冷啟動審核：免費方案暖機時掩蓋的六種反模式

Your app is not portable. It is warm.

A free box keeps state you never declared. Caches, temp files, and hand-typed env vars all survive. Then you migrate, and boot fails at 3 a.m.

So I stopped asking "does it run?" I ask a harder question now. Does it boot from nothing?

Here is the audit I use, six anti-patterns it catches, and where it is useless.

The audit is one stdlib file

No agents. No dashboards. Three assertions and a JSON report.

#!/usr/bin/env python3
"""coldboot.py - fail fast on hidden warm-state assumptions."""

import json
import os
import sys
import time
import urllib.error
import urllib.request

REQUIRED = ["APP_ENV", "DATABASE_URL", "SESSION_SECRET", "PUBLIC_ORIGIN"]
SUSPECT = {"changeme", "dev", "test", "secret", "localhost", "127.0.0.1"}


def check_env() -> dict:
    """Assert the env contract instead of trusting the box."""
    missing = [k for k in REQUIRED if not os.environ.get(k, "").strip()]
    weak = [k for k in REQUIRED if os.environ.get(k, "").strip().lower() in SUSPECT]
    return {"check": "env_contract", "ok": not missing and not weak,
            "missing": missing, "weak": weak}


def check_ready(url: str, budget_s: float = 45.0) -> dict:
    """Measure time to first 200. Treat it as a budget, not a hope."""
    started = time.monotonic()
    last_error = None
    while time.monotonic() - started < budget_s:
        try:
            with urllib.request.urlopen(url, timeout=3) as resp:
                if resp.status == 200:
                    elapsed = round(time.monotonic() - started, 2)
                    return {"check": "readiness", "ok": True, "seconds": elapsed}
        except (urllib.error.URLError, TimeoutError) as exc:
            last_error = str(exc)
        time.sleep(0.5)
    return {"check": "readiness", "ok": False, "error": last_error}


def check_data_dir(path: str) -> dict:
    """Prove the data dir is the only thing you actually persist."""
    probe = os.path.join(path, ".coldboot_probe")
    try:
        with open(probe, "w", encoding="utf-8") as fh:
            fh.write(str(time.time()))
        return {"check": "data_dir", "ok": True, "path": path}
    except OSError as exc:
        return {"check": "data_dir", "ok": False, "path": path, "error": str(exc)}


def main() -> int:
    url = os.environ.get("HEALTH_URL", "http://127.0.0.1:8080/health")
    report = [check_env(), check_ready(url), check_data_dir("/data")]
    print(json.dumps(report, indent=2))
    return 0 if all(item["ok"] for item in report) else 1


if __name__ == "__main__":
    sys.exit(main())

This is a proposal, not a benchmark. I have not run it against your service.

Force the failure with a read-only root

Docker makes hidden writes loud. Mount nothing writable except /tmp and one data dir.

docker build -t app:cold .
docker run --rm --read-only --tmpfs /tmp \
  -e APP_ENV=production \
  -e HEALTH_URL=http://127.0.0.1:8080/health \
  -v coldboot-data:/data \
  app:cold ./coldboot.py

If that command dies, your free tier was doing quiet work. That is the finding.

Six anti-patterns, one check each

1. Cache as a dependency

• Symptom: first 200 arrives after 40s. Later requests are instant.
• Root cause: nobody measured the request after a restart.
• Replacement: a cold-start budget in CI, enforced by check_ready.

Warm numbers flatter every design. Budget the cold path instead.

2. Env edits that only exist on the box

• Symptom: redeploy works, a second instance crashes on import.
• Root cause: SESSION_SECRET was typed into a shell once, months ago.
• Replacement: check_env at boot, so you crash-loop instead of 500ing.

3. IP allowlists that describe the old box

• Symptom: database auth fails only from the new region.
• Root cause: the credential was pinned to an egress IP, not a role.
• Replacement: run the audit from two networks before cutover.

4. /tmp as a database

• Symptom: uploaded files vanish after a restart.
• Root cause: no writer ever named a durable path.
• Replacement: exactly one data dir, asserted by check_data_dir.

5. Unpinned installs

• Symptom: the rebuild resolves different versions than production.
• Root cause: no lockfile, or a lockfile nobody installs from.
• Replacement: build the image in CI, then boot that image. Not pip install.

6. The invisible boot step

• Symptom: healthy process, empty tables, 500s on first read.
• Root cause: migrations were run by hand once, then forgotten.
• Replacement: migrations in the entrypoint, gated before the health route.

Diff two reports, not two opinions

Run warm first. Then destroy the box, rebuild, run again.

Two JSON files in the repo beat a long migration meeting. The diff is the argument.

Where a disposable target and free models help

You want a box you can delete without ceremony. That is the whole point of the exercise.

MonkeyCode's free server option is one candidate for a throwaway target: deploy the app, run the audit, tear it down. Its free model access fits one narrow job here. Paste the JSON report and ask for a triage checklist a human can review.

Disclosure: This article was prepared as part of MonkeyCode's product outreach.

Both availability claims come from the operator. Confirm current terms on the project page before you plan around them. Do not assume they are permanent.

And never let a model decide pass or fail. The script decides. The model only sorts.

Who should skip this

• Single stateful node with no migration plan. Fix the plan first.
• Teams already booting every commit in ephemeral CI. You have this check.
• Static sites where the boot path is not the risk.
• Anyone chasing throughput. This audit says nothing about load.

The one question before you migrate

Can I delete this box and rebuild it, tonight, without reading my notes?

If the answer needs a meeting, run the audit. If a check fails, you found it cheap. Keep the report in the repo and re-run it after every dependency bump.

If you want a throwaway target to test against, the free server option is worth a look — just read the current terms first.