Dockerfile

# ========== GO BUILD STAGE ==========
# 使用 glibc (Debian) 构建 Go 共享库，避免 musl 下 Go runtime 初始化崩溃
ARG GO_IMAGE=mirror.gcr.io/library/golang:latest
ARG DEBIAN_IMAGE=mirror.gcr.io/library/debian:latest
ARG ALPINE_IMAGE=mirror.gcr.io/library/alpine:latest
ARG DEBIAN_TRIXIE_IMAGE=mirror.gcr.io/library/debian:trixie
ARG DEBIAN_TRIXIE_SLIM_IMAGE=mirror.gcr.io/library/debian:trixie-slim
FROM ${GO_IMAGE} AS go-builder

ARG TARGETARCH
ARG TARGETVARIANT
ARG MIHOMO_REF="Alpha"
ARG MIHOMO_CACHE_BUST=1
ARG REFRESH_GO_DEPS=false

WORKDIR /build/bridge

# Debian 使用 apt 包管理器
RUN apt-get update && \
    apt-get install -y --no-install-recommends git build-essential && \
    rm -rf /var/lib/apt/lists/*

# Copy committed Go module files and source.
COPY bridge/go.mod bridge/go.sum ./
COPY bridge/converter.go ./
COPY bridge/age.go ./
COPY bridge/parser.go ./
COPY bridge/preprocess.go ./
COPY bridge/mieru.go ./
COPY bridge/cmd/portable-updater/ ./cmd/portable-updater/

RUN set -xe && \
    retry_go_dependency() { \
      attempt=1; \
      while ! "$@"; do \
        if [ "${attempt}" = 3 ]; then \
          echo "Go dependency command failed after ${attempt} attempts" >&2; \
          return 1; \
        fi; \
        echo "Go dependency command attempt ${attempt} failed; retrying" >&2; \
        sleep "$((attempt * 5))"; \
        attempt="$((attempt + 1))"; \
      done; \
    } && \
    if [ "${REFRESH_GO_DEPS}" = "true" ]; then \
      echo "MIHOMO_CACHE_BUST=$MIHOMO_CACHE_BUST" && \
      retry_go_dependency go get github.com/metacubex/mihomo@${MIHOMO_REF} && \
      mihomo_version="$(go list -m -f '{{.Version}}' github.com/metacubex/mihomo)" && \
      mieru_version="$(go list -m -f '{{.Version}}' github.com/enfein/mieru/v3)" && \
      protobuf_version="$(go list -m -f '{{.Version}}' google.golang.org/protobuf)" && \
      test -n "${mihomo_version}" && test -n "${mieru_version}" && test -n "${protobuf_version}" && \
      retry_go_dependency go get -u all && \
      retry_go_dependency go get \
        "github.com/metacubex/mihomo@${mihomo_version}" \
        "github.com/enfein/mieru/v3@${mieru_version}" \
        "google.golang.org/protobuf@${protobuf_version}" && \
      go mod tidy && \
      test "$(go list -m -f '{{.Version}}' github.com/metacubex/mihomo)" = "${mihomo_version}" && \
      test "$(go list -m -f '{{.Version}}' github.com/enfein/mieru/v3)" = "${mieru_version}" && \
      test "$(go list -m -f '{{.Version}}' google.golang.org/protobuf)" = "${protobuf_version}"; \
    else \
      retry_go_dependency go mod download; \
    fi

# Copy scripts for scheme generation
COPY scripts/ ../scripts/
RUN go run ../scripts/generate_proxy_validation.go -o proxy_validation_generated.go -manifest mihomo_capabilities.json
RUN go run ../scripts/generate_schemes.go -manifest mihomo_capabilities.json -o mihomo_schemes.h
RUN go run ../scripts/generate_param_compat.go -manifest mihomo_capabilities.json -o param_compat.h

RUN CGO_ENABLED=0 go build \
    -trimpath \
    -ldflags='-s -w' \
    -o subconverter-update \
    ./cmd/portable-updater

# Build the shared library used by the Alpine runtime.
# 关键修改：
# 1. 使用 c-shared 模式避免 musl 环境下 Go runtime 初始化问题
# 2. musl libc 不向构造函数传递 argc/argv，c-archive 模式会导致 Segfault
# 3. c-shared 模式下 Go runtime 边界清晰，初始化更稳定
RUN set -xe && \
    CGO_ENABLED=1 go build \
    -trimpath \
    -ldflags='-s -w' \
    -buildmode=c-shared \
    -o libmihomo.so \
    .

RUN ls -lh libmihomo.so libmihomo.h subconverter-update

# ========== C++ BUILD STAGE ==========
# 使用 Debian (glibc) 编译，运行时再搬运依赖到 Alpine
FROM ${DEBIAN_IMAGE} AS builder
ARG THREADS="4"
ARG SHA=""
ARG VERSION="dev"
ARG BUILD_DATE=""
ARG REFRESH_HEADERS=false
ARG SOURCE_DEPS_CACHE_BUST=stable
ARG QUICKJSPP_REF
ARG LIBCRON_REF
ARG TOML11_REF
ARG CPP_HTTPLIB_REF
ARG NLOHMANN_JSON_REF
ARG INJA_REF
ARG JPCRE2_REF

WORKDIR /

# 安装 Debian 构建依赖
RUN apt-get update && \
    apt-get install -y --no-install-recommends \
    git g++ build-essential cmake python3 python3-pip \
    pkg-config curl \
    libcurl4-openssl-dev libpcre2-dev libboost-dev rapidjson-dev \
    libyaml-cpp-dev ca-certificates ninja-build ccache && \
    rm -rf /var/lib/apt/lists/*

# quickjspp
RUN set -xe && \
    echo "SOURCE_DEPS_CACHE_BUST=${SOURCE_DEPS_CACHE_BUST}" && \
    git init quickjspp && \
    git -C quickjspp remote add origin https://github.com/ftk/quickjspp.git && \
    git -C quickjspp fetch --depth=1 origin "${QUICKJSPP_REF}" && \
    git -C quickjspp checkout --detach FETCH_HEAD && \
    git -C quickjspp submodule update --init --recursive --depth=1 && \
    cd quickjspp && \
    cmake -DCMAKE_BUILD_TYPE=Release . && \
    make quickjs -j ${THREADS} && \
    install -d /usr/lib/quickjs/ && \
    install -m644 quickjs/libquickjs.a /usr/lib/quickjs/ && \
    install -d /usr/include/quickjs/ && \
    install -m644 quickjs/quickjs.h quickjs/quickjs-libc.h /usr/include/quickjs/ && \
    install -m644 quickjspp.hpp /usr/include

# libcron
RUN set -xe && \
    echo "SOURCE_DEPS_CACHE_BUST=${SOURCE_DEPS_CACHE_BUST}" && \
    git init libcron && \
    git -C libcron remote add origin https://github.com/PerMalmberg/libcron.git && \
    git -C libcron fetch --depth=1 origin "${LIBCRON_REF}" && \
    git -C libcron checkout --detach FETCH_HEAD && \
    git -C libcron submodule update --init --recursive --depth=1 && \
    cd libcron && \
    cmake -DCMAKE_BUILD_TYPE=Release . && \
    make libcron -j ${THREADS} && \
    install -m644 libcron/out/Release/liblibcron.a /usr/lib/ && \
    install -d /usr/include/libcron/ && \
    install -m644 libcron/include/libcron/* /usr/include/libcron/ && \
    install -d /usr/include/date/ && \
    install -m644 libcron/externals/date/include/date/* /usr/include/date/

RUN set -xe && \
    echo "SOURCE_DEPS_CACHE_BUST=${SOURCE_DEPS_CACHE_BUST}" && \
    git init toml11 && \
    git -C toml11 remote add origin https://github.com/ToruNiina/toml11.git && \
    git -C toml11 fetch --depth=1 origin "${TOML11_REF}" && \
    git -C toml11 checkout --detach FETCH_HEAD && \
    cd toml11 && \
    cmake -DCMAKE_CXX_STANDARD=11 . && \
    make install -j ${THREADS}

# Copy Go shared library and module files from go-builder stage
COPY --from=go-builder /build/bridge/libmihomo.so /usr/lib/
COPY --from=go-builder /build/bridge/libmihomo.h /usr/include/
# build SubConverter-Extended from THIS repository source
WORKDIR /src
COPY . /src
COPY --from=go-builder /build/bridge/go.mod /src/bridge/go.mod
COPY --from=go-builder /build/bridge/go.sum /src/bridge/go.sum
COPY --from=go-builder /build/bridge/mihomo_capabilities.json /src/bridge/mihomo_capabilities.json
COPY --from=go-builder /build/bridge/proxy_validation_generated.go /src/bridge/proxy_validation_generated.go
COPY --from=go-builder /build/bridge/mihomo_schemes.h /src/src/parser/mihomo_schemes.h
COPY --from=go-builder /build/bridge/param_compat.h /src/src/parser/param_compat.h

RUN set -xe && \
    if [ "${REFRESH_HEADERS}" = "true" ]; then \
      echo "Downloading pinned cpp-httplib..." && \
      curl --retry 5 --retry-all-errors --retry-delay 5 -fsSL "https://raw.githubusercontent.com/yhirose/cpp-httplib/${CPP_HTTPLIB_REF}/httplib.h" -o include/httplib.h && \
      echo "Downloading pinned nlohmann/json..." && \
      curl --retry 5 --retry-all-errors --retry-delay 5 -fsSL "https://raw.githubusercontent.com/nlohmann/json/${NLOHMANN_JSON_REF}/single_include/nlohmann/json.hpp" -o include/nlohmann/json.hpp && \
      echo "Downloading pinned inja..." && \
      curl --retry 5 --retry-all-errors --retry-delay 5 -fsSL "https://raw.githubusercontent.com/pantor/inja/${INJA_REF}/single_include/inja/inja.hpp" -o include/inja.hpp && \
      echo "Downloading pinned jpcre2..." && \
      curl --retry 5 --retry-all-errors --retry-delay 5 -fsSL "https://raw.githubusercontent.com/jpcre2/jpcre2/${JPCRE2_REF}/src/jpcre2.hpp" -o include/jpcre2.hpp && \
      echo "Copying pinned quickjspp from compiled source..." && \
      cp /usr/include/quickjspp.hpp include/quickjspp.hpp && \
      echo "Copying pinned libcron headers from compiled source..." && \
      rm -rf include/libcron include/date && \
      cp -a /libcron/libcron/include/libcron include/libcron && \
      cp -a /libcron/libcron/externals/date/include/date include/date && \
      echo "Copying pinned toml11 headers from compiled source..." && \
      rm -rf include/toml11 && \
      cp /toml11/include/toml.hpp include/toml.hpp && \
      cp -a /toml11/include/toml11 include/toml11; \
    else \
      echo "Using committed header libraries"; \
    fi

RUN python3 scripts/ci/patch_cpp_httplib_force_max.py include/httplib.h
RUN python3 scripts/ci/patch_quickjspp_allocator.py include/quickjspp.hpp

RUN set -xe && \
    BUILD_ID="$(printf '%.7s' "${SHA}")" && \
    [ -n "${BUILD_ID}" ] && sed -i "s/#define BUILD_ID \"\"/#define BUILD_ID \"${BUILD_ID}\"/ " src/version.h || true && \
    [ -n "${VERSION}" ] && sed -i "s/#define VERSION \"dev\"/#define VERSION \"${VERSION}\"/" src/version.h || true && \
    [ -n "${BUILD_DATE}" ] && sed -i "s/#define BUILD_DATE \"\"/#define BUILD_DATE \"${BUILD_DATE}\"/" src/version.h || true && \
    mkdir -p bridge && \
    rm -f bridge/libmihomo.so bridge/libmihomo.a && \
    cp /usr/lib/libmihomo.so bridge/ && \
    cp /usr/include/libmihomo.h bridge/ && \
    export PATH="/usr/lib/ccache:$PATH" && \
    export CCACHE_DIR=/tmp/ccache && \
    export CCACHE_COMPILERCHECK=content && \
    cmake -GNinja \
    -DCMAKE_BUILD_TYPE=Release \
    -DCMAKE_CXX_COMPILER_LAUNCHER=ccache \
    -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=OFF \
    -DCMAKE_POSITION_INDEPENDENT_CODE=OFF \
    .

RUN export PATH="/usr/lib/ccache:$PATH" && \
    export CCACHE_DIR=/tmp/ccache && \
    export CCACHE_COMPILERCHECK=content && \
    ninja -j ${THREADS}

# 收集 glibc 运行时依赖（动态探测，避免固定版本）
RUN set -xe && \
    mkdir -p /runtime-libs && \
    ELF_LIBRARY_PATH="/usr/lib:/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu:/lib/aarch64-linux-gnu:/usr/lib/aarch64-linux-gnu:/lib64" \
      bash /src/scripts/ci/copy-elf-runtime-deps.sh /runtime-libs \
        /src/subconverter \
        /usr/lib/libmihomo.so \
        libnss_dns.so.2 \
        libnss_files.so.2 \
        libnss_compat.so.2 \
        libresolv.so.2 && \
    chmod 0755 /runtime-libs/usr/lib/libmihomo.so && \
    if [ -f /etc/nsswitch.conf ]; then \
      mkdir -p /runtime-libs/etc && \
      cp -aL /etc/nsswitch.conf /runtime-libs/etc/nsswitch.conf; \
    fi

# Small CI-only export image. It reuses the completed builder cache without
# loading the full compiler toolchain into the runner's Docker daemon.
FROM scratch AS ci-export
COPY --from=builder /src/subconverter /src/subconverter
COPY --from=go-builder /build/bridge/subconverter-update /src/subconverter-update
COPY --from=builder /runtime-libs /runtime-libs
COPY --from=builder /src/bridge /src/bridge
COPY --from=builder /src/src/parser/mihomo_schemes.h /src/src/parser/mihomo_schemes.h
COPY --from=builder /src/src/parser/param_compat.h /src/src/parser/param_compat.h
COPY --from=builder /src/include /src/include
CMD ["/src/subconverter"]

# ========== FINAL STAGE ==========
# Alpine 运行时 + 搬运 glibc 依赖（不固定版本）
FROM ${ALPINE_IMAGE}

ARG VERSION="dev"
ARG SHA=""
ARG BUILD_DATE=""
ARG DEPENDENCY_SNAPSHOT_SHA=""
LABEL \
  org.opencontainers.image.title="SubConverter-Extended" \
  org.opencontainers.image.description="A Modern Evolution of subconverter; an enhanced implementation aligned with Mihomo configuration" \
  org.opencontainers.image.url="https://github.com/Aethersailor/SubConverter-Extended" \
  org.opencontainers.image.source="https://github.com/Aethersailor/SubConverter-Extended" \
  org.opencontainers.image.licenses="GPL-3.0" \
  org.opencontainers.image.version="${VERSION}" \
  org.opencontainers.image.revision="${SHA}" \
  org.opencontainers.image.created="${BUILD_DATE}" \
  com.aethersailor.dependency-snapshot.sha256="${DEPENDENCY_SNAPSHOT_SHA}" \
  maintainer="Aethersailor"

ENV TZ=Asia/Shanghai
RUN apk add --no-cache ca-certificates tzdata && \
    ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && \
    echo $TZ > /etc/timezone

COPY --from=builder --chmod=0755 /src/subconverter /usr/bin/subconverter
COPY --from=builder /src/base /base/
COPY --from=builder /runtime-libs/ /

ENV LD_LIBRARY_PATH="/lib/x86_64-linux-gnu:/usr/lib/x86_64-linux-gnu:/lib/aarch64-linux-gnu:/usr/lib/aarch64-linux-gnu:/lib64:/usr/lib"

WORKDIR /base
RUN set -e && \
    printf '%s\n' \
      '#!/bin/sh' \
      'set -e' \
      'ARCH="$(uname -m)"' \
      'case "$ARCH" in' \
      '  x86_64) LIB_ARCH="x86_64-linux-gnu" ;;' \
      '  aarch64|arm64) LIB_ARCH="aarch64-linux-gnu" ;;' \
      '  *) LIB_ARCH="" ;;' \
      'esac' \
      'if [ -n "$LIB_ARCH" ]; then' \
      '  export LD_LIBRARY_PATH="/lib/${LIB_ARCH}:/usr/lib/${LIB_ARCH}:/lib64:/usr/lib"' \
      'fi' \
      'CONF="${PREF_PATH:-/base/pref.toml}"' \
      'CONF_DIR="$(dirname "$CONF")"' \
      'mkdir -p "$CONF_DIR"' \
      'if [ ! -f "$CONF" ] && [ -f /base/pref.example.toml ]; then' \
      '  cp /base/pref.example.toml "$CONF"' \
      'fi' \
      'exec /usr/bin/subconverter -f "$CONF"' \
      > /usr/local/bin/start-subconverter && \
    chmod +x /usr/local/bin/start-subconverter
CMD ["/usr/local/bin/start-subconverter"]
EXPOSE 25500/tcp