多架构镜像构建 + 私有仓库落地：buildx + QEMU + GitHub Actions + Harbor/Trivy/Cosign

+----------+       +---------------+       +------------------------+
| Git Push | ----> | CI (Actions/  | ----> | buildx (QEMU 模拟)     |
|          |       | Drone/Woodpecker)     | 构建多架构镜像         |
+----------+       +---------------+       +-----------+------------+
                                                        |
                                                        v
                                        +-------------------------------+
                                        |  Harbor / GHCR / ZOT 私有仓库 |
                                        |  - 多架构 manifest list      |
                                        |  - Trivy CVE 扫描            |
                                        |  - Cosign 签名验证           |
                                        +----------------+--------------+
                                                         |
                            +----------------------------+-------------+
                            |                    |                     |
                     x86_64 节点           arm64 节点          riscv64 节点
                     docker pull          docker pull          docker pull
                      自动选架构           自动选架构           自动选架构

# Docker 新版自带 buildx 插件
docker buildx version

# 创建构建器，启用 QEMU 跨架构模拟
docker run --rm --privileged tonistiigi/binfmt --install all
docker buildx create --name multiarch --driver docker-container --use
docker buildx inspect --bootstrap

# 验证支持的架构
docker buildx ls
# 应看到: linux/amd64, linux/arm64, linux/arm/v7, linux/arm/v6, linux/riscv64, linux/ppc64le, linux/s390x...

# 单条命令出多架构（以你自己项目为例）
docker buildx build \
  --platform linux/amd64,linux/arm64,linux/arm/v7 \
  --tag registry.example.com/myapp:latest \
  --tag registry.example.com/myapp:v1.2.3 \
  --push \
  .

# 构建到本地 buildx 缓存（不推远程）
docker buildx build --platform linux/arm64 --load -t myapp:arm64 .
# 注意: --load 只能单架构；多架构必须 --push 到仓库

# syntax=docker/dockerfile:1
FROM --platform=$BUILDPLATFORM golang:1.22-alpine AS builder
ARG TARGETOS TARGETARCH
WORKDIR /src
COPY . .
# 交叉编译：在 x86 上出 arm64 二进制（快！无需 QEMU 完整模拟运行）
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -ldflags="-s -w" -o /app .

FROM --platform=$TARGETPLATFORM alpine:3.20
COPY --from=builder /app /usr/local/bin/app
EXPOSE 8080
ENTRYPOINT ["/usr/local/bin/app"]

# ❌ 硬编码架构
FROM amd64/alpine:3.20        # 只出 x86

# ❌ 用未声明多架构的 base
FROM some/tiny-image:latest   # 可能只有 amd64

# ✅ 用官方或明确多架构的镜像
FROM alpine:3.20              # 官方 manifest list 含 amd64/arm64/arm/v7...

# .github/workflows/build-multiarch.yml
name: Build Multi-Arch

on:
  push:
    tags: ['v*']          # 打 tag 才构建
  workflow_dispatch:       # 手动触发

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=ref,event=branch
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=sha

      - name: Build and push
        uses: docker/build-push-action@v6
        with:
          context: .
          platforms: linux/amd64,linux/arm64,linux/arm/v7
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

# harbor.yml（下载官方安装包自带模板，改关键项）
version: "3.8"
services:
  nginx:
    image: goharbor/nginx-photon:v2.11.0
    container_name: nginx
    restart: always
    ports:
      - "80:80"
      - "443:443"
      - "4443:4443"      # Notary
    volumes:
      - ./common/config/nginx:/etc/nginx:z
      - /data/harbor:/harbor
    depends_on:
      - portal
      - core
      - registry
    networks:
      - harbor

  core:
    image: goharbor/harbor-core:v2.11.0
    container_name: harbor-core
    restart: always
    env_file: ./common/config/core/env
    volumes:
      - /data/harbor/data:/data:z
      - /data/harbor/secret:/etc/harbor:z
    networks:
      - harbor

  registry:
    image: goharbor/registry-photon:v2.11.0
    container_name: registry
    restart: always
    volumes:
      - /data/harbor/registry:/storage:z
      - ./common/config/registry:/etc/registry:z
    networks:
      - harbor

  # ... (portal, jobservice, log, redis, database, trivy-adapter, chartmuseum 等)

networks:
  harbor:
    external: false

# 官方一键安装
wget https://github.com/goharbor/harbor/releases/download/v2.11.0/harbor-online-installer-v2.11.0.tgz
tar xzvf harbor-online-installer-v2.11.0.tgz
cd harbor
cp harbor.yml.tmpl harbor.yml
vim harbor.yml   # 改 hostname、密码、数据目录、https 证书
sudo ./install.sh --with-trivy --with-notary --with-chartmuseum

# 1. 扫描：创建项目时勾选「自动扫描」，或用 CLI 手动
trivy image --scanners vuln,misconfig,secret,license \
  --severity HIGH,CRITICAL \
  registry.example.com/myapp:v1.2.3

# 2. 签名：Harbor 支持 Cosign，构建时签名
cosign sign --key cosign.key registry.example.com/myapp:v1.2.3

# 3. Harbor 策略：阻止「高危漏洞」或「未签名」镜像被拉取
#   项目 → 配置 → 漏洞级别策略 → 高危阻断 pull

# 登录（内网/自签证书）
docker login registry.example.com

# 自签证书需加到各节点信任
mkdir -p /etc/docker/certs.d/registry.example.com
cp ca.crt /etc/docker/certs.d/registry.example.com/ca.crt
systemctl restart docker

# 拉取（自动选本机架构）
docker pull registry.example.com/myapp:latest

# 1. 构建多架构并推 GHCR
docker buildx build --platform linux/amd64,linux/arm64 \
  -t ghcr.io/username/myapp:latest --push .

# 2. 本机拉取验证
docker pull ghcr.io/username/myapp:latest
docker image inspect ghcr.io/username/myapp:latest --format '{{.Architecture}}'

# 3. 看 manifest list
docker buildx imagetools inspect ghcr.io/username/myapp:latest
# 输出:
#   Manifest List:
#     Platform: linux/amd64
#     Platform: linux/arm64

#!/usr/bin/env bash
# build-release.sh —— 本地一键出多架构 + 推 GHCR + 扫描 + 签名
set -euo pipefail

IMAGE="ghcr.io/yourname/myapp"
VERSION="${1:-$(date +%Y%m%d%H%M)}"
PLATFORMS="linux/amd64,linux/arm64,linux/arm/v7"

echo ">>> 构建多架构镜像 $IMAGE:$VERSION"
docker buildx build \
  --platform "$PLATFORMS" \
  --tag "$IMAGE:$VERSION" \
  --tag "$IMAGE:latest" \
  --push .

echo ">>> CVE 扫描"
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
  aquasec/trivy image --severity HIGH,CRITICAL "$IMAGE:$VERSION"

echo ">>> 签名"
cosign sign --key cosign.key "$IMAGE:$VERSION"

echo ">>> 验证清单"
docker buildx imagetools inspect "$IMAGE:$VERSION"

echo "✅ 完成！各节点执行: docker pull $IMAGE:latest"