All instances shared the image-baked machine-id (a67bf09f...), so Tencent
saw every WechatOnCloud account worldwide as one "device" — a textbook
device-farm signal triggering risk control and the forced-logout loop
reported across old and new versions.
- docker/woc-identity.sh: new /custom-cont-init.d/00-woc-identity hook —
generates a unique machine-id on first start, persists it in the data
volume (survives restart/upgrade/recreate), writes /etc/machine-id +
/var/lib/dbus/machine-id, removes /.dockerenv. Existing instances get a
fresh unique id on first upgraded start (volume lacks the file).
- regenInstanceMachineId + POST /api/admin/instances/:id/regen-machine-id:
roll a brand-new device id and restart, for accounts re-flagged by risk
control. Gated on the hook being present (old image → instructs upgrade).
- Admin 实例卡片「安全」弹窗新增「重置设备 ID 并重启」。
Verified: two fresh containers get distinct machine-ids; id persists across
restart; regen (rm persisted file + restart) yields a new persistent id.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
GloridustandClaude Opus 4.8
Ethan ZouandGitHub
mkblbj
huglemon