arm构建

2026-07-06 11:01:30 +08:00
parent cc3518897f
commit b5cbc7fbee
34 changed files with 1321 additions and 1055 deletions
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -4,11 +4,97 @@

 - `server/`: 本仓库 RTR Server（`src/main.rs`）容器化部署
 - `client/`: 本仓库 `rtr_debug_client` 容器化部署
- `rpki-rs-client/`: 基于外部 `rpki-rs` client API 的测试客户端容器化部署
 - `frr/`: FRR 作为黑盒 RTR Client 的配置与 compose

 ---

+## 0) Build and Run Scripts
+
+`deploy/server/build-run.sh` 只管理 server，`deploy/client/build-run.sh` 只管理 debug client。两个脚本默认 action 都是 `up`，默认 mode 都是 `tcp`。
+
+常用命令：
+
+以下命令默认从仓库根目录执行。
+
+```bash
+chmod +x deploy/server/build-run.sh deploy/client/build-run.sh
+./deploy/server/build-run.sh up --mode tcp
+./deploy/client/build-run.sh up --mode tcp
+./deploy/client/build-run.sh up --clients multi
+./deploy/client/build-run.sh down
+./deploy/server/build-run.sh down
+```
+
+常用参数：
+
+| 参数/变量 | server | client | 说明 |
+| --- | --- | --- | --- |
+| `--mode base\|tcp\|tls\|ssh`, `MODE` | yes | yes | 选择 compose 模式，默认 `tcp`。 |
+| `--clients single\|multi`, `CLIENTS` | no | yes | 单 client 或 5 client，默认 `single`。 |
+| `--no-build`, `BUILD=0` | yes | yes | 只运行已有镜像，不执行 compose build。 |
+| `--server-image TAG`, `SERVER_IMAGE` | yes | no | server 镜像名；会传给 compose 的 `RPKI_RTR_SERVER_IMAGE`。 |
+| `--client-image TAG`, `CLIENT_IMAGE` | no | yes | client 镜像名；会传给 compose 的 `RPKI_RTR_CLIENT_IMAGE`。 |
+| `--platform VALUE`, `TARGET_PLATFORM` | yes | yes | `buildx` 目标平台，默认 `linux/arm64`。 |
+| `--push`, `BUILDX_PUSH=1` | yes | yes | `buildx` 构建后推送到 registry；不设置时加载到本地 Docker。 |
+| `--skip-base-pull`, `SKIP_BASE_IMAGE_PULL=1` | yes | yes | 跳过 buildx 前的基础镜像预拉取。 |
+
+支持的 action 包括 `up`、`build`、`buildx`、`rebuild`、`down`/`stop`、`restart`、`logs`、`ps`。完整帮助见：
+
+```bash
+./deploy/server/build-run.sh --help
+./deploy/client/build-run.sh --help
+```
+
+### x86 Build, ARM Deploy
+
+x86 开发机上用 Docker Buildx 分别构建 ARM server/client 镜像。不加 `--push` 时，脚本会把单平台镜像加载到本地 Docker，随后可用 `docker save` 打包传到 ARM 机器。buildx 前会自动按目标平台预拉取 `rust:1.89-bookworm` 和 `debian:bookworm-slim`。
+
+```bash
+docker buildx create --use --name rpki-builder
+docker buildx inspect --bootstrap
+
+./deploy/server/build-run.sh buildx \
+  --platform linux/arm64 \
+  --server-image rpki-rtr:arm64
+
+./deploy/client/build-run.sh buildx \
+  --platform linux/arm64 \
+  --client-image rpki-rtr-debug-client:arm64
+
+mkdir -p dist/images
+docker save rpki-rtr:arm64 -o dist/images/rpki-rtr-arm64.tar
+docker save rpki-rtr-debug-client:arm64 -o dist/images/rpki-rtr-debug-client-arm64.tar
+```
+
+把 tar 包传到 ARM 部署机：
+
+```bash
+scp dist/images/*.tar user@arm-host:/tmp/
+```
+
+ARM 部署机上加载镜像并运行，不再本地构建：
+
+```bash
+docker load -i /tmp/rpki-rtr-arm64.tar
+docker load -i /tmp/rpki-rtr-debug-client-arm64.tar
+
+SERVER_IMAGE=rpki-rtr:arm64 \
+BUILD=0 ./deploy/server/build-run.sh up --mode tcp
+
+CLIENT_IMAGE=rpki-rtr-debug-client:arm64 \
+BUILD=0 ./deploy/client/build-run.sh up --mode tcp
+```
+
+如果不使用脚本，也可以通过 compose 环境变量指定镜像：
+
+```bash
+export RPKI_RTR_SERVER_IMAGE=rpki-rtr:arm64
+docker compose --env-file deploy/server/.env \
+  -f deploy/server/docker-compose.tcp.yml up -d --no-build
+```
+
+---
+
 ## 1) Server

 路径：
@@ -117,46 +203,7 @@ docker compose -f deploy/client/docker-compose.clients.yml logs -f

 ---

-## 3) rpki-rs Client
-
-路径：
- `deploy/rpki-rs-client/Dockerfile`
- `deploy/rpki-rs-client/docker-compose.yml`
-
-单独 build 镜像：
-
-```bash
-docker build -f deploy/rpki-rs-client/Dockerfile -t rpki-rs-test-client:latest .
-```
-
-默认启动（自动 serial 测试）：
-
-```bash
-docker compose -f deploy/rpki-rs-client/docker-compose.yml up --build
-```
-
-覆盖默认参数运行：
-
-```bash
-docker compose -f deploy/rpki-rs-client/docker-compose.yml run --rm \
-  rpki-rs-test-client 127.0.0.1:323 2 reset --steps 1 --assert-min-records 1
-```
-
-停止：
-
-```bash
-docker compose -f deploy/rpki-rs-client/docker-compose.yml down
-```
-
-日志：
-
-```bash
-docker compose -f deploy/rpki-rs-client/docker-compose.yml logs -f rpki-rs-test-client
-```
-
---
-
-## 4) FRR Client
+## 3) FRR Client

 路径：
 - `deploy/frr/docker-compose.yml`
@@ -192,7 +239,7 @@ docker compose -f deploy/frr/docker-compose.yml logs -f frr-rpki-client

 ---

-## 5) BIRD Client
+## 4) BIRD Client

 路径:
 - `deploy/bird/Dockerfile`
--- a/deploy/client/build-run.sh
+++ b/deploy/client/build-run.sh
@@ -0,0 +1,237 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "${SCRIPT_DIR}/../.." && pwd)"
+
+MODE="${MODE:-tcp}"
+ACTION="up"
+DETACH="${DETACH:-1}"
+BUILD="${BUILD:-1}"
+CLIENTS="${CLIENTS:-single}"
+TARGET_PLATFORM="${TARGET_PLATFORM:-linux/arm64}"
+CLIENT_IMAGE="${CLIENT_IMAGE:-${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}}"
+BUILDX_PUSH="${BUILDX_PUSH:-0}"
+BUILDX_BUILDER="${BUILDX_BUILDER:-}"
+SKIP_BASE_IMAGE_PULL="${SKIP_BASE_IMAGE_PULL:-0}"
+
+usage() {
+  cat <<'EOF'
+Usage:
+  deploy/client/build-run.sh [action] [options]
+
+Actions:
+  up            Build and run debug client (default)
+  build         Build debug client image
+  buildx        Build debug client image with docker buildx
+  rebuild       Rebuild image without cache, then run client
+  down|stop     Stop client compose stack
+  restart       Stop, then build and run client
+  logs          Follow client logs
+  ps            Show client compose status
+
+Options:
+  --mode MODE       base|tcp|tls|ssh (default: tcp)
+  --clients MODE    single|multi (default: single)
+  --platform VALUE  Target platform for buildx (default: linux/arm64)
+  --client-image TAG
+                    Client image tag for buildx and compose
+  --push            Push buildx image instead of loading it locally
+  --builder NAME    buildx builder name
+  --skip-base-pull  Do not pull Dockerfile base images before buildx
+  --foreground      Run single client in foreground
+  --no-build        Start without --build
+  -h|--help         Show this help
+EOF
+}
+
+die() {
+  echo "error: $*" >&2
+  exit 1
+}
+
+has_compose() {
+  docker compose version >/dev/null 2>&1
+}
+
+has_buildx() {
+  docker buildx version >/dev/null 2>&1
+}
+
+pull_base_images() {
+  [[ "${SKIP_BASE_IMAGE_PULL}" == "1" ]] && return
+
+  local platform image
+  local -a platforms images
+  IFS=',' read -r -a platforms <<< "${TARGET_PLATFORM}"
+  images=(rust:1.89-bookworm debian:bookworm-slim)
+
+  for platform in "${platforms[@]}"; do
+    for image in "${images[@]}"; do
+      docker pull --platform "${platform}" "${image}"
+    done
+  done
+}
+
+compose_files() {
+  if [[ "${CLIENTS}" == "multi" ]]; then
+    [[ "${MODE}" == "tcp" || "${MODE}" == "base" ]] || die "--clients multi is only defined for tcp/base mode"
+    printf '%s\n' -f "${SCRIPT_DIR}/docker-compose.clients.yml"
+    return
+  fi
+
+  case "${MODE}" in
+    base) printf '%s\n' -f "${SCRIPT_DIR}/docker-compose.yml" ;;
+    tcp) printf '%s\n' -f "${SCRIPT_DIR}/docker-compose.tcp.yml" ;;
+    tls) printf '%s\n' -f "${SCRIPT_DIR}/docker-compose.tls.yml" ;;
+    ssh) printf '%s\n' -f "${SCRIPT_DIR}/docker-compose.ssh.yml" ;;
+    *) die "unsupported mode '${MODE}', expected base|tcp|tls|ssh" ;;
+  esac
+}
+
+compose_args() {
+  local -a args files
+  args=()
+  [[ -f "${SCRIPT_DIR}/.env" ]] && args+=(--env-file "${SCRIPT_DIR}/.env")
+  mapfile -t files < <(compose_files)
+  args+=("${files[@]}")
+  printf '%s\n' "${args[@]}"
+}
+
+compose_run() {
+  local -a args
+  mapfile -t args < <(compose_args)
+  docker compose "${args[@]}" "$@"
+}
+
+up_client() {
+  local -a up_args
+  up_args=(up)
+  [[ "${CLIENTS}" == "multi" || "${DETACH}" == "1" ]] && up_args+=(-d)
+  [[ "${BUILD}" == "1" && "${CLIENTS}" != "multi" ]] && up_args+=(--build)
+  compose_run "${up_args[@]}"
+}
+
+build_client() {
+  if [[ "${CLIENTS}" == "multi" ]]; then
+    docker build "$@" -f "${SCRIPT_DIR}/Dockerfile" -t "${CLIENT_IMAGE}" "${REPO_ROOT}"
+  else
+    compose_run build "$@"
+  fi
+}
+
+buildx_client() {
+  has_buildx || die "docker buildx is not available"
+  if [[ "${TARGET_PLATFORM}" == *,* && "${BUILDX_PUSH}" != "1" ]]; then
+    die "multi-platform buildx output requires --push"
+  fi
+
+  local -a output_args builder_args
+  [[ "${BUILDX_PUSH}" == "1" ]] && output_args=(--push) || output_args=(--load)
+  [[ -n "${BUILDX_BUILDER}" ]] && builder_args=(--builder "${BUILDX_BUILDER}") || builder_args=()
+
+  pull_base_images
+
+  docker buildx build "${builder_args[@]}" \
+    --platform "${TARGET_PLATFORM}" \
+    -f "${SCRIPT_DIR}/Dockerfile" \
+    -t "${CLIENT_IMAGE}" \
+    "${output_args[@]}" \
+    "${REPO_ROOT}"
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    up|build|buildx|rebuild|down|stop|restart|logs|ps)
+      ACTION="$1"
+      shift
+      ;;
+    --mode)
+      [[ $# -ge 2 ]] || die "--mode requires a value"
+      MODE="$2"
+      shift 2
+      ;;
+    --clients)
+      [[ $# -ge 2 ]] || die "--clients requires a value"
+      CLIENTS="$2"
+      shift 2
+      ;;
+    --platform)
+      [[ $# -ge 2 ]] || die "--platform requires a value"
+      TARGET_PLATFORM="$2"
+      shift 2
+      ;;
+    --client-image)
+      [[ $# -ge 2 ]] || die "--client-image requires a value"
+      CLIENT_IMAGE="$2"
+      shift 2
+      ;;
+    --push)
+      BUILDX_PUSH=1
+      shift
+      ;;
+    --builder)
+      [[ $# -ge 2 ]] || die "--builder requires a value"
+      BUILDX_BUILDER="$2"
+      shift 2
+      ;;
+    --skip-base-pull)
+      SKIP_BASE_IMAGE_PULL=1
+      shift
+      ;;
+    --foreground)
+      DETACH=0
+      shift
+      ;;
+    --no-build)
+      BUILD=0
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      die "unknown argument '$1'"
+      ;;
+  esac
+done
+
+[[ "${CLIENTS}" == "single" || "${CLIENTS}" == "multi" ]] || die "unsupported clients '${CLIENTS}', expected single|multi"
+export RPKI_RTR_CLIENT_IMAGE="${CLIENT_IMAGE}"
+if [[ "${ACTION}" == "buildx" ]]; then
+  has_buildx || die "docker buildx is not available"
+else
+  has_compose || die "docker compose is not available"
+fi
+
+cd "${REPO_ROOT}"
+
+case "${ACTION}" in
+  up)
+    up_client
+    ;;
+  build)
+    build_client
+    ;;
+  buildx)
+    buildx_client
+    ;;
+  rebuild)
+    build_client --no-cache
+    up_client
+    ;;
+  down|stop)
+    compose_run down
+    ;;
+  restart)
+    compose_run down
+    up_client
+    ;;
+  logs)
+    compose_run logs -f
+    ;;
+  ps)
+    compose_run ps
+    ;;
+esac
--- a/deploy/client/docker-compose.clients.yml
+++ b/deploy/client/docker-compose.clients.yml
@@ -2,7 +2,7 @@ version: "3.9"

 services:
  rtr-client-1:
-    image: rpki-rtr-debug-client:latest
+    image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
    volumes:
      - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
@@ -11,7 +11,7 @@ services:
      - rpki_net

  rtr-client-2:
-    image: rpki-rtr-debug-client:latest
+    image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
    volumes:
      - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
@@ -20,7 +20,7 @@ services:
      - rpki_net

  rtr-client-3:
-    image: rpki-rtr-debug-client:latest
+    image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
    volumes:
      - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
@@ -29,7 +29,7 @@ services:
      - rpki_net

  rtr-client-4:
-    image: rpki-rtr-debug-client:latest
+    image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
    volumes:
      - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
@@ -38,7 +38,7 @@ services:
      - rpki_net

  rtr-client-5:
-    image: rpki-rtr-debug-client:latest
+    image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
    volumes:
      - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
--- a/deploy/client/docker-compose.ssh.password.yml
+++ b/deploy/client/docker-compose.ssh.password.yml
@@ -5,7 +5,7 @@ services:
    build:
      context: ../..
      dockerfile: deploy/client/Dockerfile
-    image: rpki-rtr-debug-client:latest
+    image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
    command:
      [
        "${RPKI_RTR_SERVER_ADDR:-rpki-rtr-ssh:22}",
--- a/deploy/client/docker-compose.ssh.yml
+++ b/deploy/client/docker-compose.ssh.yml
@@ -5,7 +5,7 @@ services:
    build:
      context: ../..
      dockerfile: deploy/client/Dockerfile
-    image: rpki-rtr-debug-client:latest
+    image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
    command:
      [
        "${RPKI_RTR_SERVER_ADDR:-rpki-rtr-ssh:22}",
--- a/deploy/client/docker-compose.tcp.yml
+++ b/deploy/client/docker-compose.tcp.yml
@@ -3,7 +3,7 @@ services:
    build:
      context: ../..
      dockerfile: deploy/client/Dockerfile
-    image: rpki-rtr-debug-client:latest
+    image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
    volumes:
      - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
--- a/deploy/client/docker-compose.tls.yml
+++ b/deploy/client/docker-compose.tls.yml
@@ -5,7 +5,7 @@ services:
    build:
      context: ../..
      dockerfile: deploy/client/Dockerfile
-    image: rpki-rtr-debug-client:latest
+    image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
    command:
      [
        "${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tls:324}",
--- a/deploy/client/docker-compose.yml
+++ b/deploy/client/docker-compose.yml
@@ -3,7 +3,7 @@ services:
    build:
      context: ../..
      dockerfile: deploy/client/Dockerfile
-    image: rpki-rtr-debug-client:latest
+    image: ${RPKI_RTR_CLIENT_IMAGE:-rpki-rtr-debug-client:latest}
    command: ["${RPKI_RTR_SERVER_ADDR:-rpki-rtr-tcp:323}", "${RPKI_RTR_PROTOCOL_VERSION:-2}", "reset", "--keep-after-error", "--summary-only"]
    volumes:
      - ${RPKI_RTR_CLIENT_LOG_HOST_DIR:-../../logs/client}:/app/logs
--- a/deploy/server/.env
+++ b/deploy/server/.env
@@ -16,7 +16,6 @@ RPKI_RTR_DB_PATH=/app/rtr-db
 RPKI_RTR_REPORT_DIR=/app/report

 # Core runtime knobs.
-RPKI_RTR_STRICT_CCR_VALIDATION=false
 RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS=300
 RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS=300
 RPKI_RTR_REPORT_HISTORY_LIMIT=10
--- a/deploy/server/DEPLOYMENT.md
+++ b/deploy/server/DEPLOYMENT.md
@@ -35,7 +35,7 @@ The container runs `rpki` directly as PID 1.

 ## Runtime Configuration via `.env`

- Core: `RPKI_RTR_STRICT_CCR_VALIDATION`, `RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS`, `RPKI_RTR_MAX_DELTA`, `RPKI_RTR_MAX_CONCURRENT_HANDSHAKES`, `RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS`, `RPKI_RTR_REPORT_HISTORY_LIMIT`, `RPKI_RTR_TIMEZONE`, `RPKI_RTR_ADMIN_ADDR`, `RPKI_RTR_ADMIN_TOKEN`, `RUST_LOG`
+- Core: `RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS`, `RPKI_RTR_MAX_DELTA`, `RPKI_RTR_MAX_CONCURRENT_HANDSHAKES`, `RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS`, `RPKI_RTR_REPORT_HISTORY_LIMIT`, `RPKI_RTR_TIMEZONE`, `RPKI_RTR_ADMIN_ADDR`, `RPKI_RTR_ADMIN_TOKEN`, `RUST_LOG`
 - TCP mode: `RPKI_RTR_MAX_CONNECTIONS`
 - TLS mode: `RPKI_RTR_ENFORCE_TLS_CLIENT_SAN_IP_MATCH`, `RPKI_RTR_TLS_CERT_PATH`, `RPKI_RTR_TLS_KEY_PATH`, `RPKI_RTR_TLS_CLIENT_CA_PATH`, `RPKI_RTR_TLS_CERTS_HOST_DIR`
 - SSH mode: `RPKI_RTR_SSH_HOST_PORT`, `RPKI_RTR_SSH_CONTAINER_PORT`, `RPKI_RTR_SSH_AUTH_MODE`, `RPKI_RTR_SSH_USERNAME`, `RPKI_RTR_SSH_SUBSYSTEM_NAME`, `RPKI_RTR_SSH_HOST_KEY_PATH`, `RPKI_RTR_SSH_AUTHORIZED_KEYS_PATH`, `RPKI_RTR_SSH_KEYS_VOLUME`, `RPKI_RTR_SSH_CERTS_HOST_DIR`
--- a/deploy/server/Dockerfile
+++ b/deploy/server/Dockerfile
@@ -2,6 +2,8 @@ FROM rust:1.89-bookworm AS builder

 WORKDIR /build

+ENV CARGO_BUILD_JOBS=2
+
 RUN set -eux; \
    cat > /etc/apt/sources.list.d/debian.sources <<'EOF'
 Types: deb
@@ -75,7 +77,6 @@ ENV RPKI_RTR_ENABLE_TLS=false \
    RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS=300 \
    RPKI_RTR_REPORT_HISTORY_LIMIT=10 \
    RPKI_RTR_REFRESH_INTERVAL_SECS=300 \
-    RPKI_RTR_STRICT_CCR_VALIDATION=false \
    RPKI_RTR_ADMIN_ADDR="" \
    RPKI_RTR_ADMIN_TOKEN=""

--- a/deploy/server/build-run.sh
+++ b/deploy/server/build-run.sh
@@ -0,0 +1,215 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd -- "${SCRIPT_DIR}/../.." && pwd)"
+
+MODE="${MODE:-tcp}"
+ACTION="up"
+DETACH="${DETACH:-1}"
+BUILD="${BUILD:-1}"
+TARGET_PLATFORM="${TARGET_PLATFORM:-linux/arm64}"
+SERVER_IMAGE="${SERVER_IMAGE:-${RPKI_RTR_SERVER_IMAGE:-rpki-rtr:latest}}"
+BUILDX_PUSH="${BUILDX_PUSH:-0}"
+BUILDX_BUILDER="${BUILDX_BUILDER:-}"
+SKIP_BASE_IMAGE_PULL="${SKIP_BASE_IMAGE_PULL:-0}"
+
+usage() {
+  cat <<'EOF'
+Usage:
+  deploy/server/build-run.sh [action] [options]
+
+Actions:
+  up            Build and start server (default)
+  build         Build server image with docker compose
+  buildx        Build server image with docker buildx
+  rebuild       Rebuild image without cache, then start server
+  down|stop     Stop server compose stack
+  restart       Stop, then build and start server
+  logs          Follow server logs
+  ps            Show server compose status
+
+Options:
+  --mode MODE       base|tcp|tls|ssh (default: tcp)
+  --platform VALUE  Target platform for buildx (default: linux/arm64)
+  --server-image TAG
+                    Server image tag for buildx and compose
+  --push            Push buildx image instead of loading it locally
+  --builder NAME    buildx builder name
+  --skip-base-pull  Do not pull Dockerfile base images before buildx
+  --foreground      Run server in foreground
+  --no-build        Start without --build
+  -h|--help         Show this help
+EOF
+}
+
+die() {
+  echo "error: $*" >&2
+  exit 1
+}
+
+has_compose() {
+  docker compose version >/dev/null 2>&1
+}
+
+has_buildx() {
+  docker buildx version >/dev/null 2>&1
+}
+
+pull_base_images() {
+  [[ "${SKIP_BASE_IMAGE_PULL}" == "1" ]] && return
+
+  local platform image
+  local -a platforms images
+  IFS=',' read -r -a platforms <<< "${TARGET_PLATFORM}"
+  images=(rust:1.89-bookworm debian:bookworm-slim)
+
+  for platform in "${platforms[@]}"; do
+    for image in "${images[@]}"; do
+      docker pull --platform "${platform}" "${image}"
+    done
+  done
+}
+
+compose_files() {
+  case "${MODE}" in
+    base) printf '%s\n' -f "${SCRIPT_DIR}/docker-compose.yml" ;;
+    tcp) printf '%s\n' -f "${SCRIPT_DIR}/docker-compose.tcp.yml" ;;
+    tls) printf '%s\n' -f "${SCRIPT_DIR}/docker-compose.tls.yml" ;;
+    ssh) printf '%s\n' -f "${SCRIPT_DIR}/docker-compose.ssh.yml" ;;
+    *) die "unsupported mode '${MODE}', expected base|tcp|tls|ssh" ;;
+  esac
+}
+
+compose_args() {
+  local -a args files
+  args=()
+  [[ -f "${SCRIPT_DIR}/.env" ]] && args+=(--env-file "${SCRIPT_DIR}/.env")
+  mapfile -t files < <(compose_files)
+  args+=("${files[@]}")
+  printf '%s\n' "${args[@]}"
+}
+
+compose_run() {
+  local -a args
+  mapfile -t args < <(compose_args)
+  docker compose "${args[@]}" "$@"
+}
+
+up_server() {
+  local -a up_args
+  up_args=(up)
+  [[ "${DETACH}" == "1" ]] && up_args+=(-d)
+  [[ "${BUILD}" == "1" ]] && up_args+=(--build)
+  compose_run "${up_args[@]}"
+}
+
+buildx_server() {
+  has_buildx || die "docker buildx is not available"
+  if [[ "${TARGET_PLATFORM}" == *,* && "${BUILDX_PUSH}" != "1" ]]; then
+    die "multi-platform buildx output requires --push"
+  fi
+
+  local -a output_args builder_args
+  [[ "${BUILDX_PUSH}" == "1" ]] && output_args=(--push) || output_args=(--load)
+  [[ -n "${BUILDX_BUILDER}" ]] && builder_args=(--builder "${BUILDX_BUILDER}") || builder_args=()
+
+  pull_base_images
+
+  docker buildx build "${builder_args[@]}" \
+    --platform "${TARGET_PLATFORM}" \
+    -f "${SCRIPT_DIR}/Dockerfile" \
+    -t "${SERVER_IMAGE}" \
+    "${output_args[@]}" \
+    "${REPO_ROOT}"
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    up|build|buildx|rebuild|down|stop|restart|logs|ps)
+      ACTION="$1"
+      shift
+      ;;
+    --mode)
+      [[ $# -ge 2 ]] || die "--mode requires a value"
+      MODE="$2"
+      shift 2
+      ;;
+    --platform)
+      [[ $# -ge 2 ]] || die "--platform requires a value"
+      TARGET_PLATFORM="$2"
+      shift 2
+      ;;
+    --server-image)
+      [[ $# -ge 2 ]] || die "--server-image requires a value"
+      SERVER_IMAGE="$2"
+      shift 2
+      ;;
+    --push)
+      BUILDX_PUSH=1
+      shift
+      ;;
+    --builder)
+      [[ $# -ge 2 ]] || die "--builder requires a value"
+      BUILDX_BUILDER="$2"
+      shift 2
+      ;;
+    --skip-base-pull)
+      SKIP_BASE_IMAGE_PULL=1
+      shift
+      ;;
+    --foreground)
+      DETACH=0
+      shift
+      ;;
+    --no-build)
+      BUILD=0
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      die "unknown argument '$1'"
+      ;;
+  esac
+done
+
+export RPKI_RTR_SERVER_IMAGE="${SERVER_IMAGE}"
+if [[ "${ACTION}" == "buildx" ]]; then
+  has_buildx || die "docker buildx is not available"
+else
+  has_compose || die "docker compose is not available"
+fi
+
+cd "${REPO_ROOT}"
+
+case "${ACTION}" in
+  up)
+    up_server
+    ;;
+  build)
+    compose_run build
+    ;;
+  buildx)
+    buildx_server
+    ;;
+  rebuild)
+    compose_run build --no-cache
+    up_server
+    ;;
+  down|stop)
+    compose_run down
+    ;;
+  restart)
+    compose_run down
+    up_server
+    ;;
+  logs)
+    compose_run logs -f
+    ;;
+  ps)
+    compose_run ps
+    ;;
+esac
--- a/deploy/server/docker-compose.ssh.yml
+++ b/deploy/server/docker-compose.ssh.yml
@@ -5,7 +5,7 @@ services:
    build:
      context: ../..
      dockerfile: deploy/server/Dockerfile
-    image: rpki-rtr:latest
+    image: ${RPKI_RTR_SERVER_IMAGE:-rpki-rtr:latest}
    container_name: rpki-rtr-ssh
    restart: no
    ports:
@@ -32,7 +32,6 @@ services:
      RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS: "${RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS:-300}"
      RPKI_RTR_REPORT_HISTORY_LIMIT: "${RPKI_RTR_REPORT_HISTORY_LIMIT:-10}"
      RPKI_RTR_TIMEZONE: "${RPKI_RTR_TIMEZONE:-Asia/Shanghai}"
-      RPKI_RTR_STRICT_CCR_VALIDATION: "${RPKI_RTR_STRICT_CCR_VALIDATION:-false}"
      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:-300}"
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "${RPKI_RTR_MAX_CONCURRENT_HANDSHAKES:-128}"
--- a/deploy/server/docker-compose.tcp.yml
+++ b/deploy/server/docker-compose.tcp.yml
@@ -5,7 +5,7 @@ services:
    build:
      context: ../..
      dockerfile: deploy/server/Dockerfile
-    image: rpki-rtr:latest
+    image: ${RPKI_RTR_SERVER_IMAGE:-rpki-rtr:latest}
    container_name: rpki-rtr-tcp
    restart: no
    ports:
@@ -22,7 +22,6 @@ services:
      RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS: "${RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS:-300}"
      RPKI_RTR_REPORT_HISTORY_LIMIT: "${RPKI_RTR_REPORT_HISTORY_LIMIT:-10}"
      RPKI_RTR_TIMEZONE: "${RPKI_RTR_TIMEZONE:-Asia/Shanghai}"
-      RPKI_RTR_STRICT_CCR_VALIDATION: "${RPKI_RTR_STRICT_CCR_VALIDATION:-false}"
      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:-60}"
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
      RPKI_RTR_MAX_CONNECTIONS: "${RPKI_RTR_MAX_CONNECTIONS:-100000}"
--- a/deploy/server/docker-compose.tls.yml
+++ b/deploy/server/docker-compose.tls.yml
@@ -3,7 +3,7 @@ services:
    build:
      context: ../..
      dockerfile: deploy/server/Dockerfile
-    image: rpki-rtr:latest
+    image: ${RPKI_RTR_SERVER_IMAGE:-rpki-rtr:latest}
    container_name: rpki-rtr-tls
    restart: no
    ports:
@@ -26,7 +26,6 @@ services:
      RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS: "${RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS:-300}"
      RPKI_RTR_REPORT_HISTORY_LIMIT: "${RPKI_RTR_REPORT_HISTORY_LIMIT:-10}"
      RPKI_RTR_TIMEZONE: "${RPKI_RTR_TIMEZONE:-Asia/Shanghai}"
-      RPKI_RTR_STRICT_CCR_VALIDATION: "${RPKI_RTR_STRICT_CCR_VALIDATION:-false}"
      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:-300}"
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "${RPKI_RTR_MAX_CONCURRENT_HANDSHAKES:-128}"
--- a/deploy/server/docker-compose.yml
+++ b/deploy/server/docker-compose.yml
@@ -5,7 +5,7 @@ services:
    build:
      context: ../..
      dockerfile: deploy/server/Dockerfile
-    image: rpki-rtr:latest
+    image: ${RPKI_RTR_SERVER_IMAGE:-rpki-rtr:latest}
    container_name: rpki-rtr
    restart: no
    ports:
@@ -25,7 +25,6 @@ services:
      RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS: "${RPKI_RTR_RUNTIME_REPORT_INTERVAL_SECS:-300}"
      RPKI_RTR_REPORT_HISTORY_LIMIT: "${RPKI_RTR_REPORT_HISTORY_LIMIT:-10}"
      RPKI_RTR_TIMEZONE: "${RPKI_RTR_TIMEZONE:-Asia/Shanghai}"
-      RPKI_RTR_STRICT_CCR_VALIDATION: "${RPKI_RTR_STRICT_CCR_VALIDATION:-false}"
      RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS: "${RPKI_RTR_SOURCE_REFRESH_INTERVAL_SECS:-300}"
      RPKI_RTR_MAX_DELTA: "${RPKI_RTR_MAX_DELTA:-10}"
      RPKI_RTR_MAX_CONCURRENT_HANDSHAKES: "${RPKI_RTR_MAX_CONCURRENT_HANDSHAKES:-128}"