Dockerfile

## A custom Docker image can be built using one of the following commands:
##
##   1. docker build -t ${my-local-image-name}:${my-tag} .
## 
##   2. docker build \
##        --build-arg BUILD_DBTOOLS="true" \
##        --build-arg BINARIES="erigon evm downloader"
##        --progress plain \
##        -t ${my-local-image-name}:${my-tag} .
##
##   For all binaries:
##   3. docker build --build-arg BINARIES="all" -t ${my-local-image-name}:${my-tag} .
##
##   Using "make" (see Makefile for defaults)
##   4. make docker
##
##   5. DOCKER_BINARIES='erigon downloader rpcdaemon' make docker

ARG BUILDER_IMAGE="golang:1.27-trixie" \
    TARGET_BASE_IMAGE="debian:13-slim" \
    BINARIES="erigon" \
    BUILD_DBTOOLS="false" \
    BUILD_DATE="Not defined" \
    VCS_REF="Not defined" \
    UID_ERIGON=1000 \
    GID_ERIGON=1000 \
    EXPOSED_PORTS="8545 \
       8551 \
       8546 \
       30303 \
       30303/udp \
       42069 \
       42069/udp \
       8080 \
       9090 \
       6060"

## Use xx - Dockerfile cross-compilation helpers
FROM --platform=$BUILDPLATFORM tonistiigi/xx AS xx

### Erigon Builder section:
FROM --platform=$BUILDPLATFORM ${BUILDER_IMAGE} AS builder 
ARG TARGETARCH \
    TARGETVARIANT \
    TARGETPLATFORM \
    BUILD_DBTOOLS \
    BINARIES \
    GOPROXY="https://proxy.golang.org|https://goproxy.cn|direct"

SHELL ["/bin/bash", "-c"]

WORKDIR /erigon

## Copy all content of helpers:
COPY --from=xx / /

COPY go.mod go.sum /erigon/

## Make sure required dependencies are installed (some packages required only for arm64):
RUN xx-apt-get install -y libc6-dev g++ && \
    xx-go mod download && \
    xx-go mod tidy

COPY . /erigon/

RUN echo "DEBUG: building on ${TARGETARCH}${TARGETVARIANT}" && \
    if [ "x${TARGETARCH}" == "xamd64" ]; then \
        echo "DEBUG: detected architecture AMD64, building for x86-64-v2"; \
        export CPU_FLAGS="GOAMD64_VERSION=v2 GOARCH=amd64"; \
    elif [ "x${TARGETARCH}" == "xarm64" ]; then \
        echo "DEBUG: detected architecture ARM64"; \
        export CPU_FLAGS="GOARCH=arm64"; \
    fi && \
    echo "DEBUG: cmd - make ${CPU_FLAGS} ${BINARIES} GOBIN=/build ." && \
    make GO=xx-go CGO_ENABLED=1 GOARCH=${TARGETARCH} ${CPU_FLAGS} ${BINARIES} GOBIN=/build BUILD_TAGS=nosqlite,noboltdb && \
    if [ "x${BUILD_DBTOOLS}" == "xtrue" ]; then \
        echo "Building db-tools:"; \
        make GO=xx-go CGO_ENABLED=1 GOBIN=/build db-tools; \
    fi && \
    find /build -ls

### End of builder section


### Erigon Target section:
FROM ${TARGET_BASE_IMAGE} AS erigon
ARG USER=erigon \
    GROUP=erigon \
    UID_ERIGON \
    GID_ERIGON \
    TARGETARCH \
    TARGET_BASE_IMAGE \
    EXPOSED_PORTS \
    BUILD_DATE \
    VCS_REF

LABEL \
    "org.opencontainers.image.authors"="https://github.com/erigontech/erigon/graphs/contributors" \
    "org.opencontainers.image.base.name"="${TARGET_BASE_IMAGE}" \
    "org.opencontainers.image.created"="${BUILD_DATE}" \
    "org.opencontainers.image.revision"="${VCS_REF}" \
    "org.opencontainers.image.description"="Erigon is an implementation of Ethereum (execution layer with embeddable consensus layer), on the efficiency frontier." \
    "org.opencontainers.image.documentation"="https://docs.erigon.tech/" \
    "org.opencontainers.image.source"="https://github.com/erigontech/erigon" \
    "org.opencontainers.image.url"="https://github.com/erigontech/erigon/blob/main/Dockerfile"

STOPSIGNAL 2

SHELL ["/bin/bash", "-c"]

# CA certificates the image must not trust while the base image still ships them, as listed in
# /etc/ca-certificates.conf. eMudhra intermediate key compromise and the roots removed after it:
# https://bugzilla.mozilla.org/show_bug.cgi?id=2083449, https://bugzilla.mozilla.org/show_bug.cgi?id=2083709,
# https://bugs.debian.org/1151413
ARG CA_DISTRUST="mozilla/emSign_ECC_Root_CA_-_G3.crt mozilla/Comodo_AAA_Services_root.crt mozilla/emSign_Root_CA_-_C1.crt mozilla/emSign_ECC_Root_CA_-_C3.crt"

RUN --mount=type=bind,from=builder,source=/build,target=/tmp/build \
    echo Installing on ${TARGETARCH} with variant ${TARGETVARIANT} && \
    groupadd --gid ${GID_ERIGON} ${GROUP} && \
    useradd --system --uid ${UID_ERIGON} -g ${GROUP} --home /home/${USER} --shell /bin/bash ${USER} && \
    apt update -y && \
    apt install -y --no-install-recommends ca-certificates && \
    for ca in ${CA_DISTRUST}; do sed -i "s|^${ca}\$|!${ca}|" /etc/ca-certificates.conf; done && \
    update-ca-certificates --fresh && \
    for ca in ${CA_DISTRUST}; do [ ! -e "/etc/ssl/certs/$(basename "${ca%.crt}").pem" ] || { echo "still trusted: ${ca}"; exit 1; }; done && \
    apt clean && \
    rm -rf /var/lib/apt/lists/* && \
    install -d -o ${USER} -g ${GROUP} /home/${USER}/.local /home/${USER}/.local/share /home/${USER}/.local/share/erigon && \
    echo "Installing all binaries:" && \
    shopt -s extglob && \
    for binary in '/tmp/build/!(*.so)'; do \
        install -v -o root -g root $binary /usr/local/bin/ ; \
    done

VOLUME [ "/home/${USER}" ]
WORKDIR /home/${USER}

USER ${USER}

EXPOSE ${EXPOSED_PORTS}

ENTRYPOINT [ "/usr/local/bin/erigon" ]
### End of Erigon Target section