refactor(build): 切换到 musl 交叉编译 + distroless 镜像方案

- docker-publish.yml: 改为 cross 交叉编译 amd64/arm64 musl 静态二进制,
  前端在 CI 独立构建, buildx 组装多架构镜像
- Dockerfile.app: 从 139 行容器内编译简化为 24 行纯 COPY 打包
- Dockerfile.app.local: 移除 jemalloc 动态链接 (LD_PRELOAD/libjemalloc2)
- aether-gateway: 引入 tikv-jemallocator 静态链接 jemalloc

.github/workflows/docker-publish.yml

@@ -5,46 +5,113 @@ on:
     tags: ['v*']
   workflow_dispatch:
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   REGISTRY: ghcr.io
-  APP_IMAGE_NAME: fawney19/aether
-  GITHUB_REPO: fawney19/Aether
+  GHCR_IMAGE: fawney19/aether
+  DOCKERHUB_IMAGE: fawney19/aether
 
 jobs:
-  download-hub:
+  frontend:
+    name: Build frontend
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    outputs:
-      hub_tag: ${{ steps.hub-tag.outputs.tag }}
-    steps:
-      - name: Get latest hub release tag
-        id: hub-tag
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          TAG=$(gh release list --repo "${{ env.GITHUB_REPO }}" --limit 50 --json tagName,isDraft,isPrerelease \
-            --jq '[.[] | select(.tagName | startswith("hub-v")) | select(.isDraft == false and .isPrerelease == false)] | .[0].tagName')
-          if [ -z "$TAG" ] || [ "$TAG" = "null" ]; then
-            echo "No hub release found"
-            exit 1
-          fi
-          echo "tag=$TAG" >> $GITHUB_OUTPUT
-          echo "Hub release tag: $TAG"
-
-  build-app:
-    needs: [download-hub]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
     steps:
       - uses: actions/checkout@v5
 
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install & build
+        working-directory: frontend
+        run: |
+          npm ci
+          npm run build
+
+      - name: Upload frontend artifact
+        uses: actions/upload-artifact@v5
+        with:
+          name: frontend-dist
+          path: frontend/dist/
+          if-no-files-found: error
+          retention-days: 1
+
+  build:
+    name: Build ${{ matrix.name }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: true
+      matrix:
+        include:
+          - name: linux-amd64
+            target: x86_64-unknown-linux-musl
+            arch: amd64
+          - name: linux-arm64
+            target: aarch64-unknown-linux-musl
+            arch: arm64
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Rust cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          shared-key: release-${{ matrix.target }}
+          workspaces: . -> target
+
+      - name: Install cross
+        uses: taiki-e/install-action@cross
+
+      - name: Build
+        env:
+          CARGO_TERM_COLOR: always
+        run: cross build --release --locked -p aether-gateway --target ${{ matrix.target }}
+
+      - name: Upload binary artifact
+        uses: actions/upload-artifact@v5
+        with:
+          name: aether-gateway-${{ matrix.arch }}
+          path: target/${{ matrix.target }}/release/aether-gateway
+          if-no-files-found: error
+          retention-days: 1
+
+  docker:
+    name: Docker multi-arch
+    needs: [frontend, build]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v5
+        with:
+          path: artifacts
+
+      - name: Prepare dist layout
+        run: |
+          mkdir -p dist
+          cp artifacts/aether-gateway-amd64/aether-gateway dist/aether-gateway-amd64
+          cp artifacts/aether-gateway-arm64/aether-gateway dist/aether-gateway-arm64
+          chmod +x dist/aether-gateway-amd64 dist/aether-gateway-arm64
+          cp -r artifacts/frontend-dist dist/frontend
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Log in to Container Registry
+      - name: Log in to GHCR
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
@@ -57,13 +124,13 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Extract metadata for app image
+      - name: Extract metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
           images: |
-            ${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}
-            docker.io/fawney19/aether
+            ${{ env.REGISTRY }}/${{ env.GHCR_IMAGE }}
+            docker.io/${{ env.DOCKERHUB_IMAGE }}
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
@@ -73,68 +140,12 @@ jobs:
           flavor: |
             latest=auto
 
-      - name: Extract version from tag
-        id: version
-        run: |
-          VERSION="${GITHUB_REF#refs/tags/v}"
-          if [ "$VERSION" = "$GITHUB_REF" ]; then
-            VERSION=$(git describe --tags --always | sed 's/^v//')
-          fi
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "Extracted version: $VERSION"
-
-      - name: Resolve hub release for build args
-        run: |
-          echo "Hub release tag: ${{ needs.download-hub.outputs.hub_tag }}"
-
-      - name: Build and push app image (amd64)
-        id: build-amd64
+      - name: Build and push
         uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile.app
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha,scope=app-amd64
-          cache-to: type=gha,mode=min,scope=app-amd64
-          build-args: |
-            HUB_RELEASE_REPO=${{ env.GITHUB_REPO }}
-            HUB_TAG=${{ needs.download-hub.outputs.hub_tag }}
-          platforms: linux/amd64
-          outputs: type=image,"name=${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }},docker.io/fawney19/aether",push-by-digest=true,name-canonical=true,push=true
-
-      - name: Build and push app image (arm64)
-        id: build-arm64
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile.app
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha,scope=app-arm64
-          cache-to: type=gha,mode=min,scope=app-arm64
-          build-args: |
-            HUB_RELEASE_REPO=${{ env.GITHUB_REPO }}
-            HUB_TAG=${{ needs.download-hub.outputs.hub_tag }}
-          platforms: linux/arm64
-          outputs: type=image,"name=${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }},docker.io/fawney19/aether",push-by-digest=true,name-canonical=true,push=true
-
-      - name: Create multi-arch manifest and push
-        run: |
-          AMD64_DIGEST="${{ steps.build-amd64.outputs.digest }}"
-          ARM64_DIGEST="${{ steps.build-arm64.outputs.digest }}"
-          echo "amd64 digest: $AMD64_DIGEST"
-          echo "arm64 digest: $ARM64_DIGEST"
-
-          TAGS=$(echo "${{ steps.meta.outputs.tags }}" | tr '\n' ' ')
-          for FULL_TAG in $TAGS; do
-            if [[ "$FULL_TAG" == ghcr.io/* ]]; then
-              REPO="${{ env.REGISTRY }}/${{ env.APP_IMAGE_NAME }}"
-            elif [[ "$FULL_TAG" == docker.io/* ]]; then
-              REPO="docker.io/fawney19/aether"
-            else
-              continue
-            fi
-            echo "Creating manifest for $FULL_TAG"
-            docker buildx imagetools create -t "$FULL_TAG" \
-              "$REPO@$AMD64_DIGEST" \
-              "$REPO@$ARM64_DIGEST"
-          done
+          platforms: linux/amd64,linux/arm64

Cargo.lock

@@ -176,6 +176,7 @@ dependencies = [
  "sha2",
  "sqlx",
  "thiserror 2.0.18",
+ "tikv-jemallocator",
  "tokio",
  "tokio-util",
  "tower",
@@ -3899,6 +3900,26 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "tikv-jemalloc-sys"
+version = "0.6.1+5.3.0-1-ge13ca993e8ccb9ba9847cc330696e02839f328f7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd8aa5b2ab86a2cefa406d889139c162cbb230092f7d1d7cbc1716405d852a3b"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "tikv-jemallocator"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0359b4327f954e0567e69fb191cf1436617748813819c94b8cd4a431422d053a"
+dependencies = [
+ "libc",
+ "tikv-jemalloc-sys",
+]
+
 [[package]]
 name = "time"
 version = "0.3.47"

Dockerfile.app

@@ -1,133 +1,24 @@
 # syntax=docker/dockerfile:1
-# Aether 运行镜像：Rust gateway 直接服务 API + 前端静态文件
-# 构建命令: docker build -f Dockerfile.app -t aether-app:latest .
-# 用于 GitHub Actions CI（官方源）
+# Aether Gateway 运行时镜像（交叉编译方案）
+# 二进制和前端产物均由 CI 预先构建，此 Dockerfile 仅做打包
+# 用法: docker buildx build --platform linux/amd64,linux/arm64 -f Dockerfile.app .
+#
+# 构建上下文中须包含:
+#   dist/aether-gateway-amd64   (x86_64-unknown-linux-musl 交叉编译产物)
+#   dist/aether-gateway-arm64   (aarch64-unknown-linux-musl 交叉编译产物)
+#   dist/frontend/              (npm run build 产物)
 
-# ==================== 前端构建 ====================
-FROM node:22-slim AS frontend-builder
-WORKDIR /app/frontend
-COPY frontend/package*.json ./
-RUN npm ci
-COPY frontend/ ./
-RUN npm run build
+FROM gcr.io/distroless/static-debian12:nonroot
 
-# ==================== Rust gateway 构建 ====================
-FROM rust:1.94.1-slim AS gateway-base
-WORKDIR /build
+# TARGETARCH 由 buildx 自动注入: amd64 或 arm64
+ARG TARGETARCH
 
-# CI 镜像也采用同一套分层缓存策略，减少重复编译开销。
-ENV CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse \
-    CARGO_PROFILE_RELEASE_LTO=thin \
-    CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16
+COPY dist/aether-gateway-${TARGETARCH} /usr/local/bin/aether-gateway
+COPY dist/frontend/ /srv/frontend
 
-RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
-    --mount=type=cache,target=/var/lib/apt,sharing=locked \
-    apt-get update && apt-get install -y --no-install-recommends \
-    build-essential \
-    ca-certificates \
-    libjemalloc2 \
-    libssl-dev \
-    pkg-config \
-    perl
-
-RUN --mount=type=cache,id=aether-cargo-registry,target=/usr/local/cargo/registry,sharing=locked \
-    --mount=type=cache,id=aether-cargo-git,target=/usr/local/cargo/git,sharing=locked \
-    cargo install cargo-chef --locked
-
-FROM gateway-base AS gateway-planner
-COPY Cargo.toml Cargo.lock ./
-COPY apps/ ./apps/
-COPY crates/ ./crates/
-RUN cargo chef prepare --recipe-path recipe.json
-
-FROM gateway-base AS gateway-builder
-COPY --from=gateway-planner /build/recipe.json ./recipe.json
-RUN --mount=type=cache,id=aether-cargo-registry,target=/usr/local/cargo/registry,sharing=locked \
-    --mount=type=cache,id=aether-cargo-git,target=/usr/local/cargo/git,sharing=locked \
-    --mount=type=cache,id=aether-cargo-target-ci,target=/build/target,sharing=locked \
-    cargo chef cook --release --locked --package aether-gateway --bin aether-gateway --recipe-path recipe.json
-
-COPY Cargo.toml Cargo.lock ./
-COPY apps/ ./apps/
-COPY crates/ ./crates/
-RUN --mount=type=cache,id=aether-cargo-registry,target=/usr/local/cargo/registry,sharing=locked \
-    --mount=type=cache,id=aether-cargo-git,target=/usr/local/cargo/git,sharing=locked \
-    --mount=type=cache,id=aether-cargo-target-ci,target=/build/target,sharing=locked \
-    cargo build --release --locked -p aether-gateway && \
-    cp target/release/aether-gateway /tmp/aether-gateway
-
-# ==================== 最小运行时打包 ====================
-FROM gateway-builder AS runtime-prep
-RUN set -eux; \
-    mkdir -p \
-    /runtime-root/app/data \
-    /runtime-root/app/logs \
-    /runtime-root/etc \
-    /runtime-root/etc/ssl \
-    /runtime-root/lib \
-    /runtime-root/lib64 \
-    /runtime-root/usr/local/bin \
-    /runtime-root/usr/local/lib; \
-    cp /tmp/aether-gateway /runtime-root/usr/local/bin/aether-gateway; \
-    : > /tmp/runtime-libs.txt; \
-    : > /tmp/runtime-scan-queue.txt; \
-    printf '%s\n' /tmp/aether-gateway >> /tmp/runtime-scan-queue.txt; \
-    jemalloc_path="$(find /usr/lib -type f -name 'libjemalloc.so.2' | head -n1)"; \
-    [ -n "$jemalloc_path" ]; \
-    install -D "$jemalloc_path" /runtime-root/usr/local/lib/libjemalloc.so.2; \
-    printf '%s\n' "$jemalloc_path" >> /tmp/runtime-scan-queue.txt; \
-    while [ -s /tmp/runtime-scan-queue.txt ]; do \
-        current="$(head -n1 /tmp/runtime-scan-queue.txt)"; \
-        sed -i '1d' /tmp/runtime-scan-queue.txt; \
-        ldd "$current" | awk '/=>/ { print $3 } $1 ~ /^\// { print $1 }' | while read -r lib; do \
-            [ -n "$lib" ]; \
-            if ! grep -Fxq "$lib" /tmp/runtime-libs.txt; then \
-                printf '%s\n' "$lib" >> /tmp/runtime-libs.txt; \
-                printf '%s\n' "$lib" >> /tmp/runtime-scan-queue.txt; \
-            fi; \
-        done; \
-    done; \
-    sort -u /tmp/runtime-libs.txt -o /tmp/runtime-libs.txt; \
-    while read -r lib; do \
-        [ -n "$lib" ]; \
-        dest="/runtime-root$(dirname "$lib")"; \
-        mkdir -p "$dest"; \
-        cp -L "$lib" "$dest/"; \
-    done < /tmp/runtime-libs.txt; \
-    for lib in \
-        /lib/x86_64-linux-gnu/libnss_dns.so.2 \
-        /lib/x86_64-linux-gnu/libnss_files.so.2 \
-        /lib/x86_64-linux-gnu/libresolv.so.2; do \
-        if [ -f "$lib" ]; then \
-            dest="/runtime-root$(dirname "$lib")"; \
-            mkdir -p "$dest"; \
-            cp -L "$lib" "$dest/"; \
-        fi; \
-    done; \
-    cp -a /usr/lib/ssl /runtime-root/usr/lib/; \
-    cp -a /etc/ssl/certs /runtime-root/etc/ssl/; \
-    if [ -f /etc/ssl/openssl.cnf ]; then \
-        cp /etc/ssl/openssl.cnf /runtime-root/etc/ssl/openssl.cnf; \
-    fi; \
-    if [ -f /etc/nsswitch.conf ]; then \
-        cp /etc/nsswitch.conf /runtime-root/etc/nsswitch.conf; \
-    fi
-
-# ==================== 运行时镜像 ====================
-FROM scratch
-
-# 复制 gateway 二进制
-COPY --from=runtime-prep /runtime-root/ /
-
-# 复制前端构建产物
-COPY --from=frontend-builder /app/frontend/dist /srv/frontend
 WORKDIR /app
 
-ENV LANG=C.UTF-8 \
-    LC_ALL=C.UTF-8 \
-    LD_PRELOAD=/usr/local/lib/libjemalloc.so.2 \
-    MALLOC_CONF=background_thread:true,dirty_decay_ms:5000,muzzy_decay_ms:5000 \
-    RUST_LOG=aether_gateway=info \
+ENV RUST_LOG=aether_gateway=info \
     AETHER_GATEWAY_BIND=0.0.0.0:80 \
     AETHER_GATEWAY_STATIC_DIR=/srv/frontend
 

Dockerfile.app.local

@@ -25,7 +25,6 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     apt-get update && apt-get install -y --no-install-recommends \
     build-essential \
     ca-certificates \
-    libjemalloc2 \
     libssl-dev \
     pkg-config \
     perl
@@ -66,16 +65,11 @@ RUN set -eux; \
     /runtime-root/etc/ssl \
     /runtime-root/lib \
     /runtime-root/lib64 \
-    /runtime-root/usr/local/bin \
-    /runtime-root/usr/local/lib; \
+    /runtime-root/usr/local/bin; \
     cp /tmp/aether-gateway /runtime-root/usr/local/bin/aether-gateway; \
     : > /tmp/runtime-libs.txt; \
     : > /tmp/runtime-scan-queue.txt; \
     printf '%s\n' /tmp/aether-gateway >> /tmp/runtime-scan-queue.txt; \
-    jemalloc_path="$(find /usr/lib -type f -name 'libjemalloc.so.2' | head -n1)"; \
-    [ -n "$jemalloc_path" ]; \
-    install -D "$jemalloc_path" /runtime-root/usr/local/lib/libjemalloc.so.2; \
-    printf '%s\n' "$jemalloc_path" >> /tmp/runtime-scan-queue.txt; \
     while [ -s /tmp/runtime-scan-queue.txt ]; do \
         current="$(head -n1 /tmp/runtime-scan-queue.txt)"; \
         sed -i '1d' /tmp/runtime-scan-queue.txt; \
@@ -125,8 +119,6 @@ WORKDIR /app
 
 ENV LANG=C.UTF-8 \
     LC_ALL=C.UTF-8 \
-    LD_PRELOAD=/usr/local/lib/libjemalloc.so.2 \
-    MALLOC_CONF=background_thread:true,dirty_decay_ms:5000,muzzy_decay_ms:5000 \
     RUST_LOG=aether_gateway=info \
     AETHER_GATEWAY_BIND=0.0.0.0:80 \
     AETHER_GATEWAY_STATIC_DIR=/srv/frontend

apps/aether-gateway/Cargo.toml

@@ -58,6 +58,9 @@ url.workspace = true
 uuid.workspace = true
 webpki-roots.workspace = true
 
+[target.'cfg(not(target_env = "msvc"))'.dependencies]
+tikv-jemallocator = "0.6"
+
 [dev-dependencies]
 aether-testkit.workspace = true
 tracing-subscriber.workspace = true

apps/aether-gateway/src/main.rs

@@ -1,3 +1,7 @@
+#[cfg(not(target_env = "msvc"))]
+#[global_allocator]
+static GLOBAL: tikv_jemallocator::Jemalloc = tikv_jemallocator::Jemalloc;
+
 use clap::{Args as ClapArgs, Parser, ValueEnum};
 use tracing::{debug, info, warn};