_EXTS传进 easy-rsa——否则签出的证书没有 SAN所有 TLS 客户端都会拒绝它。证书生成过程中会要求确认按提示输入yes。配置 daemon 并开启 TCP 监听# Configure Docker daemon with TLS settings sudo tee /etc/docker/daemon.json /dev/null EOF { log-driver: json-file, log-opts: { max-size: 100m, max-file: 2, compress: true }, dns-opts: [ ndots:1 ], metrics-addr: ${METRICS_IP}:9323, tls: true, tlscacert: /etc/docker/certs/server/ca.pem, tlscert: /etc/docker/certs/server/cert.pem, tlskey: /etc/docker/certs/server/key.pem, tlsverify: true } EOF # Enable TCP listening on private IP (required for remote access) sudo sed -i s|ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock|ExecStart/usr/bin/dockerd -H fd:// -H tcp://${PRIVATE_IP}:2376 --containerd/run/containerd/containerd.sock| /lib/systemd/system/docker.service # Apply configuration changes sudo systemctl daemon-reload sudo systemctl restart dockersed这一步修改的是 systemd 服务单元往dockerd启动参数里追加tcp://${PRIVATE_IP}:2376监听是远程 TLS 访问生效的必要条件。验证 TLS 访问创建一个客户端包装脚本后续步骤也会用到sudo tee /usr/local/bin/docker-host-tls /dev/null EOF #!/bin/bash # Docker API client wrapper for TLS connections # Usage: docker-host-tls [docker-commands] export DOCKER_HOSTtcp://${PRIVATE_IP}:2376 export DOCKER_TLS_VERIFY1 export DOCKER_CERT_PATH/etc/docker/certs/client # Show connection info if no arguments provided if [ \$# -eq 0 ]; then echo Docker API connection configured: echo Host: ${PRIVATE_IP}:2376 echo TLS: enabled echo Certificates: /etc/docker/certs/client/ echo echo Usage: docker-host-tls [docker-commands] echo Examples: echo docker-host-tls version echo docker-host-tls ps echo docker-host-tls images exit 0 fi # Execute docker command with TLS environment exec docker \$ EOF sudo chmod x /usr/local/bin/docker-host-tls # Test TLS connection docker-host-tls ps docker-host-tls infodocker-host-tls ps能列出容器、docker-host-tls info返回守护进程信息说明:2376端点就绪。第二步部署加固版 dind:3376dind 是 agent 真正打到的 Docker 端点指南把它按接收不可信输入对待在三个相互独立的层面加固层面控制目的容器显式 capability 集合不用--privilegeddind 自身只保留dockerd需要的最小权限守护进程 APIOPA 授权插件authz.regofail-closed在每一次嵌套containers/create和exec中拒绝逃逸原语内核守护进程级 seccomp 配置seccomp.json在内核层阻止块设备mknod文档确认的主要逃逸向量为 dind 建立独立 PKIdind 必须使用自己的 CA不能与 host Docker 共用# Create PKI infrastructure for dind sudo mkdir -p /etc/easy-rsa/docker-dind cd /etc/easy-rsa/docker-dind sudo /usr/share/easy-rsa/easyrsa init-pki sudo /usr/share/easy-rsa/easyrsa build-ca nopass # Generate server certificate with SAN extensions export EASYRSA_EXTRA_EXTSsubjectAltName alt_names [alt_names] DNS.1 localhost DNS.2 docker-dind IP.1 127.0.0.1 IP.2 ${PRIVATE_IP} sudo -E /usr/share/easy-rsa/easyrsa build-server-full server nopass # Confirm with yes unset EASYRSA_EXTRA_EXTS # Generate client certificate sudo /usr/share/easy-rsa/easyrsa build-client-full client nopass # Confirm with yes # Create the directory layout dind expects sudo mkdir -p /etc/docker/dind/{scripts,authz,certs/{ca,server,client}} \ /var/lib/docker-dind /var/run/docker-dind # Publish certificates (the CA private key stays in the PKI, never in /certs) sudo install -m 0444 pki/ca.crt /etc/docker/dind/certs/ca/cert.pem sudo install -m 0444 pki/ca.crt /etc/docker/dind/certs/server/ca.pem sudo install -m 0444 pki/issued/server.crt /etc/docker/dind/certs/server/cert.pem sudo install -m 0400 pki/private/server.key /etc/docker/dind/certs/server/key.pem sudo install -m 0444 pki/ca.crt /etc/docker/dind/certs/client/ca.pem sudo install -m 0444 pki/issued/client.crt /etc/docker/dind/certs/client/cert.pem sudo install -m 0400 pki/private/client.key /etc/docker/dind/certs/client/key.pemdind 的 entrypoint 检测到这套完整证书后会直接使用不再每次启动生成自签名证书。部署配置文件策略、守护进程配置和脚本都随仓库发布位于 examples/guides/worker_node/其目录 README 列出了每个文件的安装位置与用途。把该目录下的文件拷贝到 worker 节点/tmp例如从克隆的仓库scp过去然后执行安装cd /tmp # Daemon policy files — mounted read-only as /etc/docker inside dind sudo install -m 0644 authz.rego daemon.json seccomp.json /etc/docker/dind/authz/ # Custom entrypoint (adds DOCKER_API_HOST and DOCKER_DNS_SERVERS support) sudo install -m 0755 dockerd-entrypoint.sh /etc/docker/dind/scripts/ # Management, wrapper, and maintenance scripts sudo install -m 0755 run-dind.sh /usr/local/bin/run-dind sudo install -m 0755 docker-dind-tls.sh /usr/local/bin/docker-dind-tls sudo install -m 0755 docker-dind-sock.sh /usr/local/bin/docker-dind-sock sudo install -m 0755 dind-cleanup.sh /usr/local/bin/dind-cleanup sudo install -m 0755 policy-tests.sh /usr/local/bin/dind-policy-tests sudo install -m 0644 dind-cleanup.service dind-cleanup.timer /etc/systemd/system/其中三个策略相关文件的角色authz.rego 是 OPA 策略fail-closed 门禁seccomp.json 是嵌套容器的内核级 syscall 过滤配置daemon.json 把 seccomp 配置设为 dind 守护进程的全局默认。三者所在目录在 dind 容器内被只读挂载为/etc/docker。所有脚本只读一个主机级配置文件按本机情况编辑这一份即可sudo tee /etc/docker/dind/dind.env /dev/null EOF API_ADDRESS${PRIVATE_IP} DOCKER_PORT3376 METRICS_ADDRESS${METRICS_IP} METRICS_PORT9324 CPU_LIMIT2 MEMORY_LIMIT4G MAX_AGE_HOURS24 EOF关键变量与默认值可省略不写即取默认变量默认用途API_ADDRESS/DOCKER_PORT0.0.0.0/3376dind TLS API 绑定地址与端口METRICS_ADDRESS/METRICS_PORT127.0.0.1/9324Prometheus 指标端点NETWORKhosthost直接绑定在API_ADDRESS上bridge改为发布端口CPU_LIMIT/MEMORY_LIMIT/PIDS_LIMIT2/4G/2048dind 容器资源限制DNS_SERVERS空逗号分隔应用于所有嵌套容器MAX_AGE_HOURS24清理 timer 的容器年龄阈值注意dind 默认--network host端口必须与 host Docker 的2376错开指南要求保持3376除非同时改动 host 端。启动 dind 并完成 OPA 插件引导sudo run-dindrun-dind.sh 的首次运行是两阶段引导dind 先在不启用授权的情况下启动脚本把 OPA 插件openpolicyagent/opa-docker-authz-v2:0.9下载并安装为 dind 守护进程内的 managed plugin然后带--authorization-plugin重启进入 fail-closed 模式。插件持久化在/var/lib/docker-dind之后的启动会直接带策略启动。启动后按这四条命令逐一确认守护进程、插件和两条访问路径docker ps | grep docker-dind # dind container is up docker-dind-sock plugin ls # opa-docker-authz is enabled docker-dind-sock run --rm hello-world # nested containers work docker-dind-tls version # TLS endpoint answers curl -s http://${METRICS_IP}:9324/metrics | head -5加固策略实际在拦什么dind 容器本身以--cap-drop ALL启动只加回dockerd需要的 capabilitiesSYS_ADMIN、NET_ADMIN、NET_RAW、SETUID、SETGID、MKNOD、FOWNER、DAC_OVERRIDE、CHOWN、AUDIT_WRITE、KILL、SYS_CHROOT、FSETID、SETFCAP、SETPCAP、NET_BIND_SERVICE。authz.rego对containers/create和exec默认allow false以下请求对嵌套容器一律拒绝拒绝项覆盖范围--privileged容器创建与 exec白名单外的--cap-addSYS_ADMIN、MKNOD、ALL等--device、--device-cgroup-rule设备直通与 cgroup 规则注入--security-optseccomp / AppArmor / systempaths 覆盖--pid、--ipc、--userns、--cgroupns、--uts共享host 与跨容器命名空间显式MaskedPaths/ReadonlyPaths移除/proc/sys保护 →modprobe_pathhost 逃逸Host bind-mounts-v /host:/dest与--mount typebind全部--sysctl、DeviceRequests、非runc--runtime、CgroupParent其余提权字段docker cp、commit、build、image load、plugin install、Swarm绕过创建门禁的 API 端点带 bind 仿真的volume create、macvlan/ipvlan 的network create挂载与 L2 直通仿真同时保留合法渗透测试负载所需默认 capability 集加NET_ADMIN/NET_RAW、Docker 管理卷、tmpfs、docker pull、完整容器生命周期、bridge 网络与--network host。块设备逃逸做了双重封锁MKNOD在 Docker 默认 capability 集里无法移除seccomp.json因此在内核层对带S_IFBLK标志的mknod/mknodat直接返回SCMP_ACT_ERRNO字符设备刻意放行供/dev/net/tun等渗透工具使用authz.rego同时封死--cap-add MKNOD和一切--security-opt覆盖保证该 profile 无法被替换或禁用。两者共同拒绝mknod /dev/sda b 8 0debugfs直读 host 磁盘的路径。一个明确的边界要说清楚--network host是有意放行的渗透工具需要 raw socket 和 host 本地目标因此嵌套容器能到达 worker 节点网络栈上的所有服务包括 host Docker 的 TLS 端口。文档要求绝不在 worker 节点存放外层守护进程的客户端证书也绝不在其上暴露任何提供文件服务的明文 HTTP 端口。第三步策略更新与自动清理修改策略后不能只重启因为旧策略下创建的嵌套容器保留原HostConfig。run-dind记录authz.rego的 SHA-256 于/var/lib/docker-dind/.authz-policy-hash哈希变化时会临时无授权启动、强制删除所有嵌套容器、再带新策略重启# After editing /etc/docker/dind/authz/authz.rego sudo docker rm -f docker-dind sudo run-dind # Force a purge without a policy change sudo env PURGEyes /usr/local/bin/run-dindworker 容器是短生命周期的启用清理 timer 按MAX_AGE_HOURS自动清理sudo systemctl daemon-reload sudo systemctl enable --now dind-cleanup.timer systemctl status dind-cleanup.timer # check schedule journalctl -u dind-cleanup.service -n 50 # review last run sudo env MAX_AGE_HOURS1 /usr/local/bin/dind-cleanup # run manually with an override第四步运行隔离测试套件验证dind-policy-tests在与真实 PentAGI worker 完全同配置的容器里演练授权策略和 seccomp profile正向测试覆盖合法负载nmap、masscan、curl、sqlmap、nginx、卷、tmpfs、容器生命周期负向测试覆盖逃逸原语特权容器、危险 capability、host 命名空间、bind-mount、块设备mknod、nsenter。指南要求在部署完成后以及每次策略变更后各跑一次。套件会探测节点上的一个明文 HTTP 服务先安装 Python 并启动一个临时服务器然后运行测试容器sudo apt-get install -y python3 python3 -m http.server 8080 --bind ${PRIVATE_IP} /tmp/dind-test-http.log 21 HTTP_PID$! docker run --rm -it \ --name pentagi-terminal-test \ --network host \ --cap-add NET_ADMIN --cap-add NET_RAW \ -e TARGET_IP${PRIVATE_IP} \ -e HTTP_PORT8080 \ -e DIND_TLS_PORT3376 \ -e OUTER_TLS_PORT2376 \ -e DOCKER_HOSTtcp://${PRIVATE_IP}:3376 \ -e DOCKER_TLS_VERIFY1 \ -e DOCKER_CERT_PATH/etc/docker/dind/certs/client \ -v /usr/local/bin/dind-policy-tests:/work/policy-tests.sh:ro \ -v /etc/docker/dind/certs/client:/etc/docker/dind/certs/client:ro \ -w /work \ vxcontrol/kali-linux \ bash /work/policy-tests.sh kill ${HTTP_PID} 2/dev/null || true这个调用方式精确复现了 PentAGI 对真实 worker 容器的注入dind 端点与客户端证书通过环境变量提供不挂载任何 Docker socket。判定标准每项测试报告[ PASS ]或[ SKIP ]无失败时退出码为0。文档对两类失败给出明确含义——负向测试失败意味着存在隔离缺口必须停下来处理正向测试失败是误报会直接打断 agent 工作负载。把证书传到主节点并接入 PentAGI传输两组客户端证书# On the worker node - create archive with host docker certificates sudo tar czf docker-host-ssl.tar.gz -C /etc/docker/certs client/ # Transfer to main node (replace MAIN_NODE_IP with actual IP) scp docker-host-ssl.tar.gz rootMAIN_NODE_IP:/opt/pentagi/ # On the main node - extract certificates cd /opt/pentagi tar xzf docker-host-ssl.tar.gz mv client docker-host-ssl rm docker-host-ssl.tar.gz# On the worker node - create archive with dind certificates sudo tar czf docker-dind-ssl.tar.gz -C /etc/docker/dind/certs client/ # Transfer to main node (replace MAIN_NODE_IP with actual IP) scp docker-dind-ssl.tar.gz rootMAIN_NODE_IP:/opt/pentagi/ # On the main node - extract certificates cd /opt/pentagi tar xzf docker-dind-ssl.tar.gz mv client docker-dind-ssl rm docker-dind-ssl.tar.gz验证主节点上的目录结构两个目录各应包含ca.pem、cert.pem、key.pemls -la /opt/pentagi/docker-host-ssl/ ls -la /opt/pentagi/docker-dind-ssl/文档要求这两组证书目录仅 root 可读且位于任何 HTTP 服务的目录之外。主节点安装并配置 Docker 环境# Create installation directory and navigate to it mkdir -p /opt/pentagi cd /opt/pentagi # Download the latest installer wget -O installer.zip https://pentagi.com/downloads/linux/amd64/installer-latest.zip # Extract the installer unzip installer.zip # Run the installer (interactive setup) sudo ./installerinstaller 需要与 Docker API 交互生产环境按文档建议用 root 运行。安装完成后通过./installer进入Tools → Docker Environment填写 Standard 模式配置PentAGI 如何到达 worker 节点host DockerDocker Hosttcp://${PRIVATE_IP}:2376TLS Verification1TLS Certificates/opt/pentagi/docker-host-ssl主节点上的路径会挂进 PentAGI 容器worker 容器如何到达 dindDocker AccesstrueDocker Socket留空——不挂载任何 socketWorker Docker Daemon Hosttcp://${PRIVATE_IP}:3376Worker Docker TLS VerifyenabledWorker Docker Certificate Path/etc/docker/dind/certs/clientworker 节点上的路径只读挂进每个 worker 容器其余字段Network AdmintrueDocker Networkpentagi-networkPublic IP Address${PRIVATE_IP}Work Directory 留空用 Docker 卷Default Imagedebian:latest或留空Pentesting Imagevxcontrol/kali-linux或留空。两组证书路径不可互换host 证书解析于主节点dind 证书解析于 worker 节点。特别要注意文档的红字警告——绝不要把 Worker Docker Certificate Path 指向/etc/docker/certs/client那是 host 守护进程的客户端证书交给 agent 等于交出:2376的 host Docker API隔离模型整体失效。如果不用 installer 而是手工配置主节点.env等价内容为## How PentAGI reaches the worker nodes host Docker DOCKER_HOSTtcp://${PRIVATE_IP}:2376 DOCKER_TLS_VERIFY1 PENTAGI_DOCKER_CERT_PATH/opt/pentagi/docker-host-ssl # path on the MAIN node ## How worker containers reach dind DOCKER_INSIDEtrue DOCKER_SOCKET # empty: mount no socket DOCKER_INSIDE_HOSTtcp://${PRIVATE_IP}:3376 DOCKER_INSIDE_TLS_VERIFY1 DOCKER_INSIDE_CERT_PATH/etc/docker/dind/certs/client # path on the WORKER node DOCKER_NET_ADMINtrue DOCKER_NETWORKpentagi-network DOCKER_PUBLIC_IP${PRIVATE_IP}PentAGI 会把DOCKER_INSIDE_*三个变量去掉_INSIDE_段后注入 worker 容器即DOCKER_HOST、DOCKER_TLS_VERIFY、DOCKER_CERT_PATH并把证书目录以相同路径只读挂载进去容器内docker直接可用。端到端验证在有一个真实 worker 容器运行后从 worker 节点验证docker-host-tls exec -it pentagi-terminal-1 docker version # talks to dind, not the host docker-host-tls exec -it pentagi-terminal-1 env | grep DOCKER_第二条命令应显示DOCKER_HOST、DOCKER_TLS_VERIFY、DOCKER_CERT_PATH名称中不含_INSIDE_并且容器内不存在/var/run/docker.sock。防火墙端口规划worker 节点需要放行的端口如下前两个只允许主 PentAGI 节点访问因为嵌套容器可用--network host探测本节点所有端口端口绑定地址服务2376${PRIVATE_IP}Host Docker APITLS3376${PRIVATE_IP}dind APITLS9323${METRICS_IP}Host Docker 指标9324${METRICS_IP}dind 指标8080 / 9100${METRICS_IP}cAdvisor / node-exporter可选部署9443${PRIVATE_IP}Browser 抓取服务可选部署Basic Auth 保护28000–30000全部接口每个 worker 容器动态分配 2 个端口供 OOB 攻击技术回调需允许被测试的目标网络访问默认METRICS_IP127.0.0.1时指标端口无需对外开放改成${PRIVATE_IP}后需额外放行 9323、9324、8080、9100 并仅对抓取主机开放。cAdvisor 挂载docker.sock把8080暴露给抓取主机之外的任何客户端相当于给出与 host Docker 同级的访问权。故障排查docker logs docker-dind # dind daemon output docker-dind-sock info | grep -A 20 Security # confirm seccomp profile is active docker-dind-sock plugin ls # confirm authz plugin is enabled # Re-bootstrap the plugin from scratch sudo rm -f /var/lib/docker-dind/.authz-plugin-installed \ /var/lib/docker-dind/.authz-policy-hash sudo docker rm -f docker-dind sudo run-dindrun-dind报缺少/dev/fuse时先sudo modprobe fuse再启动。插件状态异常时按上面最后一组命令删除标记文件并重新引导注意前两条rm只删除/var/lib/docker-dind下的两个标记文件会触发重新下载安装插件。策略变更后旧容器仍带旧权限的问题由上文策略更新小节的 purge 机制处理不要手动只重启 dind。最后保留一个文档明确给出的边界认知authz.rego是一份拒绝列表它的强度只取决于其完备性——任何能授予 SYS_ADMIN、设备访问、命名空间逃逸或文件系统访问的新 Docker API 字段都必须补充进去如果要求内核级强制保证文档指向 dind-rootless。完成上述四步并让dind-policy-tests全绿、worker 容器内验证通过后这套 worker 节点即可按 Standard 模式接入主节点的 PentAGIworker 节点上的浏览器抓取服务与指标 exporter 属于独立可选部署指南在同一文档中给出了对应步骤可按需另行实施。【免费下载链接】pentagiFully autonomous AI Agents system capable of performing complex penetration testing tasks项目地址: https://gitcode.com/GitHub_Trending/pe/pentagi创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考 PentAGI 如何搭建独立 Worker 节点：dind TLS、OPA 授权与 seccomp 加固流程
PentAGI 如何搭建独立 Worker 节点dind TLS、OPA 授权与 seccomp 加固流程【免费下载链接】pentagiFully autonomous AI Agents system capable of performing complex penetration testing tasks项目地址: https://gitcode.com/GitHub_Trending/pe/pentagi如果你的 PentAGI 主节点要执行真实的渗透测试任务官方建议把 agent 的执行环境隔离到一台独立服务器上——主节点只负责管理worker 节点承担所有容器操作。这篇文章按照仓库中的 Worker Node Setup 指南 走一遍完整流程在 worker 节点上配置 host Docker 的 TLS 远程 API:2376再部署一个三层加固的 Docker-in-Dockerdind:3376TLS OPA 授权插件 seccomp 内核过滤然后把证书和连接配置接回主节点最终让 PentAGI 的 worker 容器全部运行在这个受控沙箱里。适用前提主节点和 worker 节点各一台 Ubuntu 服务器能互相访问私有网络主节点负责跑 PentAGI 容器worker 节点负责跑pentagi-terminal-N工作容器及其嵌套容器。架构与连接模式worker 节点上运行两个 Docker 守护进程Host Docker:2376TLSPentAGI 通过它创建工作容器pentagi-terminal-Ndind:3376TLS OPA seccompagent 在 worker 容器内执行docker run时实际打到的端点所有嵌套容器创建请求都会经过授权策略检查。两种连接模式指南中推荐Standard模式链路特点Standard推荐PentAGI → Host Docker →创建 worker→ worker 经 TLS 访问 dindagent 保留完整 Docker 能力每个嵌套容器都受 dind 授权策略约束DirectPentAGI 直接连 dind 创建 workerworker 本身成为嵌套容器策略同样约束它host bind-mount 被拒绝因此必须禁用 Docker Access 且 Work Directory 留空agent 也没有嵌套 Docker指南专门解释了为什么 worker 容器通过 TLS 端点而不是挂载 socket 访问 dind挂载一个尚不存在的 socket 文件时Docker 会在节点重启后把它物化成一个目录导致 dind 无法在重启后绑定 socket而如果改挂 host daemon 的 socket 来规避这个竞态等于把整个 host Docker 交给了自主运行的 agent可以起特权容器、挂载/接管节点。指向tcp://${PRIVATE_IP}:3376两端都不存在这些问题且客户端证书是只读挂载agent 能用但不能改写。准备变量与两节点安装 Docker在 worker 节点上先定义本次搭建要用的变量PRIVATE_IP换成 worker 节点实际 IPexport PRIVATE_IP192.168.10.10 # Replace with your worker node IP export METRICS_IP127.0.0.1 # Bind address for metrics ports 8080 / 9100 / 9323 / 9324METRICS_IP默认127.0.0.1指标端口只对 worker 节点本机可见只有需要远程 Prometheus 抓取时才改成${PRIVATE_IP}。Docker 必须在两个节点上都安装按官方 Ubuntu 安装方式执行在每个节点分别运行# Add Dockers official GPG key sudo apt-get update sudo apt-get install ca-certificates curl sudo install -m 0755 -d /etc/apt/keyrings sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc sudo chmod ar /etc/apt/keyrings/docker.asc # Add Docker repository to APT sources echo \ deb [arch$(dpkg --print-architecture) signed-by/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \ $(. /etc/os-release echo ${UBUNTU_CODENAME:-$VERSION_CODENAME}) stable | \ sudo tee /etc/apt/sources.list.d/docker.list /dev/null sudo apt-get update # Install Docker CE and plugins sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin第一步Host Docker 开启 TLS:2376生成 host Docker 的证书# Install easy-rsa for certificate management sudo apt install easy-rsa # Create PKI infrastructure for host docker sudo mkdir -p /etc/easy-rsa/docker-host cd /etc/easy-rsa/docker-host sudo /usr/share/easy-rsa/easyrsa init-pki sudo /usr/share/easy-rsa/easyrsa build-ca nopass # Generate server certificate with SAN extensions export EASYRSA_EXTRA_EXTSsubjectAltName alt_names [alt_names] DNS.1 localhost DNS.2 docker DNS.3 docker-host IP.1 127.0.0.1 IP.2 ${PRIVATE_IP} sudo -E /usr/share/easy-rsa/easyrsa build-server-full server nopass # Confirm with yes unset EASYRSA_EXTRA_EXTS # Generate client certificate sudo /usr/share/easy-rsa/easyrsa build-client-full client nopass # Confirm with yes # Copy server certificates to Docker directory sudo mkdir -p /etc/docker/certs/server sudo install -m 0444 pki/ca.crt /etc/docker/certs/server/ca.pem sudo install -m 0444 pki/issued/server.crt /etc/docker/certs/server/cert.pem sudo install -m 0400 pki/private/server.key /etc/docker/certs/server/key.pem # Copy client certificates for remote access sudo mkdir -p /etc/docker/certs/client sudo install -m 0444 pki/ca.crt /etc/docker/certs/client/ca.pem sudo install -m 0444 pki/issued/client.crt /etc/docker/certs/client/cert.pem sudo install -m 0400 pki/private/client.key /etc/docker/certs/client/key.pem两个容易踩的坑文档都明确标注了build-server-full前必须exportSAN 扩展且执行时用sudo -E让EASYRSA_EXTRA_EXTS传进 easy-rsa——否则签出的证书没有 SAN所有 TLS 客户端都会拒绝它。证书生成过程中会要求确认按提示输入yes。配置 daemon 并开启 TCP 监听# Configure Docker daemon with TLS settings sudo tee /etc/docker/daemon.json /dev/null EOF { log-driver: json-file, log-opts: { max-size: 100m, max-file: 2, compress: true }, dns-opts: [ ndots:1 ], metrics-addr: ${METRICS_IP}:9323, tls: true, tlscacert: /etc/docker/certs/server/ca.pem, tlscert: /etc/docker/certs/server/cert.pem, tlskey: /etc/docker/certs/server/key.pem, tlsverify: true } EOF # Enable TCP listening on private IP (required for remote access) sudo sed -i s|ExecStart/usr/bin/dockerd -H fd:// --containerd/run/containerd/containerd.sock|ExecStart/usr/bin/dockerd -H fd:// -H tcp://${PRIVATE_IP}:2376 --containerd/run/containerd/containerd.sock| /lib/systemd/system/docker.service # Apply configuration changes sudo systemctl daemon-reload sudo systemctl restart dockersed这一步修改的是 systemd 服务单元往dockerd启动参数里追加tcp://${PRIVATE_IP}:2376监听是远程 TLS 访问生效的必要条件。验证 TLS 访问创建一个客户端包装脚本后续步骤也会用到sudo tee /usr/local/bin/docker-host-tls /dev/null EOF #!/bin/bash # Docker API client wrapper for TLS connections # Usage: docker-host-tls [docker-commands] export DOCKER_HOSTtcp://${PRIVATE_IP}:2376 export DOCKER_TLS_VERIFY1 export DOCKER_CERT_PATH/etc/docker/certs/client # Show connection info if no arguments provided if [ \$# -eq 0 ]; then echo Docker API connection configured: echo Host: ${PRIVATE_IP}:2376 echo TLS: enabled echo Certificates: /etc/docker/certs/client/ echo echo Usage: docker-host-tls [docker-commands] echo Examples: echo docker-host-tls version echo docker-host-tls ps echo docker-host-tls images exit 0 fi # Execute docker command with TLS environment exec docker \$ EOF sudo chmod x /usr/local/bin/docker-host-tls # Test TLS connection docker-host-tls ps docker-host-tls infodocker-host-tls ps能列出容器、docker-host-tls info返回守护进程信息说明:2376端点就绪。第二步部署加固版 dind:3376dind 是 agent 真正打到的 Docker 端点指南把它按接收不可信输入对待在三个相互独立的层面加固层面控制目的容器显式 capability 集合不用--privilegeddind 自身只保留dockerd需要的最小权限守护进程 APIOPA 授权插件authz.regofail-closed在每一次嵌套containers/create和exec中拒绝逃逸原语内核守护进程级 seccomp 配置seccomp.json在内核层阻止块设备mknod文档确认的主要逃逸向量为 dind 建立独立 PKIdind 必须使用自己的 CA不能与 host Docker 共用# Create PKI infrastructure for dind sudo mkdir -p /etc/easy-rsa/docker-dind cd /etc/easy-rsa/docker-dind sudo /usr/share/easy-rsa/easyrsa init-pki sudo /usr/share/easy-rsa/easyrsa build-ca nopass # Generate server certificate with SAN extensions export EASYRSA_EXTRA_EXTSsubjectAltName alt_names [alt_names] DNS.1 localhost DNS.2 docker-dind IP.1 127.0.0.1 IP.2 ${PRIVATE_IP} sudo -E /usr/share/easy-rsa/easyrsa build-server-full server nopass # Confirm with yes unset EASYRSA_EXTRA_EXTS # Generate client certificate sudo /usr/share/easy-rsa/easyrsa build-client-full client nopass # Confirm with yes # Create the directory layout dind expects sudo mkdir -p /etc/docker/dind/{scripts,authz,certs/{ca,server,client}} \ /var/lib/docker-dind /var/run/docker-dind # Publish certificates (the CA private key stays in the PKI, never in /certs) sudo install -m 0444 pki/ca.crt /etc/docker/dind/certs/ca/cert.pem sudo install -m 0444 pki/ca.crt /etc/docker/dind/certs/server/ca.pem sudo install -m 0444 pki/issued/server.crt /etc/docker/dind/certs/server/cert.pem sudo install -m 0400 pki/private/server.key /etc/docker/dind/certs/server/key.pem sudo install -m 0444 pki/ca.crt /etc/docker/dind/certs/client/ca.pem sudo install -m 0444 pki/issued/client.crt /etc/docker/dind/certs/client/cert.pem sudo install -m 0400 pki/private/client.key /etc/docker/dind/certs/client/key.pemdind 的 entrypoint 检测到这套完整证书后会直接使用不再每次启动生成自签名证书。部署配置文件策略、守护进程配置和脚本都随仓库发布位于 examples/guides/worker_node/其目录 README 列出了每个文件的安装位置与用途。把该目录下的文件拷贝到 worker 节点/tmp例如从克隆的仓库scp过去然后执行安装cd /tmp # Daemon policy files — mounted read-only as /etc/docker inside dind sudo install -m 0644 authz.rego daemon.json seccomp.json /etc/docker/dind/authz/ # Custom entrypoint (adds DOCKER_API_HOST and DOCKER_DNS_SERVERS support) sudo install -m 0755 dockerd-entrypoint.sh /etc/docker/dind/scripts/ # Management, wrapper, and maintenance scripts sudo install -m 0755 run-dind.sh /usr/local/bin/run-dind sudo install -m 0755 docker-dind-tls.sh /usr/local/bin/docker-dind-tls sudo install -m 0755 docker-dind-sock.sh /usr/local/bin/docker-dind-sock sudo install -m 0755 dind-cleanup.sh /usr/local/bin/dind-cleanup sudo install -m 0755 policy-tests.sh /usr/local/bin/dind-policy-tests sudo install -m 0644 dind-cleanup.service dind-cleanup.timer /etc/systemd/system/其中三个策略相关文件的角色authz.rego 是 OPA 策略fail-closed 门禁seccomp.json 是嵌套容器的内核级 syscall 过滤配置daemon.json 把 seccomp 配置设为 dind 守护进程的全局默认。三者所在目录在 dind 容器内被只读挂载为/etc/docker。所有脚本只读一个主机级配置文件按本机情况编辑这一份即可sudo tee /etc/docker/dind/dind.env /dev/null EOF API_ADDRESS${PRIVATE_IP} DOCKER_PORT3376 METRICS_ADDRESS${METRICS_IP} METRICS_PORT9324 CPU_LIMIT2 MEMORY_LIMIT4G MAX_AGE_HOURS24 EOF关键变量与默认值可省略不写即取默认变量默认用途API_ADDRESS/DOCKER_PORT0.0.0.0/3376dind TLS API 绑定地址与端口METRICS_ADDRESS/METRICS_PORT127.0.0.1/9324Prometheus 指标端点NETWORKhosthost直接绑定在API_ADDRESS上bridge改为发布端口CPU_LIMIT/MEMORY_LIMIT/PIDS_LIMIT2/4G/2048dind 容器资源限制DNS_SERVERS空逗号分隔应用于所有嵌套容器MAX_AGE_HOURS24清理 timer 的容器年龄阈值注意dind 默认--network host端口必须与 host Docker 的2376错开指南要求保持3376除非同时改动 host 端。启动 dind 并完成 OPA 插件引导sudo run-dindrun-dind.sh 的首次运行是两阶段引导dind 先在不启用授权的情况下启动脚本把 OPA 插件openpolicyagent/opa-docker-authz-v2:0.9下载并安装为 dind 守护进程内的 managed plugin然后带--authorization-plugin重启进入 fail-closed 模式。插件持久化在/var/lib/docker-dind之后的启动会直接带策略启动。启动后按这四条命令逐一确认守护进程、插件和两条访问路径docker ps | grep docker-dind # dind container is up docker-dind-sock plugin ls # opa-docker-authz is enabled docker-dind-sock run --rm hello-world # nested containers work docker-dind-tls version # TLS endpoint answers curl -s http://${METRICS_IP}:9324/metrics | head -5加固策略实际在拦什么dind 容器本身以--cap-drop ALL启动只加回dockerd需要的 capabilitiesSYS_ADMIN、NET_ADMIN、NET_RAW、SETUID、SETGID、MKNOD、FOWNER、DAC_OVERRIDE、CHOWN、AUDIT_WRITE、KILL、SYS_CHROOT、FSETID、SETFCAP、SETPCAP、NET_BIND_SERVICE。authz.rego对containers/create和exec默认allow false以下请求对嵌套容器一律拒绝拒绝项覆盖范围--privileged容器创建与 exec白名单外的--cap-addSYS_ADMIN、MKNOD、ALL等--device、--device-cgroup-rule设备直通与 cgroup 规则注入--security-optseccomp / AppArmor / systempaths 覆盖--pid、--ipc、--userns、--cgroupns、--uts共享host 与跨容器命名空间显式MaskedPaths/ReadonlyPaths移除/proc/sys保护 →modprobe_pathhost 逃逸Host bind-mounts-v /host:/dest与--mount typebind全部--sysctl、DeviceRequests、非runc--runtime、CgroupParent其余提权字段docker cp、commit、build、image load、plugin install、Swarm绕过创建门禁的 API 端点带 bind 仿真的volume create、macvlan/ipvlan 的network create挂载与 L2 直通仿真同时保留合法渗透测试负载所需默认 capability 集加NET_ADMIN/NET_RAW、Docker 管理卷、tmpfs、docker pull、完整容器生命周期、bridge 网络与--network host。块设备逃逸做了双重封锁MKNOD在 Docker 默认 capability 集里无法移除seccomp.json因此在内核层对带S_IFBLK标志的mknod/mknodat直接返回SCMP_ACT_ERRNO字符设备刻意放行供/dev/net/tun等渗透工具使用authz.rego同时封死--cap-add MKNOD和一切--security-opt覆盖保证该 profile 无法被替换或禁用。两者共同拒绝mknod /dev/sda b 8 0debugfs直读 host 磁盘的路径。一个明确的边界要说清楚--network host是有意放行的渗透工具需要 raw socket 和 host 本地目标因此嵌套容器能到达 worker 节点网络栈上的所有服务包括 host Docker 的 TLS 端口。文档要求绝不在 worker 节点存放外层守护进程的客户端证书也绝不在其上暴露任何提供文件服务的明文 HTTP 端口。第三步策略更新与自动清理修改策略后不能只重启因为旧策略下创建的嵌套容器保留原HostConfig。run-dind记录authz.rego的 SHA-256 于/var/lib/docker-dind/.authz-policy-hash哈希变化时会临时无授权启动、强制删除所有嵌套容器、再带新策略重启# After editing /etc/docker/dind/authz/authz.rego sudo docker rm -f docker-dind sudo run-dind # Force a purge without a policy change sudo env PURGEyes /usr/local/bin/run-dindworker 容器是短生命周期的启用清理 timer 按MAX_AGE_HOURS自动清理sudo systemctl daemon-reload sudo systemctl enable --now dind-cleanup.timer systemctl status dind-cleanup.timer # check schedule journalctl -u dind-cleanup.service -n 50 # review last run sudo env MAX_AGE_HOURS1 /usr/local/bin/dind-cleanup # run manually with an override第四步运行隔离测试套件验证dind-policy-tests在与真实 PentAGI worker 完全同配置的容器里演练授权策略和 seccomp profile正向测试覆盖合法负载nmap、masscan、curl、sqlmap、nginx、卷、tmpfs、容器生命周期负向测试覆盖逃逸原语特权容器、危险 capability、host 命名空间、bind-mount、块设备mknod、nsenter。指南要求在部署完成后以及每次策略变更后各跑一次。套件会探测节点上的一个明文 HTTP 服务先安装 Python 并启动一个临时服务器然后运行测试容器sudo apt-get install -y python3 python3 -m http.server 8080 --bind ${PRIVATE_IP} /tmp/dind-test-http.log 21 HTTP_PID$! docker run --rm -it \ --name pentagi-terminal-test \ --network host \ --cap-add NET_ADMIN --cap-add NET_RAW \ -e TARGET_IP${PRIVATE_IP} \ -e HTTP_PORT8080 \ -e DIND_TLS_PORT3376 \ -e OUTER_TLS_PORT2376 \ -e DOCKER_HOSTtcp://${PRIVATE_IP}:3376 \ -e DOCKER_TLS_VERIFY1 \ -e DOCKER_CERT_PATH/etc/docker/dind/certs/client \ -v /usr/local/bin/dind-policy-tests:/work/policy-tests.sh:ro \ -v /etc/docker/dind/certs/client:/etc/docker/dind/certs/client:ro \ -w /work \ vxcontrol/kali-linux \ bash /work/policy-tests.sh kill ${HTTP_PID} 2/dev/null || true这个调用方式精确复现了 PentAGI 对真实 worker 容器的注入dind 端点与客户端证书通过环境变量提供不挂载任何 Docker socket。判定标准每项测试报告[ PASS ]或[ SKIP ]无失败时退出码为0。文档对两类失败给出明确含义——负向测试失败意味着存在隔离缺口必须停下来处理正向测试失败是误报会直接打断 agent 工作负载。把证书传到主节点并接入 PentAGI传输两组客户端证书# On the worker node - create archive with host docker certificates sudo tar czf docker-host-ssl.tar.gz -C /etc/docker/certs client/ # Transfer to main node (replace MAIN_NODE_IP with actual IP) scp docker-host-ssl.tar.gz rootMAIN_NODE_IP:/opt/pentagi/ # On the main node - extract certificates cd /opt/pentagi tar xzf docker-host-ssl.tar.gz mv client docker-host-ssl rm docker-host-ssl.tar.gz# On the worker node - create archive with dind certificates sudo tar czf docker-dind-ssl.tar.gz -C /etc/docker/dind/certs client/ # Transfer to main node (replace MAIN_NODE_IP with actual IP) scp docker-dind-ssl.tar.gz rootMAIN_NODE_IP:/opt/pentagi/ # On the main node - extract certificates cd /opt/pentagi tar xzf docker-dind-ssl.tar.gz mv client docker-dind-ssl rm docker-dind-ssl.tar.gz验证主节点上的目录结构两个目录各应包含ca.pem、cert.pem、key.pemls -la /opt/pentagi/docker-host-ssl/ ls -la /opt/pentagi/docker-dind-ssl/文档要求这两组证书目录仅 root 可读且位于任何 HTTP 服务的目录之外。主节点安装并配置 Docker 环境# Create installation directory and navigate to it mkdir -p /opt/pentagi cd /opt/pentagi # Download the latest installer wget -O installer.zip https://pentagi.com/downloads/linux/amd64/installer-latest.zip # Extract the installer unzip installer.zip # Run the installer (interactive setup) sudo ./installerinstaller 需要与 Docker API 交互生产环境按文档建议用 root 运行。安装完成后通过./installer进入Tools → Docker Environment填写 Standard 模式配置PentAGI 如何到达 worker 节点host DockerDocker Hosttcp://${PRIVATE_IP}:2376TLS Verification1TLS Certificates/opt/pentagi/docker-host-ssl主节点上的路径会挂进 PentAGI 容器worker 容器如何到达 dindDocker AccesstrueDocker Socket留空——不挂载任何 socketWorker Docker Daemon Hosttcp://${PRIVATE_IP}:3376Worker Docker TLS VerifyenabledWorker Docker Certificate Path/etc/docker/dind/certs/clientworker 节点上的路径只读挂进每个 worker 容器其余字段Network AdmintrueDocker Networkpentagi-networkPublic IP Address${PRIVATE_IP}Work Directory 留空用 Docker 卷Default Imagedebian:latest或留空Pentesting Imagevxcontrol/kali-linux或留空。两组证书路径不可互换host 证书解析于主节点dind 证书解析于 worker 节点。特别要注意文档的红字警告——绝不要把 Worker Docker Certificate Path 指向/etc/docker/certs/client那是 host 守护进程的客户端证书交给 agent 等于交出:2376的 host Docker API隔离模型整体失效。如果不用 installer 而是手工配置主节点.env等价内容为## How PentAGI reaches the worker nodes host Docker DOCKER_HOSTtcp://${PRIVATE_IP}:2376 DOCKER_TLS_VERIFY1 PENTAGI_DOCKER_CERT_PATH/opt/pentagi/docker-host-ssl # path on the MAIN node ## How worker containers reach dind DOCKER_INSIDEtrue DOCKER_SOCKET # empty: mount no socket DOCKER_INSIDE_HOSTtcp://${PRIVATE_IP}:3376 DOCKER_INSIDE_TLS_VERIFY1 DOCKER_INSIDE_CERT_PATH/etc/docker/dind/certs/client # path on the WORKER node DOCKER_NET_ADMINtrue DOCKER_NETWORKpentagi-network DOCKER_PUBLIC_IP${PRIVATE_IP}PentAGI 会把DOCKER_INSIDE_*三个变量去掉_INSIDE_段后注入 worker 容器即DOCKER_HOST、DOCKER_TLS_VERIFY、DOCKER_CERT_PATH并把证书目录以相同路径只读挂载进去容器内docker直接可用。端到端验证在有一个真实 worker 容器运行后从 worker 节点验证docker-host-tls exec -it pentagi-terminal-1 docker version # talks to dind, not the host docker-host-tls exec -it pentagi-terminal-1 env | grep DOCKER_第二条命令应显示DOCKER_HOST、DOCKER_TLS_VERIFY、DOCKER_CERT_PATH名称中不含_INSIDE_并且容器内不存在/var/run/docker.sock。防火墙端口规划worker 节点需要放行的端口如下前两个只允许主 PentAGI 节点访问因为嵌套容器可用--network host探测本节点所有端口端口绑定地址服务2376${PRIVATE_IP}Host Docker APITLS3376${PRIVATE_IP}dind APITLS9323${METRICS_IP}Host Docker 指标9324${METRICS_IP}dind 指标8080 / 9100${METRICS_IP}cAdvisor / node-exporter可选部署9443${PRIVATE_IP}Browser 抓取服务可选部署Basic Auth 保护28000–30000全部接口每个 worker 容器动态分配 2 个端口供 OOB 攻击技术回调需允许被测试的目标网络访问默认METRICS_IP127.0.0.1时指标端口无需对外开放改成${PRIVATE_IP}后需额外放行 9323、9324、8080、9100 并仅对抓取主机开放。cAdvisor 挂载docker.sock把8080暴露给抓取主机之外的任何客户端相当于给出与 host Docker 同级的访问权。故障排查docker logs docker-dind # dind daemon output docker-dind-sock info | grep -A 20 Security # confirm seccomp profile is active docker-dind-sock plugin ls # confirm authz plugin is enabled # Re-bootstrap the plugin from scratch sudo rm -f /var/lib/docker-dind/.authz-plugin-installed \ /var/lib/docker-dind/.authz-policy-hash sudo docker rm -f docker-dind sudo run-dindrun-dind报缺少/dev/fuse时先sudo modprobe fuse再启动。插件状态异常时按上面最后一组命令删除标记文件并重新引导注意前两条rm只删除/var/lib/docker-dind下的两个标记文件会触发重新下载安装插件。策略变更后旧容器仍带旧权限的问题由上文策略更新小节的 purge 机制处理不要手动只重启 dind。最后保留一个文档明确给出的边界认知authz.rego是一份拒绝列表它的强度只取决于其完备性——任何能授予 SYS_ADMIN、设备访问、命名空间逃逸或文件系统访问的新 Docker API 字段都必须补充进去如果要求内核级强制保证文档指向 dind-rootless。完成上述四步并让dind-policy-tests全绿、worker 容器内验证通过后这套 worker 节点即可按 Standard 模式接入主节点的 PentAGIworker 节点上的浏览器抓取服务与指标 exporter 属于独立可选部署指南在同一文档中给出了对应步骤可按需另行实施。【免费下载链接】pentagiFully autonomous AI Agents system capable of performing complex penetration testing tasks项目地址: https://gitcode.com/GitHub_Trending/pe/pentagi创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考