# ✅ 推荐：Alpine + 静态链接（Go/Rust）
FROM scratch
COPY myapp /myapp
ENTRYPOINT ["/myapp"]
# 大小：5-15 MB

# ✅ 推荐：Alpine（Python/Node.js）
FROM python:3.12-alpine
# 大小：~50 MB

# ✅ 推荐：Distroless（Java 等需要 glibc 的场景）
FROM gcr.io/distroless/java21-debian12
# 大小：~150 MB

# ⚠️ 可选：Debian Slim（需要 glibc 兼容性）
FROM debian:bookworm-slim
# 大小：~75 MB

# ❌ 不推荐：完整 Ubuntu/Debian（开发镜像除外）
FROM ubuntu:24.04
# 大小：~300 MB+

# Go 应用多阶段构建
FROM golang:1.22-alpine AS builder
RUN apk add --no-cache git ca-certificates tzdata
WORKDIR /app
COPY go.mod go.sum ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /app/server .

FROM scratch
COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
COPY --from=builder /app/server /server
EXPOSE 8080
ENTRYPOINT ["/server"]

# Rust 应用多阶段构建
FROM rust:1.77-alpine AS builder
RUN apk add --no-cache musl-dev openssl-dev
WORKDIR /app
COPY Cargo.toml Cargo.lock ./
COPY src ./src
RUN cargo build --release --target x86_64-unknown-linux-musl

FROM scratch
COPY --from=builder /app/target/x86_64-unknown-linux-musl/release/myapp /myapp
ENTRYPOINT ["/myapp"]

# Python 应用多阶段构建
FROM python:3.12-alpine AS builder
RUN apk add --no-cache build-base libffi-dev openssl-dev postgresql-dev
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt

FROM python:3.12-alpine
RUN apk add --no-cache libpq libffi openssl
COPY --from=builder /install /usr/local
WORKDIR /app
COPY . .
CMD ["gunicorn", "-w", "4", "-b", "0.0.0.0:8000", "app:app"]

# 安全最佳实践
FROM alpine:3.20 AS builder
# 1. 使用特定版本标签，不用 latest
# 2. 安装时使用 --no-cache
RUN apk add --no-cache gcc musl-dev
# 3. 以非 root 用户运行
RUN adduser -D -u 1000 appuser
# 4. 最小化安装
# 5. 清理构建依赖

FROM alpine:3.20
COPY --from=builder /app/myapp /usr/local/bin/myapp
USER appuser
ENTRYPOINT ["myapp"]

# 嵌入式 Makefile 示例
CROSS_COMPILE = arm-linux-musleabihf-
CC = $(CROSS_COMPILE)gcc
AR = $(CROSS_COMPILE)ar
STRIP = $(CROSS_COMPILE)strip

CFLAGS = -Os -Wall -Wextra -ffunction-sections -fdata-sections
LDFLAGS = -static -Wl,--gc-sections -s

SRCS = main.c sensor.c network.c
OBJS = $(SRCS:.c=.o)
TARGET = iot_device

all: $(TARGET)
	$(STRIP) $(TARGET)
	ls -lh $(TARGET)

$(TARGET): $(OBJS)
	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $^

%.o: %.c
	$(CC) $(CFLAGS) -c -o $@ $<

size_report: $(TARGET)
	$(CROSS_COMPILE)size $(TARGET)

clean:
	rm -f $(OBJS) $(TARGET)

/* 嵌入式环境的内存管理策略 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/resource.h>

/* 1. 使用静态分配替代动态分配 */
static char buffer[4096];  /* 静态分配，无 malloc 开销 */

/* 2. 使用 alloca() 替代 malloc()（栈上分配） */
void process_data(size_t size) {
    char *temp = alloca(size);  /* 栈分配，函数返回时自动释放 */
    /* 使用 temp... */
}

/* 3. 使用内存池 */
typedef struct {
    char *base;
    size_t size;
    size_t offset;
} MemPool;

static char pool_memory[65536];
static MemPool pool = {pool_memory, sizeof(pool_memory), 0};

void *pool_alloc(size_t size) {
    if (pool.offset + size > pool.size) return NULL;
    void *ptr = pool.base + pool.offset;
    pool.offset += (size + 7) & ~7;  /* 8 字节对齐 */
    return ptr;
}

void pool_reset(void) {
    pool.offset = 0;
}

/* 4. 检查堆栈使用 */
void check_stack_usage(void) {
    struct rlimit rl;
    getrlimit(RLIMIT_STACK, &rl);
    printf("Stack limit: %ld bytes\n", rl.rlim_cur);
}

int main(void) {
    check_stack_usage();
    return 0;
}

# 使用 GDB 远程调试嵌入式设备
# 设备上运行 gdbserver
$ gdbserver :1234 ./iot_device

# 开发机上连接
$ arm-linux-musleabihf-gdb ./iot_device
(gdb) target remote 192.168.1.100:1234
(gdb) break main
(gdb) continue

# 使用 strace 分析系统调用
$ qemu-arm-static -strace ./iot_device

# GitHub Actions 示例：多 libc 测试
name: CI

on: [push, pull_request]

jobs:
  test-glibc:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build with glibc
        run: |
          gcc -O2 -Wall -o test_glibc src/*.c
          ./test_glibc --test

  test-musl:
    runs-on: ubuntu-latest
    container: alpine:3.20
    steps:
      - uses: actions/checkout@v4
      - name: Build with musl
        run: |
          apk add --no-cache gcc musl-dev
          gcc -O2 -Wall -o test_musl src/*.c
          ./test_musl --test

  test-musl-static:
    runs-on: ubuntu-latest
    container: alpine:3.20
    steps:
      - uses: actions/checkout@v4
      - name: Build static with musl
        run: |
          apk add --no-cache gcc musl-dev
          gcc -O2 -Wall -static -o test_static src/*.c
          ./test_static --test
          ldd test_static 2>&1 | grep -q "Not a dynamic"

  build-docker:
    needs: [test-glibc, test-musl, test-musl-static]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build Docker image
        run: docker build -t myapp:${{ github.sha }} .
      - name: Test Docker image
        run: |
          docker run --rm myapp:${{ github.sha }} --version

# 1. malloc 调优
export MALLOC_ARENA_MAX=4           # 限制 arena 数量
export MALLOC_MMAP_THRESHOLD_=131072 # mmap 阈值
export MALLOC_TRIM_THRESHOLD_=131072 # trim 阈值

# 2. 编译优化
gcc -O2 -march=native -flto -o program program.c

# 3. 链接优化
gcc -Wl,-O1 -Wl,--as-needed -o program program.c

# 4. 运行时检查
LD_DEBUG=stats ./program  # 查看链接器统计

# 1. 静态链接
musl-gcc -O2 -static -o program program.c

# 2. 外部 malloc（如需要高并发）
musl-gcc -O2 -o program program.c -ljemalloc

# 3. 编译优化
musl-gcc -O2 -march=native -flto -o program program.c

# 4. 线程栈设置
# 在代码中使用 pthread_attr_setstacksize()
# 或在编译时设置默认栈大小

# 快速检测方法
$ grep -rn '#include.*error\.h\|argp\.h\|execinfo\.h\|obstack\.h' src/
$ grep -rn 'error_at_line\|argp_parse\|backtrace\|obstack_' src/

# 如果没有匹配，大概率可以直接编译
$ musl-gcc -O2 -o program program.c

# 检查 /etc/resolv.conf
$ cat /etc/resolv.conf
# 应该包含 nameserver 行

# 在 Docker 中
$ docker run --rm alpine:3.20 cat /etc/resolv.conf
# nameserver 8.8.8.8  (Docker 自动配置)

# 如果为空，手动配置
$ echo "nameserver 8.8.8.8" > /etc/resolv.conf

# 方案 1：安装 gcompat
$ apk add gcompat
$ ./glibc_program

# 方案 2：重新编译
$ apk add gcc musl-dev
$ gcc -o program program.c

# 方案 3：使用 Docker 多架构
$ docker run --rm ubuntu:24.04 ./glibc_program

# 保留调试符号
$ musl-gcc -g -static -o program program.c
$ objcopy --only-keep-debug program program.debug
$ strip program

# 运行时使用 core dump 分析
$ ulimit -c unlimited
$ ./program  # 崩溃时生成 core
$ gdb -s program.debug -e program -c core

# 或者保留完整的带调试信息的二进制
$ musl-gcc -g -static -o program_debug program.c
$ musl-gcc -O2 -static -o program_release program.c

# musl malloc 使用简单算法，多线程并发时可能成为瓶颈
# 解决方案：使用外部 allocator

$ apk add jemalloc-dev
$ musl-gcc -O2 -o program program.c -ljemalloc

# 或使用 mimalloc
$ apk add mimalloc-dev
$ musl-gcc -O2 -o program program.c -lmimalloc

# 方法 1：ldd
$ ldd --version
# glibc: "ldd (GNU libc) 2.39"
# musl: "musl libc (x86_64)"

# 方法 2：readelf
$ readelf -l /bin/ls | grep interpreter
# glibc: [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
# musl:  [Requesting program interpreter: /lib/ld-musl-x86_64.so.1]

# 方法 3：编译时检测
$ echo '__GLIBC__' | gcc -E -xc - 2>/dev/null | grep -q "^[0-9]" && echo "glibc"
$ echo '__musl__' | musl-gcc -E -xc - 2>/dev/null | grep -q "^[0-9]" && echo "musl"