#为三星 Note20 Ultra 编译支持 Docker 的内核

sudo apt install -y build-essential bc bison flex libssl-dev libncurses5-dev libelf-dev git python-is-python3

cd ~/Project/toolchains

cd ~/Project/
git clone --depth 1 https://github.com/osm0sis/AnyKernel3.git
cd AnyKernel3
cp $PWD/$TARGET .

zip -r9 UPDATE-AnyKernel3.zip * -x .git README.md *placeholder

# 1. 更新源
pkg update && pkg upgrade

# 2. 安装 tsu (用于在 Termux 中获取 root 权限)
pkg install tsu

# 3. 启用 root 仓库
pkg install root-repo

# 4. 安装 docker 软件包
pkg install docker docker-compose

nano run_docker.sh

#!/data/data/com.termux/files/usr/bin/bash

# ================= 配置区域 =================
# Docker 默认网段范围 (覆盖 172.16.x.x ~ 172.31.x.x)
DOCKER_SUBNET="172.16.0.0/12"

# EasyTier 虚拟网段设置
# 如果你需要 EasyTier，请填入你的虚拟网段 CIDR (例如 10.144.144.0/24)
# 如果你不需要或想禁用此功能，请将引号内容留空，例如 EASYTIER_SUBNET=""
EASYTIER_SUBNET="10.144.144.0/24"

# 自定义路由表 ID (防止污染系统表)
DOCKER_TABLE_ID=100
DOCKER_REPLY_TABLE_ID=101

# 路由规则优先级
RULE_PREF=2500
# ===========================================

# 0. Root 权限检查
if [ "$(id -u)" != "0" ]; then
    sudo "$0" "$@"
    exit $?
fi

echo "=== 🚀 Android Docker 智能启动 (完全版) ==="

# ----------------------------------------------------------------
# 1. 自动配置 daemon.json
# ----------------------------------------------------------------
CONF_DIR="/data/data/com.termux/files/usr/etc/docker"
CONF_FILE="$CONF_DIR/daemon.json"

if [ ! -f "$CONF_FILE" ]; then
    echo "[1/7] Creating daemon.json..."
    mkdir -p "$CONF_DIR"
    cat > "$CONF_FILE" <<'DAEMON_EOF'
{
    "data-root": "/data/data/com.termux/files/usr/lib/docker",
    "exec-root": "/data/data/com.termux/files/usr/var/run/docker",
    "pidfile": "/data/data/com.termux/files/usr/var/run/docker.pid",
    "dns": ["223.5.5.5", "119.29.29.29", "8.8.8.8"],
    "userland-proxy": false,
    "ip-masq": true,
    "iptables": true,
    "bridge": "docker0",
    "hosts": ["unix:///data/data/com.termux/files/usr/var/run/docker.sock"],
    "storage-driver": "overlay2"
}
DAEMON_EOF
else
    echo "[1/7] daemon.json exists, skipping overwrite."
fi

# 如果网络不行，daemon.json 中可以设置 "mtu": 1280, 来排除这个可能

# ----------------------------------------------------------------
# 2. 基础环境挂载 (Cgroups)
# ----------------------------------------------------------------
echo "[2/7] Mounting Cgroups..."
if [ ! -d /sys/fs/cgroup ]; then mkdir -p /sys/fs/cgroup; fi
if ! mountpoint -q /sys/fs/cgroup; then mount -t tmpfs -o mode=755 tmpfs /sys/fs/cgroup; fi
for subsys in cpu cpuacct memory devices freezer blkio perf_event pids cpuset; do
    mkdir -p /sys/fs/cgroup/$subsys
    if ! mountpoint -q /sys/fs/cgroup/$subsys; then
        mount -t cgroup -o $subsys cgroup /sys/fs/cgroup/$subsys 2>/dev/null || true
    fi
done

# ----------------------------------------------------------------
# 3. 内核参数优化
# ----------------------------------------------------------------
echo "[3/7] Enabling IP Forwarding & Fixing rp_filter..."
sysctl -w net.ipv4.ip_forward=1 > /dev/null
sysctl -w net.ipv4.conf.all.forwarding=1 > /dev/null

for file in /proc/sys/net/ipv4/conf/*/rp_filter; do
    echo 0 > "$file"
done

# ----------------------------------------------------------------
# 4. 智能路由配置
# ----------------------------------------------------------------
echo "[4/7] Configuring Routing Strategy..."

# A. 清理旧规则
while ip rule del from all lookup main pref 1 2>/dev/null; do true; done
while ip rule del from all lookup main pref 30000 2>/dev/null; do true; done
while ip rule del from $DOCKER_SUBNET lookup $DOCKER_TABLE_ID 2>/dev/null; do true; done
while ip rule del to $DOCKER_SUBNET lookup main 2>/dev/null; do true; done
while ip rule del fwmark 0x20233 lookup main 2>/dev/null; do true; done
while ip rule del fwmark 0x999 lookup main 2>/dev/null; do true; done
while ip rule del from 172.17.0.0/16 lookup $DOCKER_REPLY_TABLE_ID 2>/dev/null; do true; done

# B. 探测当前外网出口
ROUTE_INFO=$(ip route get 223.5.5.5 2>/dev/null)
INTERFACE=$(echo "$ROUTE_INFO" | grep -oP 'dev \K\S+')
GATEWAY=$(echo "$ROUTE_INFO" | grep -oP 'via \K\S+')

if [ -n "$INTERFACE" ]; then
    echo "    -> 当前系统主出口: $INTERFACE (网关: ${GATEWAY:-直连})"

    # C. 为 Docker 出站建立独立路由表
    ip route flush table $DOCKER_TABLE_ID
    if [ -n "$GATEWAY" ]; then
        ip route add default via "$GATEWAY" dev "$INTERFACE" table $DOCKER_TABLE_ID
    else
        ip route add default dev "$INTERFACE" table $DOCKER_TABLE_ID
    fi

    # D. Docker 出站策略
    ip rule add from $DOCKER_SUBNET lookup $DOCKER_TABLE_ID pref $RULE_PREF
    echo "    -> 策略已生效: Docker 出站流量 -> Table $DOCKER_TABLE_ID -> $INTERFACE"

    # E. Docker 入站策略（去往 Docker 的流量走 main 表）
    ip rule add to $DOCKER_SUBNET lookup main pref $((RULE_PREF - 1))
    echo "    -> 回程路由: 去往 Docker -> main table"

    # F. fwmark 绕过 Android VPN
    ip rule add fwmark 0x20233 lookup main pref 100
    echo "    -> fwmark 规则: 0x20233 -> main table"
else
    echo "⚠️  警告: 未检测到网络连接"
fi

# G. 修复 EasyTier
if [ -n "$EASYTIER_SUBNET" ]; then
    echo "检测到 EasyTier 配置..."
    while ip rule del to "$EASYTIER_SUBNET" lookup main pref 1 2>/dev/null; do true; done
    ip rule add to "$EASYTIER_SUBNET" lookup main pref 1
    echo "    -> EasyTier 路由: to $EASYTIER_SUBNET -> main table"
fi

# ----------------------------------------------------------------
# 5. 防火墙与 NAT
# ----------------------------------------------------------------
echo "[5/7] Applying Firewall & NAT Rules..."

# 清理规则
iptables -t nat -F POSTROUTING 2>/dev/null
iptables -t mangle -F OUTPUT 2>/dev/null
iptables -t mangle -F POSTROUTING 2>/dev/null

# A. 允许转发
iptables -P FORWARD ACCEPT
iptables -I FORWARD 1 -j ACCEPT

# B. Docker 基础 NAT
iptables -t nat -A POSTROUTING -s "$DOCKER_SUBNET" ! -d "$DOCKER_SUBNET" -j MASQUERADE

# C. 高通硬件校验和修复
iptables -t mangle -A POSTROUTING -p tcp -j CHECKSUM --checksum-fill 2>/dev/null
iptables -t mangle -A POSTROUTING -p udp -j CHECKSUM --checksum-fill 2>/dev/null

# D. fwmark 标记
iptables -t mangle -A OUTPUT -d $DOCKER_SUBNET -j MARK --set-mark 0x20233
echo "    -> iptables 标记: 去往 Docker -> fwmark 0x20233"

# ----------------------------------------------------------------
# 6. 启动 Docker
# ----------------------------------------------------------------
echo "[6/7] Starting Dockerd..."

pkill dockerd 2>/dev/null
sleep 2
pkill containerd 2>/dev/null
sleep 1

dockerd > /dev/null 2>&1 &

IS_RUNNING=0
for i in {1..10}; do
    if [ -S "/data/data/com.termux/files/usr/var/run/docker.sock" ]; then
        echo "✅ Docker Daemon is Running!"
        export DOCKER_HOST="unix:///data/data/com.termux/files/usr/var/run/docker.sock"
        IS_RUNNING=1
        break
    fi
    sleep 1
done

if [ "$IS_RUNNING" -eq 1 ]; then
    if docker ps >/dev/null 2>&1; then
        echo "   服务响应正常 (docker ps OK)"
    fi
else
    echo "❌ 启动失败"
    exit 1
fi

# ----------------------------------------------------------------
# 7. 配置局域网访问（动态检测）
# ----------------------------------------------------------------
echo "[7/7] Configuring LAN Access..."

# 等待 Docker 网络就绪
sleep 2

# 动态检测物理网络接口和 IP
detect_lan_interface() {
    # 优先级：wlan0 > eth0 > rndis0 > usb0
    for iface in wlan0 eth0 rndis0 usb0; do
        if ip link show $iface 2>/dev/null | grep -q "state UP"; then
            local lan_ip=$(ip -4 addr show $iface 2>/dev/null | grep -oP '(?<=inet\s)\d+(\.\d+){3}' | head -1)
            if [ -n "$lan_ip" ]; then
                echo "$iface:$lan_ip"
                return 0
            fi
        fi
    done
    return 1
}

LAN_INFO=$(detect_lan_interface)
if [ -n "$LAN_INFO" ]; then
    LAN_IFACE=$(echo $LAN_INFO | cut -d: -f1)
    LAN_IP=$(echo $LAN_INFO | cut -d: -f2)
    LAN_SUBNET=$(echo $LAN_IP | cut -d. -f1-3).0/24
    
    echo "    -> 检测到局域网接口: $LAN_IFACE ($LAN_IP)"
    
    # A. 为 Docker 回程创建路由表
    ip route flush table $DOCKER_REPLY_TABLE_ID 2>/dev/null
    ip route add $LAN_SUBNET dev $LAN_IFACE src $LAN_IP table $DOCKER_REPLY_TABLE_ID
    
    # 尝试添加默认路由（如果有网关）
    LAN_GW=$(ip route | grep "default.*$LAN_IFACE" | grep -oP 'via \K\S+' | head -1)
    if [ -n "$LAN_GW" ]; then
        ip route add default via $LAN_GW dev $LAN_IFACE table $DOCKER_REPLY_TABLE_ID 2>/dev/null
    else
        ip route add default dev $LAN_IFACE table $DOCKER_REPLY_TABLE_ID 2>/dev/null
    fi
    
    # B. 添加策略路由（Docker 回程走专用表）
    ip rule add from 172.17.0.0/16 lookup $DOCKER_REPLY_TABLE_ID pref 98
    echo "    -> 回程路由表: 172.17.0.0/16 -> table $DOCKER_REPLY_TABLE_ID"
    
    # C. FORWARD 链允许
    iptables -I FORWARD 1 -i $LAN_IFACE -o docker0 -j ACCEPT
    iptables -I FORWARD 1 -i docker0 -o $LAN_IFACE -j ACCEPT
    echo "    -> FORWARD: $LAN_IFACE <-> docker0"
    
    # D. SNAT（回程地址转换）
    iptables -t nat -I POSTROUTING 1 -s 172.17.0.0/16 -o $LAN_IFACE -j SNAT --to-source $LAN_IP
    echo "    -> SNAT: 172.17.0.0/16 -> $LAN_IP"
    
    # E. INPUT 链允许（可选，更安全的方式）
    iptables -I INPUT 1 -i $LAN_IFACE -p tcp --dport 1024:65535 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
    echo "    -> INPUT: 允许 $LAN_IFACE 访问高位端口"
    
    echo "✅ 局域网访问已配置完成"
    echo "   局域网设备可通过 http://$LAN_IP:<端口> 访问容器"
else
    echo "⚠️  未检测到活跃的局域网接口，跳过局域网访问配置"
    echo "   (仅支持本机访问 http://172.17.0.1:<端口>)"
fi

echo ""
echo "=== 🎉 Docker 启动完成 ==="
echo "本机访问: http://172.17.0.1:<端口>"
if [ -n "$LAN_IP" ]; then
    echo "局域网访问: http://$LAN_IP:<端口>"
fi

tsu
echo export DOCKER_HOST=\"unix:///data/data/com.termux/files/usr/var/run/docker.sock\" >> ~/.bashrc
source ~/.bashrc

# 1. 将幽灵进程上限调整到最大值 (约 20 亿)
adb shell "/system/bin/device_config put activity_manager max_phantom_processes 2147483647"

# 2. 禁用配置同步 (防止系统自动改回去)
adb shell "/system/bin/device_config set_sync_disabled_for_tests persistent"

#!/bin/bash
while true; do
    echo "启动 Dockerd..."
    # 这里的参数根据你的实际情况调整
    sudo dockerd --iptables=false >> docker.log 2>&1
    echo "Dockerd 挂了! 5秒后重启..."
    sleep 5
done