{"id":1867,"date":"2026-08-18T20:14:02","date_gmt":"2026-08-18T12:14:02","guid":{"rendered":"https:\/\/tongchun.website\/index.php\/kimiagent-01-system\/"},"modified":"2026-08-18T20:26:23","modified_gmt":"2026-08-18T12:26:23","slug":"kimiagent-01-system","status":"publish","type":"page","link":"https:\/\/tongchun.website\/index.php\/kimiagent-01-system\/","title":{"rendered":"01-system \u2014 Kimi \u6c99\u7bb1\u7cfb\u7edf\u4e0e\u5bb9\u5668\u5c42\uff1aOS\u3001\u5bb9\u5668\u8fb9\u754c\u3001s6 \u521d\u59cb\u5316\u6811\u3001\u7528\u6237\u6743\u9650\u3001\u8d44\u6e90\u4e0e\u7f51\u7edc"},"content":{"rendered":"\n

\u2190 \u8fd4\u56de\u4e3b\u62a5\u544a\uff1aKimi Agent\uff08\u4e91\u7aef\u6c99\u7bb1\uff09\u6280\u672f\u62a5\u544a<\/a> \uff5c GitHub \u539f\u6587<\/a><\/p>\n\n\n\n

\u5408\u89c4\u4e0e\u98ce\u9669\u58f0\u660e<\/strong>\uff1a\u672c\u62a5\u544a\u4e3a\u5b89\u5168\u7814\u7a76\u4e0e\u4e92\u64cd\u4f5c\u5b66\u4e60\u76ee\u7684\u7684\u9006\u5411\u5206\u6790\uff0c\u5168\u7a0b\u53ea\u8bfb\u91c7\u96c6\uff0c\u672a\u5bf9\u76ee\u6807\u7cfb\u7edf\u505a\u4efb\u4f55\u4fee\u6539\uff1b\u6587\u4e2d\u6240\u6709\u5bc6\u94a5\u3001token\u3001\u8d26\u53f7\u7ea7\u6807\u8bc6\uff08chat_id \/ project_id \/ tenant_id \u7b49\uff09\u5747\u5df2\u8131\u654f\uff1b\u6c99\u7bb1\u5185\u53d1\u73b0\u7684\u9ed8\u8ba4\u5f31\u53e3\u4ee4\uff08VNC\/SSH\uff09\u5c5e\u5e73\u53f0\u4fa7\u914d\u7f6e\uff0c\u4ec5\u4f5c\u5b89\u5168\u53d1\u73b0\u62ab\u9732\uff0c\u8bf7\u52ff\u7528\u4e8e\u8bbf\u95ee\u4efb\u4f55\u4e0d\u5c5e\u4e8e\u81ea\u5df1\u7684\u7cfb\u7edf\u3002docx\/pdf\/xlsx\/kimi-slides \u7b49\u5f15\u64ce\u4e8c\u8fdb\u5236\u4e3a Moonshot \u4e13\u6709\u8bb8\u53ef\uff08\u7981\u518d\u5206\u53d1\/\u9006\u5411\uff09\uff0c\u672c\u6587\u4ec5\u4f5c\u884c\u4e3a\u7ea7\u63cf\u8ff0\u3002\u62a5\u544a\u57fa\u4e8e\u5355\u6b21\u5206\u6790\u7a97\u53e3\uff08\u7ea6 50 \u5206\u949f\u751f\u547d\u5468\u671f\uff09\uff0c\u8f6f\u4ef6\u7248\u672c\u4e0e\u6280\u80fd\u5e93\u5b58\u968f\u955c\u50cf\u66f4\u65b0\u53ef\u80fd\u53d8\u5316\u3002<\/p><\/blockquote>\n\n\n\n

\u91c7\u96c6\u65f6\u95f4\uff1a2026-08-18 08:14\u201309:26 UTC\u3002\u6765\u6e90\uff1aSSH \u53ea\u8bfb\u8bbf\u95ee\uff08kimi \u7528\u6237\uff0cssh -p 12222<\/code>\uff09+ root HTTP \u515c\u5e95\uff08http:\/\/127.0.0.1:18080\/<\u7edd\u5bf9\u8def\u5f84><\/code>\uff09\u3002\u6240\u6709\u8def\u5f84\u5747\u4e3a\u6c99\u7bb1\u5185\u8def\u5f84\u3002 \u6ce8\u610f\uff1a\u6c99\u7bb1\u5728 09:26 UTC \u5de6\u53f3\u88ab\u5e73\u53f0\u56de\u6536\uff08frp \u96a7\u9053 ssh-terminal<\/code> \u79bb\u7ebf\uff0c\u4e09\u6b21\u91cd\u8fde\u5747 Connection refused\uff09\uff0c\u5c11\u91cf\u6536\u5c3e\u9879\u672a\u91c7\u96c6\uff0c\u89c1\u6587\u672b”\u672a\u5b8c\u6210\u7684\u53d6\u8bc1\u7f3a\u53e3”\u3002<\/p>\n\n\n\n

1. OS \u4e0e\u5185\u6838\uff1a\u4e0d\u662f\u666e\u901a\u5bb9\u5668\uff0c\u662f cubevm \u5fae\u865a\u62df\u673a<\/h2>\n\n\n\n
  • \u7528\u6237\u6001\uff1aDebian GNU\/Linux 12 (bookworm)<\/code>\uff08\/etc\/os-release\uff09\u3002<\/li>
  • \u5185\u6838\uff1aLinux 2d9b504a 6.6.69-cube.pvm.guest.005.x-g039db8913c80 #1 SMP PREEMPT_DYNAMIC Thu May 21 23:33:35 CST 2026 x86_64<\/code>\u2014\u2014\u5b9a\u5236 “cube.pvm.guest” \u5185\u6838\uff0c\u660e\u786e\u662f guest \u5185\u6838\u3002<\/li>
  • \u865a\u62df\u5316\u8bc1\u636e\uff1a\n
    • \/sys\/class\/dmi\/id\/sys_vendor<\/code> = Cube Hypervisor<\/code>\uff0cproduct_name<\/code> = cube-hypervisor<\/code>\uff1bsystemd-detect-virt<\/code> = kvm<\/code>\u3002<\/li>
    • \/proc\/cmdline<\/code>\uff1aroot=\/dev\/pmem0 rootflags=dax,errors=remount-ro ro rootfstype=ext4 panic=1 console=hvc0 net.ifnames=0 cubevm ... clocksource=kvm-clock<\/code>\u3002pmem0<\/code>+DAX\u3001hvc0<\/code> virtio-console\u3001cubevm<\/code> \u6807\u8bb0\u3001mitigations=off \u90fd\u662f Firecracker\/Kata \u7c7b microVM \u5178\u578b\u7279\u5f81\u3002<\/li>
    • \u8bbe\u5907\u6587\u4ef6\uff1a\/dev\/pmem0<\/code>\u3001\/dev\/pmem1<\/code>\u3001\/dev\/vda<\/code>~\/dev\/vdd<\/code>\u3001\/dev\/vsock<\/code>\u3001\/dev\/cubemsg0<\/code>\uff08\u5bbf\u4e3b\u901a\u4fe1\u5b57\u7b26\u8bbe\u5907\uff09\u3001\/dev\/ndctl0\/1<\/code>\u3001\/dev\/hvc0-7<\/code>\u3002\u6ca1\u6709 \/dev\/kvm<\/code>\uff08guest \u5185\u4e0d\u53ef\u5d4c\u5957\uff09\u3001\u6ca1\u6709 \/dev\/dri<\/code>\uff08\u65e0 GPU\uff0ckasmvnc \u914d\u7f6e\u91cc gpu.hw3d: false<\/code>\uff09\u3002<\/li><\/ul><\/li>
    • \u7ed3\u8bba\uff1a\u6240\u8c13”\u6c99\u7bb1\u5bb9\u5668”= Moonshot \u81ea\u7814 cubevm microVM\uff08\u817e\u8baf\u4e91\u57fa\u7840\u8bbe\u65bd\uff0c\u89c1\u7f51\u7edc\u8282\uff09\u91cc\u518d\u8dd1\u4e00\u5c42\u5bb9\u5668\u3002\u5bb9\u5668\u8fb9\u754c\u5728 VM \u4e4b\u5185\u3002<\/li><\/ul>\n\n\n\n

      2. \u5bb9\u5668\u8fb9\u754c\uff1acgroup v1 + overlay2\uff0c\u975e Docker \u6807\u51c6\u8fd0\u884c\u65f6<\/h2>\n\n\n\n
      • \/.dockerenv<\/code>\u3001\/run\/.containerenv<\/code> \u5747\u4e0d\u5b58\u5728\u3002<\/li>
      • \/proc\/1\/cgroup<\/code> \u4e3a cgroup v1<\/strong>\uff0812 \u4e2a\u63a7\u5236\u5668\u5355\u72ec\u6302\u8f7d\u5230 \/sys\/fs\/cgroup\/<ctl><\/code>\uff09\uff0c\u5404\u63a7\u5236\u5668\u8def\u5f84\u4e3a \/default\/<container-id><\/code>\uff1a<\/li><\/ul>\n\n\n\n

        2d9b504a104a439f9374a6374a236fa7<\/code>\uff08memory\/cpu\/cpuacct\/devices\/freezer\/net_cls\/net_prio \u6709\u5bb9\u5668\u7ea7\u5b50\u7ec4\uff1bpids\/cpuset\/blkio\/hugetlb\/perf_event \u5728\u6839 \/<\/code>\uff09\u3002<\/p>\n\n\n\n

        • \u6839\u6587\u4ef6\u7cfb\u7edf\u662f overlay2<\/strong>\uff1a61 \u4e2a lower \u5c42 \/run\/blk-cube\/vdc\/0..60<\/code>\uff0cupperdir=\/run\/blk-cube\/vda\/disk\/<container-id>\/upper<\/code>\u2014\u2014\u955c\u50cf\u5c42\u653e\u5728\u72ec\u7acb\u5757\u8bbe\u5907 vdc\u3001\u53ef\u5199\u5c42\u5728 vda\uff0c\u7531\u5bbf\u4e3b\u7684 blk-cube \u673a\u5236\u70ed\u6302\u8fdb VM\u3002<\/li>
        • tmpfs \u8986\u76d6 \/etc\/hosts<\/code>\u3001\/etc\/resolv.conf<\/code>\u3001\/etc\/hostname<\/code>\uff08\u8fd0\u884c\u65f6\u53ef\u5199\u4f46\u4e0d\u5165\u955c\u50cf\uff09\u3002<\/li>
        • \u4e1a\u52a1 FUSE \u6302\u8f7d\uff08proc\/mounts \u6458\u5f55\uff09\uff1a\n
          • portal \/mnt\/portal-overlay fuse.portal ... allow_other<\/code>\uff08\u53ea\u8bfb\u6280\u80fd\/\u63d2\u4ef6 overlay\uff0cclaim \u65f6\u7ed1\u5b9a\uff09<\/li>
          • drive9 \/mnt\/agents fuse.drive9 ... allow_other<\/code>\uff08\u53ef\u5199\u5de5\u4f5c\u533a\uff0c\u8be6\u89c1 03-storage\uff09<\/li><\/ul><\/li>
          • \u4e3b\u673a\u540d = \u5bb9\u5668 ID \u524d 8 \u4f4d\uff1a2d9b504a<\/code>\uff1b\/etc\/hosts \u53ea\u6709\u4e00\u884c 127.0.0.1 localhost 2d9b504a<\/code>\u3002<\/li>
          • \u73af\u5883\u6807\u8bc6\u6587\u4ef6\uff1a\/run\/e2b\/.E2B_SANDBOX<\/code>\uff085 \u5b57\u8282\u6807\u8bb0\u6587\u4ef6\uff0cE2B \u517c\u5bb9\u4fe1\u53f7\uff0c\u914d\u5408 envd \u63d0\u4f9b E2B \u534f\u8bae\u547d\u4ee4\u6267\u884c\uff09\u3002<\/li><\/ul>\n\n\n\n

            3. s6 \u521d\u59cb\u5316\u6811\u4e0e\u5bb9\u5668\u5b8c\u6574\u751f\u547d\u5468\u671f<\/h2>\n\n\n\n

            3.1 \u5f15\u5bfc\u94fe\uff08\/init \u2192 PID1\uff09<\/h3>\n\n\n\n

            \/init<\/code> \u662f s6-overlay v3.1.6.2<\/strong> \u6807\u51c6\u5165\u53e3\uff081012 \u5b57\u8282 shell\uff09\uff1a\u81ea\u4e3e PATH\uff08\/command\u3001\/bin\u3001\/usr\/bin\uff09\u540e exec s6-overlay-suexec preinit \u2192 \/package\/admin\/s6-overlay-3.1.6.2\/libexec\/stage0<\/code>\u3002 stage0 \u8c03 s6-linux-init-maker<\/code> \u751f\u6210 basedir \/run\/s6\/basedir<\/code>\uff0c\u6700\u7ec8 exec \u51fa PID1\uff1a<\/p>\n\n\n\n

            PID 1: \/package\/admin\/s6\/command\/s6-svscan -d4 -- \/run\/service<\/code><\/pre>\n\n\n\n
            s6 \u5957\u4ef6\u5168\u90e8\u9759\u6001\u5b89\u88c5\u5728 \/package\/admin\/<\/code>\uff1aexecline-2.9.4.0\u3001s6-2.12.0.2\u3001s6-linux-init-1.1.2.0\u3001s6-overlay-3.1.6.2\u3001s6-rc-0.5.4.2 \u7b49\u3002 \u5173\u673a\u7531\u5e38\u9a7b\u7684 s6-linux-init-shutdownd -d3 -c \/run\/s6\/basedir -g 3000 -C -B<\/code> \u63a5\u7ba1\uff083 \u79d2 kill \u5bbd\u9650\uff09\u3002<\/p>\n\n\n\n
            3.2 \u670d\u52a1\u76ee\u5f55\u7ed3\u6784<\/h3>\n\n\n\n
            • \u670d\u52a1\u6e90\u5b9a\u4e49<\/strong>\u5728 \/etc\/s6-overlay\/s6-rc.d\/<\/code>\uff08\u7f16\u8bd1\u8fdb\u955c\u50cf\uff09\uff1b\u8fd0\u884c\u65f6\u7f16\u8bd1\u7ed3\u679c\u5728 \/run\/s6-rc\/servicedirs\/<\/code>\uff0c\/run\/service\/<\/code> \u4e0b\u4ee5\u7b26\u53f7\u94fe\u63a5\u6302\u5165\u626b\u63cf\u76ee\u5f55\u3002<\/li>
            • bundle user<\/code>\uff08s6-overlay \u9ed8\u8ba4\u542f\u52a8\u76ee\u6807\uff09\u7684 contents\uff1abrowser-guard\u3001envd\u3001kasmvnc\u3001kernel-server\u3001portal\u3001socat\u3001sshd<\/code>\u3002user2<\/code> bundle \u4e3a\u7a7a\u3002\u5404\u670d\u52a1\u5747\u65e0 dependencies.d\uff08\u9664 browser-guard \u5728\u811a\u672c\u5185\u7528 s6-svwait -u \/run\/service\/kasmvnc<\/code> \u505a\u663e\u793a\u5c31\u7eea\u7b49\u5f85\uff09\u3002<\/li>
            • S6_LOGGING=0<\/code>\uff08\u5bb9\u5668\u73af\u5883\uff09\uff0c\u5373 -B<\/code>\uff1a\u65e0 catch-all \u65e5\u5fd7\u5668\uff0c\u5404\u670d\u52a1\u65e5\u5fd7\u76f4\u63a5\u5230\u5bb9\u5668 stdout\/stderr\u3002<\/li>
            • \u955c\u50cf\u73af\u5883\u53d8\u91cf\u88ab dump \u5230 \/run\/s6\/container_environment\/<\/code>\uff08\u6bcf\u53d8\u91cf\u4e00\u4e2a\u6587\u4ef6\uff09\uff0c\u5404 run \u811a\u672c\u7528 #!\/command\/with-contenv bash<\/code> \u7ee7\u627f\u2014\u2014\u8fd9\u662f\u6c99\u7bb1\u5185\u6240\u6709\u670d\u52a1\u73af\u5883\u53d8\u91cf\u7684\u7edf\u4e00\u6765\u6e90<\/strong>\u3002<\/li><\/ul>\n\n\n\n
              3.3 \u5404\u670d\u52a1 run \u811a\u672c\u8981\u70b9\uff08\u539f\u6587\u5df2\u53d6\u8bc1\uff09<\/h3>\n\n\n\n
              \u670d\u52a1<\/th>\u5173\u952e\u5185\u5bb9<\/th><\/tr><\/thead>
              envd<\/td>exec envd -isnotfc<\/code>\u3002\u811a\u672c\u5185\u4e2d\u6587\u6ce8\u91ca\uff1aAGS \u4e0d\u662f firecracker\uff0c\u65e0 MMDS\uff08169.254.169.254 \u9ed1\u6d1e\uff09\uff0c-isnotfc<\/code> \u8df3\u8fc7 MMDS \u63a2\u6d4b\uff0c\u5426\u5219\u6bcf\u6b21 \/init \u6302\u8d77 ~7s\u2014\u2014\u8fd9\u662f\u9488\u5bf9\u975e firecracker \u540e\u7aef\u7684\u5b9a\u5236\u8865\u4e01<\/strong>\u3002\u63d0\u4f9b E2B \u517c\u5bb9\u547d\u4ee4\u6267\u884c\u901a\u9053\u3002<\/td><\/tr>
              portal<\/td>Go \u4e8c\u8fdb\u5236 \/usr\/local\/bin\/portal -http-bind -allow-other -env prod -gateway-addr https:\/\/kimi-api-sandbox.msh.team\/apiv2 \/mnt\/portal-overlay<\/code>\u3002\u6ce8\u91ca\u8bf4\u660e\uff1a\u542f\u52a8\u65f6\u662f\u7a7a manifest<\/strong>\uff0c\u7b49 kimiwarden \u5728 claim \u65f6 POST \/api\/v1\/bind_token<\/code>\uff08HS256 JWT \u6362 STS\uff09+ POST \/api\/v1\/bind<\/code>\uff08overlay manifest\uff1askills\/plugins\/auth\/vault\uff09\u3002\u542f\u7528\u5f00\u5173 KIMI_PROJECT_PORTAL_CAPABILITY_ENABLED=true<\/code> \u7531 kimiwarden \u6ce8\u5165\u3002<\/td><\/tr>
              kernel-server<\/td>s6-setuidgid kimi python3 \/app\/kernel_server.py --host 0.0.0.0 --port 8888<\/code>\uff0cWORKDIR=${KERNEL_SERVER_WORKDIR:-\/mnt\/agents}<\/code>\uff0c\u6ce8\u5165 DISPLAY=:99<\/code>\u3001HOME=\/home\/kimi<\/code>\uff08\u8be6\u89c1 02-runtime\uff09\u3002<\/td><\/tr>
              kasmvnc<\/td>\u4ee5 root<\/strong> \u8dd1 \/bin\/bash \/root\/setup_kasmvnc.sh<\/code>\uff1a\u751f\u6210 kasmvnc.yaml\u3001vncpasswd\uff08\u660e\u6587 ‘password’\uff09\uff0c\u542f\u52a8 Xvnc :99 -SecurityTypes None -rfbport 5901 -websocketPort 6080 -interface 0.0.0.0<\/code>\uff0c\u7528 snakeoil \u81ea\u7b7e\u8bc1\u4e66\u3002\u811a\u672c\u4e3b\u8fdb\u7a0b\u662f sleep infinity<\/code>\uff0cXvnc\uff08PID 155\uff09\u5b9e\u4e3a\u5b64\u513f\u6302\u5728 PID1 \u4e0b\u3002<\/td><\/tr>
              browser-guard<\/td>s6-svwait<\/code> \u7b49 kasmvnc \u2192 s6-setuidgid kimi python3 \/app\/browser_guard.py --wait-display --display :99 --timeout 60 --monitor<\/code>\u3002\u5b83\u62c9\u8d77 Chromium 151\uff08--remote-debugging-port=9222 --remote-debugging-address=0.0.0.0 --no-sandbox --disable-blink-features=AutomationControlled --user-data-dir=\/tmp\/chromium_user_data<\/code>\uff0c\u52a0\u8f7d \/app\/pdf-viewer \u6269\u5c55\uff0cJS heap \u9650 512MB\uff09\u3002<\/td><\/tr>
              socat<\/td>execline \u5355\u884c\uff1apython3 \/opt\/moonbox-project-template\/bin\/project-cdp-proxy.py<\/code>\u2014\u2014CDP \u4ee3\u7406\uff0c\u540d\u5b57\u7559\u81ea\u65e7\u67b6\u6784\u3002<\/td><\/tr>
              sshd<\/td>exec \/usr\/sbin\/sshd -D -e<\/code>\uff0c\u65e0\u81ea\u5b9a\u4e49\u914d\u7f6e\u76ee\u5f55\uff08sshd_config.d \u4e3a\u7a7a\uff09\u3002<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
              3.4 claim \u65f6\u6ce8\u5165\u7684\u7b2c\u4e8c\u6279\u670d\u52a1\uff08\u751f\u547d\u5468\u671f\u5173\u952e\u89c2\u5bdf\uff09<\/h3>\n\n\n\n
              \u8fdb\u7a0b\u6811\u65f6\u95f4\u6233\u663e\u793a\uff1aboot \u4e8e 08:36\uff08s6 \u5168\u5bb6\u6876\u62c9\u8d77\uff09\uff0c\u800c drive9-fuse<\/code>\u3001drive9-fuse-watchdog<\/code> \u4e24\u4e2a\u670d\u52a1\u7684 supervise \u76ee\u5f55\u521b\u5efa\u4e8e 08:43<\/strong>\u2014\u2014\u5b83\u4eec\u4e0d\u662f\u955c\u50cf s6-rc \u6e90\uff0c\u800c\u662f\u5728\u6c99\u7bb1\u88ab claim\uff08\u7ed1\u5b9a\u5177\u4f53\u9879\u76ee\uff09\u65f6\u7531\u5916\u90e8\u63a7\u5236\u9762\u76f4\u63a5\u5199\u8fdb \/run\/service\/<\/code> \u7684<\/strong>\uff1a<\/p>\n\n\n\n
              • \/run\/service\/drive9-fuse\/run<\/code>\uff1a\u91cd\u542f\u524d\u5148 fusermount3 -uz<\/code> \u6e05\u6b8b\u7559\u6b7b\u6302\u8f7d\uff08\u5e26\u9632\u8bef\u5220\u6821\u9a8c\uff09\uff0csource \u73af\u5883\u6587\u4ef6\u540e<\/li><\/ul>\n\n\n\n
                  exec drive9 mount --foreground --mode=fuse -allow-other --server http:\/\/10.213.5.144 --profile kimi-project --durability close-sync :\/projects\/<\u9879\u76eeUUID> \/mnt\/agents<\/code>\uff0c\u65e5\u5fd7\u5230 \/tmp\/kimi-project-drive9.log<\/code>\uff0c\u81ea\u5e26 2 \u79d2\u9632\u6296\u52a8\u91cd\u542f\u9650\u901f\u3002<\/p>\n\n\n\n
                • \/run\/service\/drive9-fuse-watchdog\/run<\/code>\uff1a\u6bcf 15s \u63a2\u6d3b\uff08stat \/mnt\/agents\/.<\/code> + ls .drive9-health<\/code> \u5c0f\u76ee\u5f55\uff0c\u907f\u514d\u5927\u76ee\u5f55 readdir \u89e6\u53d1\u9884\u53d6\uff09\uff0c\u8fde\u7eed 3 \u6b21\u5931\u8d25 pkill -9 -x drive9<\/code> \u4ea4\u7ed9 s6 \u91cd\u542f\uff0c\u65e5\u5fd7\u5199\u540c\u4e00\u6587\u4ef6\u3002<\/li>
                • \u540c\u65f6\u521b\u5efa\u7684\u8fd8\u6709 \/run\/kimi-project\/preview.json<\/code>\uff08root:kimi 0440\uff0cclaim \u5143\u6570\u636e\uff09\u548c\u4e24\u4e2a root \u8c03\u8bd5 http.server\uff0818080 \u66b4\u9732 \/tmp\/project-probe<\/code>\u300118082 \u7ed1 127.0.0.1\u2014\u2014\u7591\u4e3a\u63a7\u5236\u9762\u63a2\u9488\uff09\u3002<\/li><\/ul>\n\n\n\n
                  \u5b8c\u6574\u751f\u547d\u5468\u671f<\/strong>\uff1acubevm \u5fae VM \u542f\u52a8\uff08pmem0 DAX rootfs\uff09\u2192 \u5bb9\u5668\u5c42 overlay2 \u7ec4\u88c5 \u2192 \/init(s6-overlay) \u2192 s6-svscan \u2192 s6-rc \u7f16\u8bd1\u5e76\u62c9\u8d77 7 \u4e2a\u57fa\u7840\u670d\u52a1\uff08envd\/portal\/sshd\/kasmvnc\/kernel-server\/browser-guard\/socat\uff09\u2192 \u6c99\u7bb1\u8fdb\u5165\u7a7a\u95f2\u6c60 \u2192 \u7528\u6237\u4f1a\u8bdd claim\uff1akimiwarden \u901a\u8fc7 portal 8080 \u4e0b\u53d1 bind_token+manifest\uff08skills overlay \u6302\u4e0a\uff09\uff0c\u540c\u65f6\u628a\u9879\u76ee\u7ea7 drive9-fuse + watchdog \u670d\u52a1\u6ce8\u5165 \/run\/service\uff08\u5de5\u4f5c\u533a\u6302\u4e0a\uff09\u2192 \u4f1a\u8bdd\u7ed3\u675f\u6c99\u7bb1\u56de\u6536\uff08\u672c\u6b21\u5b9e\u6d4b\u5b58\u6d3b\u7ea6 50 \u5206\u949f\uff0c09:26 UTC \u88ab\u56de\u6536\uff09\u3002<\/p>\n\n\n\n
                  4. \u7528\u6237\u4e0e\u6743\u9650\u6a21\u578b<\/h2>\n\n\n\n
                  • \u7528\u6237\uff1akimi:x:999:995::\/home\/kimi:\/bin\/bash<\/code>\uff0c\u4ec5\u5c5e\u81ea\u5df1\u7684\u7ec4\uff1broot \u6b63\u5e38\u5b58\u5728\uff1b\u53e6\u6709 Debian \u5e38\u89c4\u7cfb\u7edf\u7528\u6237\uff08systemd-*\u3001avahi\u3001polkitd \u7b49\uff0c\u6765\u81ea\u955c\u50cf\u9884\u88c5\u5305\uff09\u3002kimi \u4e0d\u5728 sudo \u7ec4<\/strong>\u3002<\/li>
                  • sudo\uff1a\/etc\/sudoers<\/code> \u662f Debian \u539f\u7248\uff08root + %sudo ALL\uff09\uff0csudoers.d \u53ea\u6709 README\uff1bsudo -n true<\/code> \u5b9e\u6d4b a password is required<\/code>\u2014\u2014kimi \u65e0\u514d\u5bc6 sudo\uff0c\u4e8b\u5b9e\u4e0a\u4e5f\u65e0\u6cd5 sudo\uff08\u5bc6\u7801\u672a\u8bbe\u7f6e\uff09<\/strong>\u3002<\/li>
                  • \/etc\/shadow\uff08\u7ecf 18080 root \u901a\u9053\u8bfb\u53d6\uff0c\u5df2\u8131\u654f\uff09\uff1aroot<\/code> \u6709 yescrypt \u54c8\u5e0c\uff08$y$j9T$KQhGRcPm...<\/code>\uff0c\u4ec5\u8bb0\u524d 8 \u4f4d\uff09\uff1bkimi:!<\/code>\uff08\u9501\u5b9a\uff0c\u65e0\u5bc6\u7801\uff09\u3002\u5176\u4f59\u7cfb\u7edf\u8d26\u6237\u5168\u9501\u3002<\/li>
                  • SSH\uff1aAllowUsers kimi<\/code>\uff08\u767d\u540d\u5355\u53ea\u653e\u884c kimi\uff0cPermitRootLogin yes \u88ab\u5176\u67b6\u7a7a\uff09\uff0cPubkeyAuthentication + PasswordAuthentication \u53cc\u5f00\uff0csshd_config \u91cc SetEnv<\/code> \u7ed9 SSH \u4f1a\u8bdd\u6ce8\u5165 npm \u955c\u50cf NPM_CONFIG_REGISTRY=https:\/\/npm.mirrors.msh.team\/<\/code> \u548c\u4e00\u6761\u628a\u5404 skills \u6a21\u677f node_modules\/.bin<\/code> \u585e\u8fdb\u524d\u9762\u7684\u5b9a\u5236 PATH\u3002<\/li>
                  • \u63d0\u6743\u8f85\u52a9\uff1a\u4e0d\u5b58\u5728 \/etc\/s6\/sudod<\/code> \u89c4\u5219\u76ee\u5f55\uff1bs6-sudod \u4ec5\u4ee5 s6rc-oneshot-runner<\/code> \u7684 IPC socket \u5f62\u5f0f\u5b58\u5728\uff08\/run\/s6-rc\/servicedirs\/s6rc-oneshot-runner<\/code>\uff0c\u7528\u4e8e root \u8dd1 oneshot\uff09\uff0c\u4e0e\u4e1a\u52a1\u65e0\u5173\u3002<\/li>
                  • \u6743\u9650\u5206\u5de5\u603b\u89c8\uff1aroot \u6301\u6709\u57fa\u7840\u8bbe\u65bd<\/strong>\uff08s6\u3001portal\u3001drive9\u3001Xvnc\u3001sshd\u3001envd\uff09\uff1bkimi \u6301\u6709\u7528\u6237\u8d1f\u8f7d<\/strong>\uff08kernel-server\u3001browser-guard\u3001Chromium\u3001ipykernel\uff09\u3002\u5de5\u4f5c\u533a \/mnt\/agents<\/code> \u7531 kernel-server run \u811a\u672c chown -R kimi:kimi<\/code>\u3002<\/li><\/ul>\n\n\n\n
                    5. \u8d44\u6e90\u9650\u5236\uff08cgroup v1 \u5b9e\u6d4b\u503c\uff09<\/h2>\n\n\n\n
                    \u7ef4\u5ea6<\/th>\u9650\u5236<\/th>\u8bc1\u636e<\/th><\/tr><\/thead>
                    \u5185\u5b58<\/td>4 GiB<\/strong> \u786c\u9650\uff084294967296 B\uff09\uff0c\u65e0 swap<\/td>\/sys\/fs\/cgroup\/memory\/memory.limit_in_bytes<\/code>\uff1bfree -h\uff1atotal 3.9Gi\u3001\u91c7\u96c6\u65f6\u5df2\u7528 1.5Gi\u3001buff\/cache 2.2Gi<\/td><\/tr>
                    CPU<\/td>\u914d\u989d 2 \u6838<\/strong>\uff08cfs_quota 200000\/100000\uff09\uff0c\u53ef\u89c1 3 \u4e2a\u903b\u8f91\u6838<\/td>nproc=3\uff1b\/sys\/fs\/cgroup\/cpu\/cpu.cfs_*<\/td><\/tr>
                    \u78c1\u76d8<\/td>overlay \u6839 41G\uff08\u53ef\u7528 39G\uff09\uff1b\/dev\/shm \u4ec5 64M\uff1b\/mnt\/agents \u663e\u793a 1.0T\uff08\u8fdc\u7aef\u914d\u989d\uff09<\/td>df -h<\/td><\/tr>
                    \u8fdb\u7a0b\u6570<\/td>nproc ulimit 16152\uff1bpids \u63a7\u5236\u5668\u672a\u6309\u5bb9\u5668\u6302\u8f7d\uff08\u65e0 pids.max \u53ef\u8bfb\uff09<\/td>ulimit -u<\/td><\/tr>
                    \u6587\u4ef6\u53e5\u67c4<\/td>nofile 1024<\/strong>\uff08\u504f\u5c0f\uff0c\u9ad8\u5e76\u53d1 FD \u578b\u8d1f\u8f7d\u662f\u6f5c\u5728\u74f6\u9888\uff09<\/td>ulimit -n<\/td><\/tr>
                    \u5176\u4ed6<\/td>core=0\u3001stack 8M\u3001locked memory 8M<\/td>ulimit -a\uff1b\/etc\/security\/limits.conf \u4e3a\u7a7a<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                    6. \u7f51\u7edc<\/h2>\n\n\n\n
                    • \u63a5\u53e3\uff08\/proc\/net\/dev\uff09\uff1alo<\/code>\u3001eth0<\/code>\u3001dummy0<\/code>\u3001sit0<\/code>\uff08dummy0\/sit0 \u65e0\u6d41\u91cf\uff0c\u4e3a\u5185\u6838\u9ed8\u8ba4\u6b8b\u7559\uff09\u3002<\/li>
                    • \u7f16\u5740\uff08\/proc\/net\/route \u89e3\u7801\uff09\uff1aeth0 \u4e3a 169.254.68.4\/30 \u94fe\u8def\u672c\u5730\u6bb5<\/strong>\uff0c\u9ed8\u8ba4\u7f51\u5173 169.254.68.5<\/code>\u2014\u2014\u5bbf\u4e3b\u4fa7 NAT\uff0c\u6c99\u7bb1\u65e0\u771f\u5b9e\u5185\u7f51\u5730\u5740\u3002<\/li>
                    • DNS\uff1a\/etc\/resolv.conf<\/code>\uff08tmpfs\uff0c”Generated by NetworkManager”\uff09\u6307\u5411 183.60.83.19<\/code>\u3001183.60.82.98<\/code>\uff08\u817e\u8baf DNSPod \u516c\u5171 DNS\uff09\u3002<\/li>
                    • \u51fa\u7ad9\uff1a\u53ef\u76f4\u8fde\u516c\u7f51\uff0c\u672a\u505a egress \u8fc7\u6ee4<\/strong>\u3002\u5b9e\u6d4b https:\/\/www.baidu.com<\/code> 200\u3001https:\/\/github.com<\/code> 200\uff1b\u51fa\u53e3\u516c\u7f51 IP 43.153.86.66<\/code>\uff08\u817e\u8baf\u4e91\uff09\u3002SCF_POD_ID<\/code> \u73af\u5883\u53d8\u91cf\u8fdb\u4e00\u6b65\u6307\u5411\u817e\u8baf\u4e91 SCF\/\u4e91\u51fd\u6570\u5bbf\u4e3b\u3002<\/li>
                    • \u5185\u7f51\u4f9d\u8d56\uff1adrive9 \u5b58\u50a8\u670d\u52a1\u7aef http:\/\/10.213.5.144<\/code>\uff1bportal \u7f51\u5173 https:\/\/kimi-api-sandbox.msh.team\/apiv2<\/code>\uff1bpip\/npm \u8d70 *.mirrors.msh.team<\/code> \u5185\u7f51\u955c\u50cf\u3002<\/li>
                    • \u955c\u50cf\u7cbe\u7b80\u5230\u6ca1\u6709 ip\u3001iptables\u3001ss \u547d\u4ee4<\/strong>\uff08\u7f51\u7edc\u5de5\u5177\u4e0d\u9884\u88c5\uff0c\u8bca\u65ad\u53ea\u80fd\u9760 \/proc\uff09\u3002<\/li>
                    • \u5bf9\u5916\u66b4\u9732\u94fe\u8def\uff1asshd(22)\/CDP(9222)\/VNC(5901\/6080)\/portal(8080)\/kernel(8888) \u76d1\u542c\u5728\u5bb9\u5668 eth0\uff0c\u7531\u6c99\u7bb1\u5185 frpc \u53cd\u5411\u8fde\u5230\u6211\u4eec\u7684 frps\uff08127.0.0.1:12222 \u7b49\u7aef\u53e3\uff09\u2014\u2014\u6c99\u7bb1\u672c\u8eab\u65e0\u5165\u7ad9 NAT \u89c4\u5219\u3002<\/li><\/ul>\n\n\n\n
                      7. \u65f6\u533a\u4e0e\u73af\u5883\u53d8\u91cf\u6765\u6e90<\/h2>\n\n\n\n
                      • \u7cfb\u7edf\u65f6\u949f\/\u65f6\u533a\uff1a\/etc\/localtime \u2192 Etc\/UTC<\/code>\u3001\/etc\/timezone=Etc\/UTC<\/code>\uff0cdate \u8f93\u51fa UTC\u3002TZ=Asia\/Shanghai<\/code> \u53ea\u5b58\u5728\u4e8e\u5bb9\u5668\u73af\u5883\u53d8\u91cf\uff08cubevm \u5e73\u53f0\u6ce8\u5165\uff09\uff0c\u4e0d\u6539\u7cfb\u7edf\u65f6\u533a\u2014\u2014\u4e1a\u52a1\u8fdb\u7a0b\u89c1\u4e0a\u6d77\u65f6\u533a\uff0c\u7cfb\u7edf\u65e5\u5fd7\u89c1 UTC<\/strong>\u3002<\/li>
                      • \u73af\u5883\u53d8\u91cf\u4e09\u7ea7\u6765\u6e90\uff1a<\/li><\/ul>\n\n\n\n
                        1. \u5e73\u53f0\u6ce8\u5165<\/strong>\uff08cubevm\/\u63a7\u5236\u9762 \u2192 \/run\/s6\/container_environment \u2192 with-contenv \u2192 \u6240\u6709 s6 \u670d\u52a1\uff09\uff1aCUBE_CONTAINER_ID_SANDBOX\/MONITOR_SIDECAR<\/code>\u3001SCF_POD_ID<\/code>\u3001KIMI_PROJECT_PORTAL_CAPABILITY_*<\/code>\u3001MOONBOX_BASE_IMAGE=msh-sandbox.tencentcloudcr.com\/kimiclaw\/moonbox-okc:project-20260811-2<\/code>\u3001SSH_PASSWORD<\/code>\u3001VNC_PASSWORD<\/code> \u7b49\u3002<\/li>
                        2. sshd SetEnv<\/strong>\uff1aSSH \u4f1a\u8bdd\u4e13\u5c5e\uff08npm \u955c\u50cf\u3001\u542b skills \u6a21\u677f bin \u7684 PATH\uff09\u3002\u6ce8\u610f SSH \u4f1a\u8bdd\u7684 PATH \u4e0e s6 \u670d\u52a1\u7684 PATH\uff08\/command \u5f00\u5934\uff09\u4e0d\u540c\u3002<\/li>
                        3. \u670d\u52a1 run \u811a\u672c\u5185 export<\/strong>\uff1a\u5982 kernel-server\/browser-guard \u7684 DISPLAY\u3001HOME\u3001XAUTHORITY\u3002<\/li><\/ol>\n\n\n\n