feat: add pprof endpoint option for profiling

Add --pprof and --pprof-addr flags to enable pprof HTTP endpoint
for runtime profiling and debugging.

Security improvements:
- Use http.Server with ReadHeaderTimeout (10s) and IdleTimeout (120s)
- Graceful shutdown tied to options.Ctx with 5s timeout
- Explicit pprof handler registration instead of default serve mux

Changes:
- Add EnablePprof and PprofAddr to AgentOptions
- Add --pprof flag to enable pprof server (default: false)
- Add --pprof-addr flag to configure listen address (default: localhost:6060)
- Implement startPprofServer() with proper timeouts and shutdown handling
- Update docs/debug-tips.md and docs/cn/debug-tips.md with usage examples

Usage:
  kyanos watch --pprof
  kyanos watch --pprof --pprof-addr=:9090

The pprof endpoint provides access to:
- /debug/pprof/heap - memory profiling
- /debug/pprof/profile - CPU profiling
- /debug/pprof/goroutine - goroutine dumps

Author: hengyouhai

agent/agent.go

@@ -19,21 +19,23 @@ import (
 	"kyanos/version"
 	"os"
 	"os/exec"
+	"net/http"
 	"os/signal"
 	"runtime"
 	"strings"
 	"sync"
 	"syscall"
 	"time"
 
-	_ "net/http/pprof"
+	"net/http/pprof"
 
 	"github.com/cilium/ebpf/rlimit"
 	gops "github.com/google/gops/agent"
 )
 
 func SetupAgent(options ac.AgentOptions) {
 	startGopsServer(options)
+	startPprofServer(options)
 
 	if err := version.UpgradeDetect(); err != nil {
 		if errors.Is(err, version.ErrBehindLatest) {
@@ -252,3 +254,49 @@ func startGopsServer(opts ac.AgentOptions) {
 		}
 	}
 }
+
+func startPprofServer(opts ac.AgentOptions) {
+	if !opts.EnablePprof {
+		return
+	}
+
+	addr := opts.GetPprofAddr()
+	displayAddr := addr
+	if strings.HasPrefix(addr, ":") {
+		displayAddr = "localhost" + addr
+	}
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/debug/pprof/", pprof.Index)
+	mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
+	mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
+	mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
+	mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
+	mux.HandleFunc("/debug/pprof/{name}", pprof.Index)
+
+	server := &http.Server{
+		Addr:              addr,
+		Handler:           mux,
+		ReadHeaderTimeout: 10 * time.Second,
+		IdleTimeout:       120 * time.Second,
+	}
+
+	go func() {
+		common.AgentLog.Infof("Starting pprof server on http://%s/debug/pprof/", displayAddr)
+		common.AgentLog.Info("pprof endpoints: /debug/pprof/heap, /debug/pprof/profile, /debug/pprof/goroutine")
+		if err := server.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			common.AgentLog.Errorf("Failed to start pprof server: %v", err)
+		}
+	}()
+
+	go func() {
+		<-opts.Ctx.Done()
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		if err := server.Shutdown(shutdownCtx); err != nil {
+			common.AgentLog.Errorf("Failed to shutdown pprof server: %v", err)
+		} else {
+			common.AgentLog.Info("pprof server shutdown gracefully")
+		}
+	}()
+}

agent/common/options.go

@@ -50,6 +50,8 @@ type AgentOptions struct {
 	ConntrackCloseWaitTimeMills int
 	MaxAllowStuckTimeMills      int
 	StartGopsServer             bool
+	EnablePprof                 bool
+	PprofAddr                   string
 
 	FilterComm              string
 	ProcessExecEventChannel chan *bpf.AgentProcessExecEvent
@@ -74,6 +76,13 @@ type AgentOptions struct {
 	FirstPacketEventMapPageNum int
 }
 
+func (o AgentOptions) GetPprofAddr() string {
+	if o.PprofAddr == "" {
+		return "localhost:6060"
+	}
+	return o.PprofAddr
+}
+
 func (o AgentOptions) FilterByContainer() bool {
 	return o.ContainerId != "" || o.ContainerName != "" || o.PodName != ""
 }

cmd/root.go

@@ -105,6 +105,8 @@ func init() {
 	rootCmd.PersistentFlags().IntVar(&options.MaxAllowStuckTimeMills, "max-allow-stuck-time-mills", 1000, "--max-allow-stuck-time-mills 100")
 
 	rootCmd.PersistentFlags().BoolVar(&options.StartGopsServer, "gops", false, "start gops server")
+	rootCmd.PersistentFlags().BoolVar(&options.EnablePprof, "pprof", false, "enable pprof HTTP endpoint for profiling (WARNING: exposes sensitive profiling data; do not use on untrusted networks)")
+	rootCmd.PersistentFlags().StringVar(&options.PprofAddr, "pprof-addr", "127.0.0.1:6060", "pprof HTTP server address (WARNING: binding to non-loopback addresses, e.g. \":6060\" or \"0.0.0.0:6060\", will expose profiling data to the network)")
 
 	rootCmd.PersistentFlags().MarkHidden("default-log-level")
 	rootCmd.PersistentFlags().MarkHidden("agent-log-level")

docs/cn/debug-tips.md

@@ -85,6 +85,50 @@ VSCODE 直接打开项目即可，.vscode/launch.json 添加配置如下：
 
 注意添加 `--debug-output` 参数。
 
+## 性能分析（Profiling）
+
+Kyanos 提供了 pprof 端点用于运行时性能分析和调试。你可以使用 `--pprof` 标志启用 pprof HTTP 服务器：
+
+```bash
+./kyanos watch --pprof
+```
+
+默认情况下，pprof 服务器监听 `localhost:6060`。你可以使用 `--pprof-addr` 标志自定义监听地址：
+
+```bash
+./kyanos watch --pprof --pprof-addr="0.0.0.0:9090"
+```
+
+可用的 pprof 端点：
+
+| 端点 | 说明 |
+|------|------|
+| `/debug/pprof/` | 索引页面，显示所有可用的 profile |
+| `/debug/pprof/heap` | 内存堆 profile |
+| `/debug/pprof/profile` | CPU profile（默认 30 秒） |
+| `/debug/pprof/goroutine` | Goroutine 堆栈信息 |
+| `/debug/pprof/allocs` | 内存分配 profile |
+| `/debug/pprof/block` | 阻塞 profile |
+| `/debug/pprof/mutex` | 锁竞争 profile |
+
+使用示例：
+
+```bash
+# 采集 CPU profile
+curl -o cpu.pprof http://localhost:6060/debug/pprof/profile?seconds=30
+go tool pprof cpu.pprof
+
+# 查看堆内存 profile
+go tool pprof http://localhost:6060/debug/pprof/heap
+
+# 查看 goroutine 堆栈
+curl http://localhost:6060/debug/pprof/goroutine?debug=1
+```
+
+> [!TIP]
+>
+> pprof 端点对于诊断 Kyanos 自身的性能问题、内存泄漏或 goroutine 泄漏非常有用。
+
 ## 源码结构
 
 ```

docs/debug-tips.md

@@ -94,6 +94,50 @@ Make sure to add the `--debug-output` parameter.
 Protocol inference code can be debugged by printing logs using `bpf_printk`,
 refer to: https://nakryiko.com/posts/bpf-tips-printk/.
 
+## Profiling
+
+Kyanos provides pprof endpoints for runtime profiling and debugging. You can enable the pprof HTTP server using the `--pprof` flag:
+
+```bash
+./kyanos watch --pprof
+```
+
+By default, the pprof server listens on `localhost:6060`. You can customize the address using the `--pprof-addr` flag:
+
+```bash
+./kyanos watch --pprof --pprof-addr="0.0.0.0:9090"
+```
+
+Available pprof endpoints:
+
+| Endpoint | Description |
+|----------|-------------|
+| `/debug/pprof/` | Index page with all available profiles |
+| `/debug/pprof/heap` | Memory heap profile |
+| `/debug/pprof/profile` | CPU profile (30 seconds by default) |
+| `/debug/pprof/goroutine` | Goroutine dump |
+| `/debug/pprof/allocs` | Allocation profile |
+| `/debug/pprof/block` | Block profile |
+| `/debug/pprof/mutex` | Mutex contention profile |
+
+Example usage:
+
+```bash
+# Capture CPU profile
+curl -o cpu.pprof http://localhost:6060/debug/pprof/profile?seconds=30
+go tool pprof cpu.pprof
+
+# View heap profile
+go tool pprof http://localhost:6060/debug/pprof/heap
+
+# View goroutine dump
+curl http://localhost:6060/debug/pprof/goroutine?debug=1
+```
+
+> [!TIP]
+>
+> The pprof endpoint is useful for diagnosing performance issues, memory leaks, or goroutine leaks in Kyanos itself.
+
 ## Source Code Structure
 
 ```