Multi-arch Images والـ Native Modules: اشتغلت عندي

// platforms.js: الـ platforms والـ manifest lists، والـ native binaries بتاعة Node، و lint للـ multi-arch Dockerfile
const ARCH = { x86_64: "amd64", x64: "amd64", amd64: "amd64", aarch64: "arm64", arm64: "arm64", armv7l: "arm", armhf: "arm", arm: "arm" };

export function parsePlatform(s) {
  const [os = "linux", rawArch, rawVariant] = String(s).toLowerCase().split("/");
  const arch = ARCH[rawArch];
  if (!arch) throw new Error(`arch مش معروفة: ${rawArch}`);
  let variant = rawVariant ?? null;
  if (rawArch === "armv7l" || rawArch === "armhf") variant ??= "v7";
  if (arch === "arm64" && variant === "v8") variant = null; // arm64 و arm64/v8 هما نفس الحاجة
  return { os, arch, variant };
}

export const platformString = ({ os, arch, variant }) => [os, arch, variant].filter(Boolean).join("/");

export const nodeArch = (arch) => ({ amd64: "x64", arm64: "arm64", arm: "arm" })[arch];

export function libcOf(image) {
  const [name, tag = "latest"] = String(image).split("@")[0].split(":");
  if (name === "scratch") return null;
  if (/alpine/.test(tag) || /alpine/.test(name)) return "musl";
  return "glibc"; // node:22 و node:22-slim و bookworm و distroless كلهم glibc
}

export function prebuildKey(platform, libc) {
  const p = typeof platform === "string" ? parsePlatform(platform) : platform;
  const base = `${p.os}-${nodeArch(p.arch)}`;
  if (p.os !== "linux") return base;
  return `${base}-${libc === "musl" ? "musl" : "gnu"}`;
}

const MACHINES = { 0x3e: "amd64", 0xb7: "arm64", 0x28: "arm", 0x03: "386" };

export function binaryInfo(buf) {
  if (buf.length >= 4 && buf[0] === 0x7f && buf.toString("latin1", 1, 4) === "ELF") {
    const le = buf[5] === 1;
    const m = le ? buf.readUInt16LE(18) : buf.readUInt16BE(18);
    return { format: "elf", bits: buf[4] === 2 ? 64 : 32, arch: MACHINES[m] ?? `unknown-${m}` };
  }
  const magic = buf.length >= 4 ? buf.readUInt32BE(0) : 0;
  if ([0xcffaedfe, 0xcefaedfe, 0xfeedfacf, 0xfeedface].includes(magic)) return { format: "mach-o", bits: magic === 0xcffaedfe || magic === 0xfeedfacf ? 64 : 32, arch: null };
  if (buf.length >= 2 && buf.toString("latin1", 0, 2) === "MZ") return { format: "pe", bits: null, arch: null };
  return { format: "unknown", bits: null, arch: null };
}

export function selectManifest(entries, host, { emulation = false } = {}) {
  const h = typeof host === "string" ? parsePlatform(host) : host;
  const list = entries.map((e) => ({ ...e, p: parsePlatform(e.platform) }));
  const exact = list.find((e) => e.p.os === h.os && e.p.arch === h.arch && (e.p.variant ?? null) === (h.variant ?? null))
    ?? list.find((e) => e.p.os === h.os && e.p.arch === h.arch);
  if (exact) return { platform: platformString(exact.p), digest: exact.digest, emulated: false };
  const other = list.find((e) => e.p.os === h.os);
  if (emulation && other) return { platform: platformString(other.p), digest: other.digest, emulated: true };
  throw Object.assign(new Error(`no matching manifest for ${platformString(h)} in the
…

$ node lab.js
=== الـ machine دي ===
  process.platform linux | process.arch x64 | libc glibc
  الـ node binary نفسه: {"format":"elf","bits":64,"arch":"amd64"}
  الـ prebuild اللي npm هيدوّر عليه هنا: linux-x64-gnu
  و binary اتعمل على Mac: {"format":"mach-o","bits":64,"arch":null}

=== docker pull: أنهي manifest؟ ===
  linux/amd64    server في الـ cloud  ← linux/amd64 sha256:aa11
  linux/aarch64  Graviton أو Mac M    ← linux/arm64 sha256:bb22
  linux/arm/v7   Raspberry Pi قديم    ← no matching manifest for linux/arm/v7 in the manifest list entries
  linux/arm/v7   ونفس الـ Pi بـ QEMU  ← linux/amd64 sha256:aa11 (emulated، أبطأ بكتير)

=== الـ native modules ===
  npm install على Mac M، و COPY node_modules:
     WRONG-BINARY      sharp اتعمل لـ darwin-arm64 وشغّال على linux-x64-gnu: ERR_DLOPEN_FAILED
     WRONG-BINARY      bcrypt اتعمل لـ darwin-arm64 وشغّال على linux-x64-gnu: ERR_DLOPEN_FAILED
  npm ci على BUILDPLATFORM amd64، والـ image arm64:
     WRONG-BINARY      sharp اتعمل لـ linux-x64-gnu وشغّال على linux-arm64-gnu: ERR_DLOPEN_FAILED
     WRONG-BINARY      bcrypt اتعمل لـ linux-x64-gnu وشغّال على linux-arm64-gnu: ERR_DLOPEN_FAILED
  npm ci على glibc، والـ image alpine:
     
…

FROM --platform=linux/amd64 node:22-slim
WORKDIR /app
COPY package.json package-lock.json ./
# node_modules جاهزة من الـ laptop، علشان الـ build يبقى أسرع
COPY node_modules ./node_modules
COPY . .
CMD ["node", "server.js"]

# syntax=docker/dockerfile:1
# npm ci على الـ build machine من غير emulation، وبعدين ننقل node_modules لـ alpine صغيرة
FROM --platform=$BUILDPLATFORM node:22 AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev

FROM node:22-alpine
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
CMD ["node", "server.js"]

# syntax=docker/dockerfile:1
# الـ TypeScript compile بيطلّع JS عادي، فينفع على الـ build machine بسرعة
FROM --platform=$BUILDPLATFORM node:22-slim AS build
WORKDIR /app
COPY package*.json ./
RUN --mount=type=cache,target=/root/.npm npm ci
COPY . .
RUN npm run build

# الـ production dependencies على الـ target platform نفسها، علشان sharp و bcrypt ياخدوا الـ binary الصح
FROM node:22-slim AS deps
WORKDIR /app
COPY package*.json ./
RUN --mount=type=cache,target=/root/.npm,id=npm-$TARGETPLATFORM npm ci --omit=dev

FROM node:22-slim
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY --from=build /app/dist ./dist
USER node
CMD ["node", "dist/server.js"]

# buildx.sh: image واحدة لأكتر من platform

# مرة واحدة على الـ machine: QEMU للـ emulation، و builder بيدعم multi-platform
docker run --privileged --rm tonistiigi/binfmt --install all
docker buildx create --name multi --use

# build للاتنين و push لـ manifest list واحدة بنفس الـ tag
docker buildx build --platform linux/amd64,linux/arm64 -t registry.example.com/shop-api:1.6.0 --push .

# شوف الـ manifest list: digest لكل platform
docker buildx imagetools inspect registry.example.com/shop-api:1.6.0

# جرّب الـ arm64 على machine تانية (بـ QEMU، أبطأ بكتير)
docker run --rm --platform linux/arm64 registry.example.com/shop-api:1.6.0 node -p "process.arch"

# جُوّه الـ Dockerfile، BuildKit بيدّيك:
#   BUILDPLATFORM  ← الـ machine اللي بتعمل build (linux/amd64 في الـ CI مثلًا)
#   TARGETPLATFORM ← الـ platform اللي الـ stage بتتبني ليها (linux/arm64)
#   TARGETOS و TARGETARCH و TARGETVARIANT
# أسرع حل للـ CI: runner لكل arch (arm64 runner + amd64 runner) وبعدين imagetools create يجمعهم

// lab.js: إحنا شغّالين على إيه فعلًا، وأنهي image هتتشد، والـ native modules هتشتغل ولا لأ
import { readFileSync } from "node:fs";
import { binaryInfo, prebuildKey, selectManifest, checkNative, lintDockerfile, parsePlatform, platformString } from "./platforms.js";

const head = readFileSync(process.execPath).subarray(0, 64);
const libc = process.report.getReport().header.glibcVersionRuntime ? "glibc" : "musl";
console.log("=== الـ machine دي ===");
console.log(`  process.platform ${process.platform} | process.arch ${process.arch} | libc ${libc}`);
console.log(`  الـ node binary نفسه: ${JSON.stringify(binaryInfo(head))}`);
console.log(`  الـ prebuild اللي npm هيدوّر عليه هنا: ${prebuildKey(`${process.platform}/${process.arch}`, libc)}`);
console.log(`  و binary اتعمل على Mac: ${JSON.stringify(binaryInfo(Buffer.from([0xcf, 0xfa, 0xed, 0xfe, 0x0c, 0, 0, 1])))}`);

console.log("\n=== docker pull: أنهي manifest؟ ===");
const list = [{ platform: "linux/amd64", digest: "sha256:aa11" }, { platform: "linux/arm64/v8", digest: "sha256:bb22" }];
for (const [host, opts, what] of [["linux/amd64", {}, "server في الـ cloud"], ["linux/aarch64", {}, "Graviton أو Mac M"], ["linux/arm/v7", {}, "Raspberry Pi قديم"], ["linux/arm/v7", { emulation: true }, "ونفس الـ Pi بـ QEMU"]]) {
  try { const r = selectManifest(list, host, opts); console.log(`  ${host.padEnd(14)} ${what.padEnd(20)} ← ${r.platform} ${r.digest}${r.emulated ? " (emulated، أبطأ بكتير)" : ""}`); }
  catch (e) { console.log(`  ${host.padEnd(14)} ${what.padEnd(20)} ← ${e.message}`); }
}

console.log("\n=== الـ native modules ===");
const native = [
  { name: "sharp", prebuilds: ["darwin-arm64", "linux-x64-gnu", "linux-arm64-gnu", "linux-x64-musl", "linux-arm64-musl"] },
  { name: "bcrypt", prebuilds: ["linux-x64-gnu", "darwin-arm64"] },
];
for (const [what, installedOn, runsOn] of [
  ["npm install على Mac M، و COPY node_modules", "darwin-arm64", prebuildKey("linux/amd64", "glibc")],
  ["npm ci على BUILDPLATFORM amd64، والـ image arm64", "linux-x64-gnu", prebuildKey("linux/arm64", "glibc")],
  ["npm ci على glibc، والـ image alpine", "linux-x64-gnu", prebuildKey("linux/amd64", "musl")],
  ["npm ci على الـ target arm64 نفسها", "linux-arm64-gnu", prebuildKey("linux/arm64", "glibc")],
]) {
  console.log(`  ${what}:`);
  for (const r of checkNative(native, { installedOn, runsOn })) console.log(`     ${r.status.padEnd(17)} ${r.msg}`);
}

console.log("\n=== lint ===");
for (const file of ["Dockerfile.naive", "Dockerfile.cross", "Dockerfile"]) {
  const found = lintDockerfile(readFileSync(file, "utf8"), { native: ["sharp", "bcrypt"] });
  console.log(`  ${file}: ${found.length ? "" : "نضيف"}`);
  for (const f of found) console.log(`     ${f.severity} ${f.rule} (stage ${f.stage}): ${f.msg}`);
}
console.log(`\n  platformString(parsePlatform("Linux/x86_64")) ← ${platformString(parsePlatform("Linux/x86_64"))}`);