From 25c4dd50b3c7109a330a1c007563086a317273ab Mon Sep 17 00:00:00 2001
From: ouyangxq <775153912@qq.com>
Date: Wed, 2 Sep 2026 15:30:29 +0800
Subject: [PATCH] fix(deploy): bound infrastructure container logs

---
 deploy/docker-compose.rocketmq.yml          |  9 +++++++++
 docker-compose-infra.yml                    |  9 +++++++++
 scripts/container-logging-contract.test.mjs | 21 +++++++++++++++++++++
 3 files changed, 39 insertions(+)

diff --git a/deploy/docker-compose.rocketmq.yml b/deploy/docker-compose.rocketmq.yml
index b97a63ebb..4a5038dcd 100644
--- a/deploy/docker-compose.rocketmq.yml
+++ b/deploy/docker-compose.rocketmq.yml
@@ -1,10 +1,17 @@
 name: firstleg-${DEPLOY_ENV:-test}-rocketmq
 
+x-bounded-logging: &bounded-logging
+  driver: local
+  options:
+    max-size: ${DOCKER_LOG_MAX_SIZE:-50m}
+    max-file: "${DOCKER_LOG_MAX_FILE:-3}"
+
 services:
   rocketmq-namesrv:
     image: apache/rocketmq:5.3.1
     restart: unless-stopped
     command: sh mqnamesrv
+    logging: *bounded-logging
     networks: [infra-network]
 
   rocketmq-broker:
@@ -17,6 +24,7 @@ services:
       - ./rocketmq:/config:ro
       - ${ROCKETMQ_DATA_DIR:-/data/firstleg/rocketmq/store}:/home/rocketmq/store
     command: sh /config/render-broker-config.sh
+    logging: *bounded-logging
     networks: [infra-network]
 
   rocketmq-topic-init:
@@ -46,6 +54,7 @@ services:
       -t "%DLQ%$${MQ_TOPIC_PREFIX}baiyue-audit-consumer-v1" -r 1 -w 1 -p 6'
     # Broker 注册较慢或任一初始化命令失败时整组重试；所有命令均幂等。
     restart: on-failure
+    logging: *bounded-logging
     networks: [infra-network]
 
 networks:
diff --git a/docker-compose-infra.yml b/docker-compose-infra.yml
index bc83b8b6e..52cddb8f0 100644
--- a/docker-compose-infra.yml
+++ b/docker-compose-infra.yml
@@ -1,5 +1,11 @@
 name: firstleg-test-infra
 
+x-bounded-logging: &bounded-logging
+  driver: local
+  options:
+    max-size: ${DOCKER_LOG_MAX_SIZE:-50m}
+    max-file: "${DOCKER_LOG_MAX_FILE:-3}"
+
 services:
   nacos:
     image: docker.m.daocloud.io/nacos/nacos-server:v2.3.2
@@ -22,6 +28,7 @@ services:
       retries: 20
       start_period: 30s
     restart: unless-stopped
+    logging: *bounded-logging
     networks: [baiyue]
 
   mysql:
@@ -46,6 +53,7 @@ services:
       retries: 20
       start_period: 30s
     restart: unless-stopped
+    logging: *bounded-logging
     networks: [baiyue]
 
   redis:
@@ -62,6 +70,7 @@ services:
       timeout: 5s
       retries: 10
     restart: unless-stopped
+    logging: *bounded-logging
     networks: [baiyue]
 
 volumes:
diff --git a/scripts/container-logging-contract.test.mjs b/scripts/container-logging-contract.test.mjs
index 440849fa7..a504306b6 100644
--- a/scripts/container-logging-contract.test.mjs
+++ b/scripts/container-logging-contract.test.mjs
@@ -28,6 +28,11 @@ const composeFiles = [
   'deploy/docker-compose.overseas.yml',
 ];
 
+const infrastructureComposeFiles = [
+  ['deploy/docker-compose.rocketmq.yml', 3],
+  ['docker-compose-infra.yml', 3],
+];
+
 test('deployable applications log only to stdout and stderr', () => {
   for (const path of applicationConfigs) {
     const source = readFileSync(path, 'utf8');
@@ -52,3 +57,19 @@ test('runtime image does not prepare an application log directory', () => {
   const dockerfile = readFileSync('deploy/docker/Dockerfile', 'utf8');
   assert.doesNotMatch(dockerfile, /\/app\/logs/);
 });
+
+test('infrastructure containers also use bounded local logs', () => {
+  for (const [path, expectedServiceCount] of infrastructureComposeFiles) {
+    const source = readFileSync(path, 'utf8');
+    assert.match(source, /x-bounded-logging:\s+&bounded-logging/, path);
+    assert.match(source, /driver:\s+local/, path);
+    assert.match(source, /DOCKER_LOG_MAX_SIZE/, path);
+    assert.match(source, /DOCKER_LOG_MAX_FILE/, path);
+    assert.equal(
+      source.match(/logging:\s+\*bounded-logging/g)?.length,
+      expectedServiceCount,
+      path,
+    );
+    assert.doesNotMatch(source, /driver:\s+json-file/, path);
+  }
+});