C++ Deployment & Best Practices: CMake, Docker, CI/CD, RAII & Modern Guidelines (2025)

cmake_minimum_required(VERSION 3.20)  # minimum version lock

project(MyApp
  VERSION   1.2.0
  LANGUAGES CXX
)

# ── C++ standard ───────────────────────────────────────────────
set(CMAKE_CXX_STANDARD          17)
set(CMAKE_CXX_STANDARD_REQUIRED ON)   # error if 17 not available
set(CMAKE_CXX_EXTENSIONS        OFF)  # no GNU extensions (-std=c++17 not -std=gnu++17)

# ── Build type defaults ─────────────────────────────────────────
if(NOT CMAKE_BUILD_TYPE)
  set(CMAKE_BUILD_TYPE Release)
endif()

# ── Find dependencies ───────────────────────────────────────────
find_package(Threads REQUIRED)        # pthreads
# find_package(Boost 1.80 REQUIRED COMPONENTS system filesystem)

# ── Targets ─────────────────────────────────────────────────────
add_executable(MyApp
  src/main.cpp
  src/processor.cpp
)

# Target-based includes (PRIVATE = only MyApp, not its dependants)
target_include_directories(MyApp PRIVATE
  ${CMAKE_CURRENT_SOURCE_DIR}/include
)

target_link_libraries(MyApp PRIVATE
  Threads::Threads
)

# ── Compiler warnings (per-target, not global) ──────────────────
target_compile_options(MyApp PRIVATE
  $<$<CXX_COMPILER_ID:GNU,Clang>:-Wall;-Wextra;-Wpedantic>
  $<$<CONFIG:Debug>:-fsanitize=address,undefined;-g;-O0>
  $<$<CONFIG:Release>:-O2;-DNDEBUG>
)
target_link_options(MyApp PRIVATE
  $<$<CONFIG:Debug>:-fsanitize=address,undefined>
)

# ── Embed version at compile time ───────────────────────────────
configure_file(
  ${CMAKE_CURRENT_SOURCE_DIR}/include/version.h.in
  ${CMAKE_CURRENT_BINARY_DIR}/include/version.h
)

# ── Tests ───────────────────────────────────────────────────────
enable_testing()
add_subdirectory(tests)

# ── Install rules ───────────────────────────────────────────────
install(TARGETS MyApp DESTINATION bin)
install(DIRECTORY include/ DESTINATION include)

# Debug build (with ASan + UBSan)
cmake -S . -B build/debug -DCMAKE_BUILD_TYPE=Debug
cmake --build build/debug --parallel $(nproc)
ctest --test-dir build/debug --output-on-failure

# Release build (optimized, no sanitizers)
cmake -S . -B build/release -DCMAKE_BUILD_TYPE=Release
cmake --build build/release --parallel $(nproc)

# Install to /usr/local
sudo cmake --install build/release --prefix /usr/local

# Cross-compile for ARM (with toolchain file)
cmake -S . -B build/arm -DCMAKE_TOOLCHAIN_FILE=arm-linux.cmake

# ── Stage 1: Build ──────────────────────────────────────────────
FROM gcc:13 AS builder

WORKDIR /src

# Install CMake
RUN apt-get update && apt-get install -y cmake && rm -rf /var/lib/apt/lists/*

# Copy source (layers cached separately — CMakeLists.txt first)
COPY CMakeLists.txt .
COPY src/ src/
COPY include/ include/

# Configure and build release
RUN cmake -S . -B build -DCMAKE_BUILD_TYPE=Release && \
    cmake --build build --parallel $(nproc)

# ── Stage 2: Runtime ────────────────────────────────────────────
FROM ubuntu:22.04

# Only install runtime deps (not the compiler!)
RUN apt-get update && \
    apt-get install -y libstdc++6 ca-certificates && \
    rm -rf /var/lib/apt/lists/*

# Copy ONLY the compiled binary from the builder stage
COPY --from=builder /src/build/MyApp /usr/local/bin/MyApp

# Non-root user for security
RUN useradd --system --no-create-home appuser
USER appuser

ENTRYPOINT ["/usr/local/bin/MyApp"]

# Build the image
docker build -t myapp:1.2.0 -t myapp:latest .

# Check final image size
docker images myapp
# builder stage: ~1.8 GB  |  runtime stage: ~180 MB

# Run locally
docker run --rm myapp:1.2.0

# Run with environment variables and port mapping
docker run -d \
  --name myapp-prod \
  -e APP_PORT=8080 \
  -p 8080:8080 \
  myapp:1.2.0

# Push to registry (Docker Hub or ghcr.io)
docker push myapp:1.2.0
docker push myapp:latest

name: C++ CI/CD

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  build-and-test:
    strategy:
      matrix:
        os: [ubuntu-22.04, macos-14, windows-2022]
        build_type: [Debug, Release]

    runs-on: ${{ matrix.os }}

    steps:
      - uses: actions/checkout@v4

      - name: Install CMake
        uses: lukka/get-cmake@latest

      - name: Configure
        run: |
          cmake -S . -B build \
            -DCMAKE_BUILD_TYPE=${{ matrix.build_type }}

      - name: Build
        run: cmake --build build --parallel 4

      - name: Run Tests (with sanitizers in Debug)
        run: ctest --test-dir build --output-on-failure

      - name: Upload binary artifact
        if: matrix.build_type == 'Release' && matrix.os == 'ubuntu-22.04'
        uses: actions/upload-artifact@v4
        with:
          name: MyApp-linux
          path: build/MyApp

  docker-build:
    needs: build-and-test
    runs-on: ubuntu-22.04
    if: github.ref == 'refs/heads/main'

    steps:
      - uses: actions/checkout@v4

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v5
        with:
          push: true
          tags: ghcr.io/${{ github.repository }}:latest

#include <iostream>
#include <memory>
#include <optional>
#include <stdexcept>
#include <string>
#include <string_view>
using namespace std;

namespace MyApp {

// RAII wrapper — resource tied to object lifetime
class DataProcessor {
    unique_ptr<int[]> buffer;  // RAII: freed in destructor automatically
    int size;

public:
    // Validate in constructor — throw on invalid state
    explicit DataProcessor(int n)
        : size(n), buffer(make_unique<int[]>(n))
    {
        if (n <= 0)
            throw invalid_argument("Size must be positive");
    }

    // const + noexcept: read-only, optimizer-friendly
    int  getSize() const noexcept { return size; }

    // string_view: zero-copy, no allocation
    void process(string_view name) const {
        cout << "Processing " << name << ": size=" << size << "\n";
    }

    // std::optional — no null pointers, no sentinel values
    optional<int> findFirst(int target) const noexcept {
        for (int i = 0; i < size; i++)
            if (buffer[i] == target) return i;
        return nullopt;
    }
};

// Guard clause pattern — flat, readable
void run(string_view input) {
    if (input.empty())     { cerr << "Error: empty input\n";  return; }
    if (input.size() > 100) { cerr << "Error: input too long\n"; return; }

    try {
        DataProcessor p(42);          // RAII: auto-cleanup
        p.process(input);

        auto idx = p.findFirst(7);
        if (idx)
            cout << "Found at index: " << *idx << "\n";
        else
            cout << "Not found\n";
    }
    catch (const exception& e) {
        cerr << "Exception: " << e.what() << "\n";
    }
}

} // namespace MyApp

int main(int argc, char* argv[]) {
    if (argc != 2) {
        cerr << "Usage: " << argv[0] << " <name>\n";
        return 1;
    }
    MyApp::run(argv[1]);
    return 0;
}