feat(orion): add Dicfuse warmup, remove isolation-dir, fix event log tailing.

.github/workflows/orion-client-deploy.yml

@@ -181,6 +181,11 @@ jobs:
             sudo chmod +x /home/orion/orion-runner/run.sh
             sudo chmod +x /home/orion/orion-runner/cleanup.sh
 
+            # Grant CAP_DAC_READ_SEARCH file capability so orion can bypass
+            # DAC read/search checks without running as root
+            sudo setcap cap_dac_read_search+ep /home/orion/orion-runner/orion
+            getcap /home/orion/orion-runner/orion
+
             # Update systemd service file if changed
             if [ -f /home/orion/orion-runner/orion-runner.service ]; then
                 cp /home/orion/orion-runner/orion-runner.service /etc/systemd/system/
@@ -285,6 +290,11 @@ jobs:
             sudo chmod +x /home/orion/orion-runner/run.sh
             sudo chmod +x /home/orion/orion-runner/cleanup.sh
 
+            # Grant CAP_DAC_READ_SEARCH file capability so orion can bypass
+            # DAC read/search checks without running as root
+            sudo setcap cap_dac_read_search+ep /home/orion/orion-runner/orion
+            getcap /home/orion/orion-runner/orion
+
             # Update systemd service file if changed
             if [ -f /home/orion/orion-runner/orion-runner.service ]; then
                 sudo cp /home/orion/orion-runner/orion-runner.service /etc/systemd/system/

orion/Cargo.toml

@@ -12,7 +12,7 @@ path = "src/main.rs"
 api-model = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "fs", "process"] }
 tracing = { workspace = true }
-tracing-subscriber = { workspace = true }
+tracing-subscriber = { workspace = true, features = ["env-filter"] }
 serde = { workspace = true, features = ["derive", "rc"] }
 futures-util = { workspace = true }
 once_cell = { workspace = true }
@@ -30,7 +30,5 @@ td_util_buck = { path = "./buck" }
 thiserror = { workspace = true }
 utoipa.workspace = true
 common = { path = "../common" }
-ring = "0.17.14"
-hex = { workspace = true }
-scorpiofs = "0.2.0"
+scorpiofs = "0.2.1"
 tokio-util = { workspace = true }

orion/buck/run.rs

@@ -32,42 +32,28 @@ pub struct Buck2 {
     program: String,
     /// The result of running `root`, if we have done so yet.
     root: Option<PathBuf>,
-    /// The isolation directory to always use when invoking buck
-    isolation_dir: Option<String>,
 }
 
 impl Buck2 {
     pub fn new(program: String, root: PathBuf) -> Self {
         Self {
             program,
             root: Some(root),
-            isolation_dir: None,
         }
     }
 
     pub fn with_root(program: String, root: PathBuf) -> Self {
         Self {
             program,
             root: Some(root),
-            isolation_dir: None,
         }
     }
 
-    pub fn set_isolation_dir(&mut self, isolation_dir: String) {
-        self.isolation_dir = Some(isolation_dir);
-    }
-
     pub fn command(&self) -> Command {
         let mut command = Command::new(&self.program);
         command
             .env("BUCKD_STARTUP_TIMEOUT", "30")
             .env("BUCKD_STARTUP_INIT_TIMEOUT", "1200");
-        match &self.isolation_dir {
-            None => {}
-            Some(isolation_dir) => {
-                command.args(["--isolation-dir", isolation_dir]);
-            }
-        }
         command
     }
 

orion/scorpio.toml

@@ -8,22 +8,22 @@
 # ==============================================================================
 
 # Mega 服务地址（本地 mono 服务）
-base_url = "https://git.buck2hub.com"
-lfs_url = "https://git.buck2hub.com"
+base_url = "https://git.gitmega.com"
+lfs_url = "https://git.gitmega.com"
 
 # Dicfuse 数据存储
 store_path = "/tmp/megadir/store"
 
 # Scorpio daemon 主挂载点（orion 不再启动 scorpio daemon，但 scorpiofs 仍需此配置）
 workspace = "/tmp/megadir/mount"
-
+config_file = "./config.toml"
 # Git 提交信息
 git_author = "MEGA"
 git_email = "admin@mega.org"
 
 # Dicfuse 读取配置
 dicfuse_readable = "true"
-load_dir_depth = "3"
+load_dir_depth = "5"
 fetch_file_thread = "10"
 dicfuse_import_concurrency = "4"
 dicfuse_dir_sync_ttl_secs = "5"

orion/src/antares.rs

@@ -3,7 +3,7 @@
 //! This module provides a singleton wrapper around `scorpiofs::AntaresManager`
 //! for managing overlay filesystem mounts used during build operations.
 
-use std::{error::Error, io, path::PathBuf, sync::Arc};
+use std::{error::Error, io, path::PathBuf, sync::Arc, time::Duration};
 
 use scorpiofs::{AntaresConfig, AntaresManager, AntaresPaths};
 use tokio::sync::OnceCell;
@@ -120,13 +120,54 @@ pub async fn mount_job(job_id: &str, cl: Option<&str>) -> Result<AntaresConfig,
         .map_err(Into::into)
 }
 
+/// Initialize Antares during Orion startup and eagerly trigger Dicfuse import.
+///
+/// This keeps the first build request from paying the full Dicfuse cold-start
+/// cost. Readiness waiting runs in the background so Orion can continue booting.
+#[allow(dead_code)] // Called from the bin target (main.rs), not visible to lib check.
+pub(crate) async fn warmup_dicfuse() -> Result<(), DynError> {
+    tracing::info!("Initializing Antares Dicfuse during Orion startup");
+    let manager = get_manager().await?;
+    let dicfuse = manager.dicfuse();
+
+    // Idempotent: safe even if the manager already started import internally.
+    dicfuse.start_import();
+
+    tokio::spawn(async move {
+        let warmup_timeout_secs: u64 = std::env::var("ORION_DICFUSE_WARMUP_TIMEOUT_SECS")
+            .ok()
+            .and_then(|v| v.parse().ok())
+            .unwrap_or(1200);
+        tracing::info!(
+            "Waiting for Antares Dicfuse warmup to finish (timeout: {}s)",
+            warmup_timeout_secs
+        );
+
+        match tokio::time::timeout(
+            Duration::from_secs(warmup_timeout_secs),
+            dicfuse.store.wait_for_ready(),
+        )
+        .await
+        {
+            Ok(_) => tracing::info!("Antares Dicfuse warmup completed"),
+            Err(_) => tracing::warn!(
+                "Antares Dicfuse warmup timed out after {}s",
+                warmup_timeout_secs
+            ),
+        }
+    });
+
+    Ok(())
+}
+
 /// Unmount and cleanup a job overlay filesystem.
 ///
 /// # Arguments
 /// * `job_id` - The job identifier to unmount
 ///
 /// # Returns
 /// The `AntaresConfig` of the unmounted job if it existed.
+#[allow(dead_code)]
 pub async fn unmount_job(job_id: &str) -> Result<Option<AntaresConfig>, DynError> {
     tracing::debug!("Unmounting Antares job: job_id={}", job_id);
     get_manager()