fix(deploy): runtime DNS re-resolution via resolv.conf-injected resolver, both runtimes

deploy/Dockerfile.web

@@ -7,4 +7,7 @@ RUN npm run build
 
 FROM nginx:1.27-alpine
 COPY deploy/nginx.conf /etc/nginx/conf.d/default.conf
+COPY --chmod=755 deploy/entrypoint-resolver.sh /entrypoint-resolver.sh
 COPY --from=build /src/dist /usr/share/nginx/html
+# entrypoint 先按 /etc/resolv.conf 注入 resolver(Docker/podman 双运行时),再执行继承的 nginx CMD
+ENTRYPOINT ["/entrypoint-resolver.sh"]

deploy/entrypoint-resolver.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+# 双运行时(Docker/podman)DNS 修复:镜像内 baked 的 resolver 地址无法同时成立
+# (Docker=127.0.0.11,podman aardvark=网络网关,见容器 /etc/resolv.conf)。
+# 启动前取 resolv.conf 首个 nameserver 注入 nginx 配置,保住 spec §11 的
+# 变量式 proxy_pass 运行时重解析(valid=10s,scale/重建后秒级感知新 IP)。
+set -eu
+RESOLVER=$(awk '/^nameserver/{print $2; exit}' /etc/resolv.conf 2>/dev/null || true)
+[ -n "$RESOLVER" ] || RESOLVER=127.0.0.11
+CONF=/etc/nginx/conf.d/default.conf
+sed -i "s#resolver [0-9a-fA-F:.]* valid=#resolver ${RESOLVER} valid=#" "$CONF"
+echo "entrypoint-resolver: resolver=${RESOLVER} injected into ${CONF}"
+if [ $# -gt 0 ]; then exec "$@"; fi
+exec nginx -g 'daemon off;'

deploy/nginx.conf

@@ -1,10 +1,13 @@
 server {
   listen 80;
   client_max_body_size 200m;
+  # 地址为占位默认值(127.0.0.11=Docker 内嵌 DNS);镜像 entrypoint 启动时会按
+  # /etc/resolv.conf 的首个 nameserver 重写本行,兼容 podman aardvark-dns。
+  resolver 127.0.0.11 valid=10s;
 
   location /api/ {
-    # 静态主机名:启动时经 /etc/resolv.conf 解析(Docker 127.0.0.11 / podman aardvark 均兼容)
+    set $api_upstream http://api:8080;   # 变量式 → 每次按 DNS 解析,scale 后轮询到新副本(spec §11)
-    proxy_pass http://api:8080;      # 无 URI 部分:保留 /api 前缀转发
+    proxy_pass $api_upstream;            # 无 URI 部分:保留 /api 前缀转发
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;