fix(appsec): load on musl ZTS; ci: disk envelope for helper-rust coverage

.gitlab/generate-appsec.php

@@ -340,6 +340,9 @@
     KUBERNETES_CPU_REQUEST: 8
     KUBERNETES_MEMORY_REQUEST: 24Gi
     KUBERNETES_MEMORY_LIMIT: 30Gi
+    # Coverage instrumentation makes this build strictly bigger than the 30G
+    # its non-coverage sibling needs, and the DinD helper only defaults to 20G.
+    DOCKER_LOOPBACK_SIZE: 50G
     ARCH: amd64
     GRADLE_USER_HOME: "$CI_PROJECT_DIR/.gradle-home"
   before_script:
@@ -355,8 +358,21 @@
         TERM=dumb ./gradlew loadCaches --info
       fi
 
+      echo "=== disk before buildPortableLibdatadogPhp ==="
+      df -h /
+      docker system df
+      docker run --rm -v php-portable-libdatadog-php:/vol alpine df -h /vol
+
+      # Keep the exit status but always report disk after the build: an
+      # exhausted loopback is the hypothesis these numbers exist to settle.
       TERM=dumb ./gradlew buildPortableLibdatadogPhp \
-        --info -Pbuildscan --scan -PuseHelperRustCoverage
+        --info -Pbuildscan --scan -PuseHelperRustCoverage && rc=0 || rc=$?
+
+      echo "=== disk after buildPortableLibdatadogPhp (gradle exit $rc) ==="
+      df -h /
+      docker system df
+      docker run --rm -v php-portable-libdatadog-php:/vol alpine df -h /vol
+      [ "$rc" -eq 0 ] || exit "$rc"
 
       # Coverage-instrumented artifacts are bulky: this leaves ~6G of cargo
       # intermediates in php-portable-libdatadog-php, over a quarter of the

appsec/src/extension/ddappsec.c

@@ -195,15 +195,19 @@ static PHP_GINIT_FUNCTION(ddappsec)
     if (!is_main_thread) {
 #    if defined(__linux__)
         extern void *__dso_handle;
-        // adds a dependency on glibc 2.18
-        extern int __cxa_thread_atexit_impl(
-            void (*func)(void *), void *arg, void *dso_handle);
-        __cxa_thread_atexit_impl(_tshutdown_handler, NULL, __dso_handle);
+        // Weak because musl exports no __cxa_thread_atexit_impl (it is a glibc
+        // 2.18 internal); a strong reference makes dlopen() of this DSO fail.
+        extern int __cxa_thread_atexit_impl(void (*func)(void *), void *arg,
+            void *dso_handle) __attribute__((weak));
+        if (__cxa_thread_atexit_impl) {
+            __cxa_thread_atexit_impl(_tshutdown_handler, NULL, __dso_handle);
+            ddappsec_globals->registered_thread_local_dtor = true;
+        }
 #    elif defined(__APPLE__)
         extern void _tlv_atexit(void (*termFunc)(void *), void *objAddr);
         _tlv_atexit(_tshutdown_handler, NULL);
-#    endif
         ddappsec_globals->registered_thread_local_dtor = true;
+#    endif
     }
 #endif
 }