适用系统Kylin Linux Advanced Server V10 (Tercel) / SP1硬件要求CPU ≥ 2核内存 ≥ 4GiB建议 ≥ 8GiB网络要求可访问华为云镜像代理内网/隔离环境见文末离线方案一、前置环境检查在终端执行以下命令确认系统环境echo 系统版本 cat/etc/os-releaseecho CPU 核心数 nprocecho 内存 free-hecho 磁盘空间 df-h/echo SELinux 状态 getenforceecho 防火墙状态 systemctl status firewalld --no-pagerecho Git 版本 git--versionecho 端口占用 ss-tlnp|grep-E:80|:443|:5001|:5003|:5432|:6379||echo✅ 目标端口暂无占用检查标准检查项通过标准未通过处理CPU 2 核升级硬件内存 4 GiB建议至少 8 GiB磁盘剩余 10G清理磁盘SELinuxPermissive 或 Disabled见下文防火墙运行中即可后续放行端口端口 80/443未被占用停用占用程序SELinux 处理如为 Enforcingsetenforce0sed-is/^SELINUXenforcing/SELINUXpermissive//etc/selinux/config二、防火墙端口放行Dify 默认使用以下端口需提前放行firewall-cmd--permanent--add-port80/tcp firewall-cmd--permanent--add-port443/tcp firewall-cmd--permanent--add-port5001/tcp firewall-cmd--permanent--add-port5003/tcp firewall-cmd--permanent--add-port5432/tcp firewall-cmd--permanent--add-port6379/tcp firewall-cmd--reloadfirewall-cmd --list-ports三、安装 Docker二进制方式⚠️为什么用二进制安装Kylin V10 SP1 的 glibc 版本为 2.28Docker 官方最新 RPM29.x要求 glibc 2.34直接安装会报依赖错误。经实测使用Docker 24.0.9 静态二进制包可完美兼容。3.1 清理旧版本如有systemctl stopdocker2/dev/nullrm-f/usr/bin/docker*rm-f/usr/bin/containerd*rm-f/usr/bin/ctrrm-f/usr/bin/runcrm-f/etc/yum.repos.d/docker-ce.reporm-f/etc/yum.repos.d/CentOS-Base.repo yum clean all3.2 下载并安装 Docker 24.0.9cd/tmpcurl-L-k-odocker-24.0.9.tgz https://mirrors.aliyun.com/docker-ce/linux/static/stable/x86_64/docker-24.0.9.tgztar-zxvfdocker-24.0.9.tgzcpdocker/* /usr/bin/3.3 创建 systemd 服务文件cat/usr/lib/systemd/system/docker.serviceEOF [Unit] DescriptionDocker Application Container Engine Documentationhttps://docs.docker.com Afternetwork-online.target firewalld.service Wantsnetwork-online.target [Service] Typenotify ExecStart/usr/bin/dockerd ExecReload/bin/kill -s HUP $MAINPID LimitNOFILEinfinity LimitNPROCinfinity TimeoutStartSec0 Delegateyes KillModeprocess Restarton-failure StartLimitBurst3 StartLimitInterval60s [Install] WantedBymulti-user.target EOF3.4 启动 Docker 并验证systemctl daemon-reload systemctl startdockersystemctlenabledockerecho Docker 版本 docker--versionecho Containerd 版本 containerd--version预期输出Docker version 24.0.9, build 2936816containerd github.com/containerd/containerd v1.7.13 ...四、安装 Docker Compose V2 插件Dify 要求 Docker Compose 2.24.0。mkdir-p/usr/libexec/docker/cli-pluginscurl-Lhttps://github.com/docker/compose/releases/download/v2.27.0/docker-compose-linux-x86_64-o/usr/libexec/docker/cli-plugins/docker-composechmodx /usr/libexec/docker/cli-plugins/docker-compose# 验证dockercompose version预期输出Docker Compose version v2.27.0五、配置 Docker 镜像加速华为云代理国内环境 Docker Hub 直接访问不稳定使用华为云镜像代理swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io可稳定拉取镜像。mkdir-p/etc/dockercat/etc/docker/daemon.jsonEOF { registry-mirrors: [ https://swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io ], log-driver: json-file, log-opts: { max-size: 10m, max-file: 3 } } EOFsystemctl daemon-reload systemctl restartdocker# 验证配置加载dockerinfo|grep-A5Registry Mirrors测试镜像拉取dockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/hello-worlddockerrun--rmswr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/hello-world看到Hello from Docker!即表示 Docker 环境完全就绪。六、部署 Dify6.1 克隆源码cd~gitclone https://github.com/langgenius/dify.gitcddify/docker6.2 复制环境配置cp.env.example .env6.3 修改 docker-compose.yaml替换镜像前缀由于daemon.json的 mirror 重定向对部分镜像不生效需直接修改 compose 文件将所有 Docker Hub 镜像替换为华为云代理路径。sed-is|image: langgenius/|image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/|gdocker-compose.yamlsed-is|image: postgres|image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/postgres|gdocker-compose.yamlsed-is|image: redis|image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/redis|gdocker-compose.yamlsed-is|image: nginx|image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/nginx|gdocker-compose.yamlsed-is|image: semitechnologies/|image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/semitechnologies/|gdocker-compose.yamlsed-is|image: ubuntu/|image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/ubuntu/|gdocker-compose.yamlsed-is|image: busybox|image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/busybox|gdocker-compose.yaml6.4 启动 Difydockercompose up-d预期输出[] Running 15/15 ✔ Network docker_ssrf_proxy_network Created ✔ Network docker_default Created ✔ Container docker-web-1 Started ✔ Container docker-sandbox-1 Started ✔ Container docker-db_postgres-1 Healthy ✔ Container docker-redis-1 Started ✔ Container docker-init_permissions-1 Exited ✔ Container docker-weaviate-1 Started ✔ Container docker-ssrf_proxy-1 Started ✔ Container docker-plugin_daemon-1 Started ✔ Container docker-api_websocket-1 Started ✔ Container docker-api-1 Started ✔ Container docker-worker_beat-1 Started ✔ Container docker-worker-1 Started ✔ Container docker-nginx-1 Started七、部署后验证# 查看容器状态所有应为 Up 或 healthydockercomposeps# 查看异常日志dockercompose logs--tail50|grep-ierror\|fatal# 测试本地访问curl-Ihttp://localhost/install八、访问与初始化部署成功后在浏览器访问http://服务器IP/install首次访问流程设置管理员账号邮箱 密码完成初始化后登录地址为http://服务器IP九、常见问题速查现象原因解决方案nothing provides libc.so.6(GLIBC_2.34)麒麟 glibc 2.28 不兼容 Docker 29.x改用二进制安装 Docker 24.0.9nothing provides container-selinux麒麟源缺少该包二进制安装绕过 RPM 依赖error adding content digest to leaseDocker 与 containerd 版本不匹配重装配套版本24.0.9 1.7.13镜像拉取超时Docker Hub 网络不通使用华为云代理路径直接替换镜像前缀init_permissions拉取失败busybox 镜像未替换补充 sed 替换规则容器反复重启内存不足或数据库未就绪检查docker compose logs十、附录离线部署方案完全无网络环境若服务器完全无外网需在有网络的机器上提前下载镜像# 在有外网的机器上执行dockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-api:1.14.2dockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-web:1.14.2dockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-plugin-daemon:0.6.1-localdockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-sandbox:0.2.15dockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/postgres:15-alpinedockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/redis:6-alpinedockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/nginx:latestdockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/semitechnologies/weaviate:1.27.0dockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/ubuntu/squid:latestdockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/busybox:latest# 导出为 tar 包dockersave-odify-images.tar swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-api:1.14.2 swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-web:1.14.2 swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-plugin-daemon:0.6.1-local swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-sandbox:0.2.15 swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/postgres:15-alpine swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/redis:6-alpine swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/nginx:latest swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/semitechnologies/weaviate:1.27.0 swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/ubuntu/squid:latest swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/busybox:latest# 传到麒麟服务器后导入dockerload-idify-images.tar参考文档Dify 官方文档
适用系统Kylin Linux Advanced Server V10 (Tercel) / SP1硬件要求CPU ≥ 2核内存 ≥ 4GiB建议 ≥ 8GiB网络要求可访问华为云镜像代理内网/隔离环境见文末离线方案一、前置环境检查在终端执行以下命令确认系统环境echo 系统版本 cat/etc/os-releaseecho CPU 核心数 nprocecho 内存 free-hecho 磁盘空间 df-h/echo SELinux 状态 getenforceecho 防火墙状态 systemctl status firewalld --no-pagerecho Git 版本 git--versionecho 端口占用 ss-tlnp|grep-E:80|:443|:5001|:5003|:5432|:6379||echo✅ 目标端口暂无占用检查标准检查项通过标准未通过处理CPU 2 核升级硬件内存 4 GiB建议至少 8 GiB磁盘剩余 10G清理磁盘SELinuxPermissive 或 Disabled见下文防火墙运行中即可后续放行端口端口 80/443未被占用停用占用程序SELinux 处理如为 Enforcingsetenforce0sed-is/^SELINUXenforcing/SELINUXpermissive//etc/selinux/config二、防火墙端口放行Dify 默认使用以下端口需提前放行firewall-cmd--permanent--add-port80/tcp firewall-cmd--permanent--add-port443/tcp firewall-cmd--permanent--add-port5001/tcp firewall-cmd--permanent--add-port5003/tcp firewall-cmd--permanent--add-port5432/tcp firewall-cmd--permanent--add-port6379/tcp firewall-cmd--reloadfirewall-cmd --list-ports三、安装 Docker二进制方式⚠️为什么用二进制安装Kylin V10 SP1 的 glibc 版本为 2.28Docker 官方最新 RPM29.x要求 glibc 2.34直接安装会报依赖错误。经实测使用Docker 24.0.9 静态二进制包可完美兼容。3.1 清理旧版本如有systemctl stopdocker2/dev/nullrm-f/usr/bin/docker*rm-f/usr/bin/containerd*rm-f/usr/bin/ctrrm-f/usr/bin/runcrm-f/etc/yum.repos.d/docker-ce.reporm-f/etc/yum.repos.d/CentOS-Base.repo yum clean all3.2 下载并安装 Docker 24.0.9cd/tmpcurl-L-k-odocker-24.0.9.tgz https://mirrors.aliyun.com/docker-ce/linux/static/stable/x86_64/docker-24.0.9.tgztar-zxvfdocker-24.0.9.tgzcpdocker/* /usr/bin/3.3 创建 systemd 服务文件cat/usr/lib/systemd/system/docker.serviceEOF [Unit] DescriptionDocker Application Container Engine Documentationhttps://docs.docker.com Afternetwork-online.target firewalld.service Wantsnetwork-online.target [Service] Typenotify ExecStart/usr/bin/dockerd ExecReload/bin/kill -s HUP $MAINPID LimitNOFILEinfinity LimitNPROCinfinity TimeoutStartSec0 Delegateyes KillModeprocess Restarton-failure StartLimitBurst3 StartLimitInterval60s [Install] WantedBymulti-user.target EOF3.4 启动 Docker 并验证systemctl daemon-reload systemctl startdockersystemctlenabledockerecho Docker 版本 docker--versionecho Containerd 版本 containerd--version预期输出Docker version 24.0.9, build 2936816containerd github.com/containerd/containerd v1.7.13 ...四、安装 Docker Compose V2 插件Dify 要求 Docker Compose 2.24.0。mkdir-p/usr/libexec/docker/cli-pluginscurl-Lhttps://github.com/docker/compose/releases/download/v2.27.0/docker-compose-linux-x86_64-o/usr/libexec/docker/cli-plugins/docker-composechmodx /usr/libexec/docker/cli-plugins/docker-compose# 验证dockercompose version预期输出Docker Compose version v2.27.0五、配置 Docker 镜像加速华为云代理国内环境 Docker Hub 直接访问不稳定使用华为云镜像代理swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io可稳定拉取镜像。mkdir-p/etc/dockercat/etc/docker/daemon.jsonEOF { registry-mirrors: [ https://swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io ], log-driver: json-file, log-opts: { max-size: 10m, max-file: 3 } } EOFsystemctl daemon-reload systemctl restartdocker# 验证配置加载dockerinfo|grep-A5Registry Mirrors测试镜像拉取dockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/hello-worlddockerrun--rmswr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/hello-world看到Hello from Docker!即表示 Docker 环境完全就绪。六、部署 Dify6.1 克隆源码cd~gitclone https://github.com/langgenius/dify.gitcddify/docker6.2 复制环境配置cp.env.example .env6.3 修改 docker-compose.yaml替换镜像前缀由于daemon.json的 mirror 重定向对部分镜像不生效需直接修改 compose 文件将所有 Docker Hub 镜像替换为华为云代理路径。sed-is|image: langgenius/|image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/|gdocker-compose.yamlsed-is|image: postgres|image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/postgres|gdocker-compose.yamlsed-is|image: redis|image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/redis|gdocker-compose.yamlsed-is|image: nginx|image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/nginx|gdocker-compose.yamlsed-is|image: semitechnologies/|image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/semitechnologies/|gdocker-compose.yamlsed-is|image: ubuntu/|image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/ubuntu/|gdocker-compose.yamlsed-is|image: busybox|image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/busybox|gdocker-compose.yaml6.4 启动 Difydockercompose up-d预期输出[] Running 15/15 ✔ Network docker_ssrf_proxy_network Created ✔ Network docker_default Created ✔ Container docker-web-1 Started ✔ Container docker-sandbox-1 Started ✔ Container docker-db_postgres-1 Healthy ✔ Container docker-redis-1 Started ✔ Container docker-init_permissions-1 Exited ✔ Container docker-weaviate-1 Started ✔ Container docker-ssrf_proxy-1 Started ✔ Container docker-plugin_daemon-1 Started ✔ Container docker-api_websocket-1 Started ✔ Container docker-api-1 Started ✔ Container docker-worker_beat-1 Started ✔ Container docker-worker-1 Started ✔ Container docker-nginx-1 Started七、部署后验证# 查看容器状态所有应为 Up 或 healthydockercomposeps# 查看异常日志dockercompose logs--tail50|grep-ierror\|fatal# 测试本地访问curl-Ihttp://localhost/install八、访问与初始化部署成功后在浏览器访问http://服务器IP/install首次访问流程设置管理员账号邮箱 密码完成初始化后登录地址为http://服务器IP九、常见问题速查现象原因解决方案nothing provides libc.so.6(GLIBC_2.34)麒麟 glibc 2.28 不兼容 Docker 29.x改用二进制安装 Docker 24.0.9nothing provides container-selinux麒麟源缺少该包二进制安装绕过 RPM 依赖error adding content digest to leaseDocker 与 containerd 版本不匹配重装配套版本24.0.9 1.7.13镜像拉取超时Docker Hub 网络不通使用华为云代理路径直接替换镜像前缀init_permissions拉取失败busybox 镜像未替换补充 sed 替换规则容器反复重启内存不足或数据库未就绪检查docker compose logs十、附录离线部署方案完全无网络环境若服务器完全无外网需在有网络的机器上提前下载镜像# 在有外网的机器上执行dockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-api:1.14.2dockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-web:1.14.2dockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-plugin-daemon:0.6.1-localdockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-sandbox:0.2.15dockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/postgres:15-alpinedockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/redis:6-alpinedockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/nginx:latestdockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/semitechnologies/weaviate:1.27.0dockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/ubuntu/squid:latestdockerpull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/busybox:latest# 导出为 tar 包dockersave-odify-images.tar swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-api:1.14.2 swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-web:1.14.2 swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-plugin-daemon:0.6.1-local swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/langgenius/dify-sandbox:0.2.15 swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/postgres:15-alpine swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/redis:6-alpine swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/nginx:latest swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/semitechnologies/weaviate:1.27.0 swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/ubuntu/squid:latest swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/busybox:latest# 传到麒麟服务器后导入dockerload-idify-images.tar参考文档Dify 官方文档
