Docker-targets v2 (#10346)

* Revert "Revert "Merge pull request #8242 from ethereum-optimism/go-docker-targets""

This reverts commit d972c460.

It also fixes up some conflicts / inconsistencies,
 since op-conductor was added after the original revert.

* ops: experimental cross-build fixes

* Retrieve git tag in Circle CI and use to set op version within docker image

* Update dispute-mon and da-server to use new docker build flow

* Fix GIT_VERSION script in Circle CI config.yml

* Update ops-bedrock docker-compose to use new docker build flow

* Load pre-built op-challenger image in devnet tests

* Save op-challenger.tar to avoid docker rebuild in devnet tests

* Add Circle CI job for check-cross-platform

* Allow env var to override VERSION in Makefiles

* Pass version to op-program components except op-program-client

* Wrap all docker-bake variable names in quotes

---------
Co-authored-by: protolambda <proto@protolambda.com>

.circleci/config.yml

@@ -326,9 +326,32 @@ jobs:
             export IMAGE_TAGS="$(echo -ne "<<parameters.docker_tags>>" | sed "s/[^a-zA-Z0-9\n,]/-/g")"
             export GIT_COMMIT="$(git rev-parse HEAD)"
             export GIT_DATE="$(git show -s --format='%ct')"
-            export GIT_VERSION="<<pipeline.git.tag>>"
             export PLATFORMS="<<parameters.platforms>>"
 
+            echo "Checking git tags pointing at $GIT_COMMIT:"
+            tags_at_commit=$(git tag --points-at $GIT_COMMIT)
+            echo "Tags at commit:\n$tags_at_commit"
+
+            filtered_tags=$(echo "$tags_at_commit" | grep "^<<parameters.docker_name>>/" || true)
+            echo "Filtered tags:\n$filtered_tags"
+
+            if [ -z "$filtered_tags" ]; then
+              export GIT_VERSION="untagged"
+            else
+              sorted_tags=$(echo "$filtered_tags" | sed "s/<<parameters.docker_name>>\///" | sort -V)
+              echo "Sorted tags:\n$sorted_tags"
+
+              # prefer full release tag over "-rc" release candidate tag if both exist
+              full_release_tag=$(echo "$sorted_tags" | grep -v -- "-rc" || true)
+              if [ -z "$full_release_tag" ]; then
+                export GIT_VERSION=$(echo "$sorted_tags" | tail -n 1)
+              else
+                export GIT_VERSION=$(echo "$full_release_tag")
+              fi
+            fi
+
+            echo "Setting GIT_VERSION=$GIT_VERSION"
+
             # Create, start (bootstrap) and use a *named* docker builder
             # This allows us to cross-build multi-platform,
             # and naming allows us to use the DLC (docker-layer-cache)
@@ -416,8 +439,50 @@ jobs:
                       --signer-logging-level="INFO"\
                       --attestor-key-id="//cloudkms.googleapis.com/v1/projects/$ATTESTOR_PROJECT_NAME/locations/global/keyRings/$ATTESTOR_NAME-key-ring/cryptoKeys/$ATTESTOR_NAME-key/cryptoKeyVersions/1"
 
+  # Verify newly published images (built on AMD machine) will run on ARM
+  check-cross-platform:
+    docker:
+      - image: cimg/base:current
+    resource_class: arm.medium
+    parameters:
+      registry:
+        description: Docker registry
+        type: string
+        default: "us-docker.pkg.dev"
+      repo:
+        description: Docker repo
+        type: string
+        default: "oplabs-tools-artifacts/images"
+      op_component:
+        description: "Name of op-stack component (e.g. op-node)"
+        type: string
+        default: ""
+      docker_tag:
+        description: "Tag of docker image"
+        type: string
+        default: "<<pipeline.git.revision>>"
+    steps:
+      - setup_remote_docker
+      - run:
+          name: "Verify Image Platform"
+          command: |
+            image_name="<<parameters.registry>>/<<parameters.repo>>/<<parameters.op_component>>:<<parameters.docker_tag>>"
+            echo "Retrieving Docker image manifest: $image_name"
+            MANIFEST=$(docker manifest inspect $image_name)
 
-
+            echo "Verifying 'linux/arm64' is supported..."
+            SUPPORTED_PLATFORM=$(echo "$MANIFEST" | jq -r '.manifests[] | select(.platform.architecture == "arm64" and .platform.os == "linux")')
+            echo $SUPPORT_PLATFORM
+            if [ -z "$SUPPORTED_PLATFORM" ]; then
+              echo "Platform 'linux/arm64' not supported by this image"
+              exit 1
+            fi
+      - run:
+          name: "Pull and run docker image"
+          command: |
+            image_name="<<parameters.registry>>/<<parameters.repo>>/<<parameters.op_component>>:<<parameters.docker_tag>>"
+            docker pull $image_name || exit 1
+            docker run $image_name <<parameters.op_component>> --version || exit 1
 
   contracts-bedrock-coverage:
     docker:
@@ -1288,16 +1353,16 @@ jobs:
           command: |
             IMAGE_BASE_PREFIX="us-docker.pkg.dev/oplabs-tools-artifacts/images"
             # Load from previous docker-build job
-            docker load < "./op-stack-go.tar"
             docker load < "./op-node.tar"
             docker load < "./op-proposer.tar"
             docker load < "./op-batcher.tar"
+            docker load < "./op-challenger.tar"
             docker load < "./da-server.tar"
             # rename to the tags that the docker-compose of the devnet expects
-            docker tag "$IMAGE_BASE_PREFIX/op-stack-go:<<pipeline.git.revision>>" "$IMAGE_BASE_PREFIX/op-stack-go:devnet"
             docker tag "$IMAGE_BASE_PREFIX/op-node:<<pipeline.git.revision>>" "$IMAGE_BASE_PREFIX/op-node:devnet"
             docker tag "$IMAGE_BASE_PREFIX/op-proposer:<<pipeline.git.revision>>" "$IMAGE_BASE_PREFIX/op-proposer:devnet"
             docker tag "$IMAGE_BASE_PREFIX/op-batcher:<<pipeline.git.revision>>" "$IMAGE_BASE_PREFIX/op-batcher:devnet"
+            docker tag "$IMAGE_BASE_PREFIX/op-challenger:<<pipeline.git.revision>>" "$IMAGE_BASE_PREFIX/op-challenger:devnet"
             docker tag "$IMAGE_BASE_PREFIX/da-server:<<pipeline.git.revision>>" "$IMAGE_BASE_PREFIX/da-server:devnet"
       - run:
           name: pnpm i
@@ -1803,64 +1868,50 @@ workflows:
             - op-e2e-fault-proof-tests
             - op-e2e-action-tests
             - op-e2e-ext-geth-tests
-      - docker-build: # just to warm up the cache (other jobs run in parallel)
-          name: op-stack-go-docker-build
-          docker_name: op-stack-go
-          docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          save_image_tag: <<pipeline.git.revision>> # for devnet later
       - docker-build:
           name: op-node-docker-build
           docker_name: op-node
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: ['op-stack-go-docker-build']
           save_image_tag: <<pipeline.git.revision>> # for devnet later
       - docker-build:
           name: op-batcher-docker-build
           docker_name: op-batcher
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: ['op-stack-go-docker-build']
           save_image_tag: <<pipeline.git.revision>> # for devnet later
       - docker-build:
           name: op-program-docker-build
           docker_name: op-program
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: ['op-stack-go-docker-build']
-          save_image_tag: <<pipeline.git.revision>> # for devnet later
+          # op-program is not part of the devnet, we don't save it.
       - docker-build:
           name: op-proposer-docker-build
           docker_name: op-proposer
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: ['op-stack-go-docker-build']
           save_image_tag: <<pipeline.git.revision>> # for devnet later
       - docker-build:
           name: op-challenger-docker-build
           docker_name: op-challenger
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: ['op-stack-go-docker-build']
           save_image_tag: <<pipeline.git.revision>> # for devnet later
       - docker-build:
           name: op-dispute-mon-docker-build
           docker_name: op-dispute-mon
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: ['op-stack-go-docker-build']
           save_image_tag: <<pipeline.git.revision>> # for devnet later
       - docker-build:
           name: op-conductor-docker-build
           docker_name: op-conductor
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: ['op-stack-go-docker-build']
-          save_image_tag: <<pipeline.git.revision>> # for devnet later
+          # op-conductor is not part of the devnet, we don't save it.
       - docker-build:
           name: op-heartbeat-docker-build
           docker_name: op-heartbeat
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: ['op-stack-go-docker-build']
-          save_image_tag: <<pipeline.git.revision>> # for devnet later
+          # op-heartbeat is not part of the devnet, we don't save it.
       - docker-build:
           name: da-server-docker-build
           docker_name: da-server
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: ['op-stack-go-docker-build']
           save_image_tag: <<pipeline.git.revision>> # for devnet later
       - cannon-prestate:
           requires:
@@ -1874,6 +1925,7 @@ workflows:
             - op-batcher-docker-build
             - op-proposer-docker-build
             - op-node-docker-build
+            - op-challenger-docker-build
             - da-server-docker-build
             - cannon-prestate
       - docker-build:
@@ -1909,18 +1961,6 @@ workflows:
               only: /^(da-server|proxyd|chain-mon|indexer|ci-builder(-rust)?|ufm-[a-z0-9\-]*|op-[a-z0-9\-]*)\/v.*/
             branches:
               ignore: /.*/
-      - docker-build: # just to warm up the cache (other jobs run in parallel)
-          name: op-stack-go-docker-build-release
-          filters:
-            tags:
-              only: /^(da-server|proxyd|chain-mon|indexer|ci-builder(-rust)?|ufm-[a-z0-9\-]*|op-[a-z0-9\-]*)\/v.*/
-            branches:
-              ignore: /.*/
-          docker_name: op-stack-go
-          docker_tags: <<pipeline.git.revision>>
-          platforms: "linux/amd64,linux/arm64"
-          requires:
-            - hold
       - docker-build:
           name: op-heartbeat-release
           filters:
@@ -1930,12 +1970,17 @@ workflows:
               ignore: /.*/
           docker_name: op-heartbeat
           docker_tags: <<pipeline.git.revision>>
-          requires: ['op-stack-go-docker-build-release']
+          requires: ['hold']
           platforms: "linux/amd64,linux/arm64"
           publish: true
           release: true
           context:
             - oplabs-gcr-release
+      - check-cross-platform:
+          name: op-heartbeat-cross-platform
+          op_component: op-heartbeat
+          requires:
+            - op-heartbeat-release
       - docker-build:
           name: op-node-docker-release
           filters:
@@ -1945,12 +1990,17 @@ workflows:
               ignore: /.*/
           docker_name: op-node
           docker_tags: <<pipeline.git.revision>>
-          requires: ['op-stack-go-docker-build-release']
+          requires: ['hold']
           platforms: "linux/amd64,linux/arm64"
           publish: true
           release: true
           context:
             - oplabs-gcr-release
+      - check-cross-platform:
+          name: op-node-cross-platform
+          op_component: op-node
+          requires:
+            - op-node-docker-release
       - docker-build:
           name: op-batcher-docker-release
           filters:
@@ -1960,12 +2010,17 @@ workflows:
               ignore: /.*/
           docker_name: op-batcher
           docker_tags: <<pipeline.git.revision>>
-          requires: ['op-stack-go-docker-build-release']
+          requires: ['hold']
           platforms: "linux/amd64,linux/arm64"
           publish: true
           release: true
           context:
             - oplabs-gcr-release
+      - check-cross-platform:
+          name: op-batcher-cross-platform
+          op_component: op-batcher
+          requires:
+            - op-batcher-docker-release
       - docker-build:
           name: op-proposer-docker-release
           filters:
@@ -1975,12 +2030,17 @@ workflows:
               ignore: /.*/
           docker_name: op-proposer
           docker_tags: <<pipeline.git.revision>>
-          requires: ['op-stack-go-docker-build-release']
+          requires: ['hold']
           platforms: "linux/amd64,linux/arm64"
           publish: true
           release: true
           context:
             - oplabs-gcr-release
+      - check-cross-platform:
+          name: op-proposer-cross-platform
+          op_component: op-proposer
+          requires:
+            - op-proposer-docker-release
       - docker-build:
           name: op-challenger-docker-release
           filters:
@@ -1990,12 +2050,17 @@ workflows:
               ignore: /.*/
           docker_name: op-challenger
           docker_tags: <<pipeline.git.revision>>
-          requires: ['op-stack-go-docker-build-release']
+          requires: ['hold']
           platforms: "linux/amd64,linux/arm64"
           publish: true
           release: true
           context:
             - oplabs-gcr-release
+      - check-cross-platform:
+          name: op-challenger-cross-platform
+          op_component: op-challenger
+          requires:
+            - op-challenger-docker-release
       - docker-build:
           name: op-dispute-mon-docker-release
           filters:
@@ -2005,12 +2070,17 @@ workflows:
               ignore: /.*/
           docker_name: op-dispute-mon
           docker_tags: <<pipeline.git.revision>>
-          requires: ['op-stack-go-docker-build-release']
+          requires: ['hold']
           platforms: "linux/amd64,linux/arm64"
           publish: true
           release: true
           context:
             - oplabs-gcr-release
+      - check-cross-platform:
+          name: op-dispute-mon-cross-platform
+          op_component: op-dispute-mon
+          requires:
+            - op-dispute-mon-docker-release
       - docker-build:
           name: op-conductor-docker-release
           filters:
@@ -2020,12 +2090,17 @@ workflows:
               ignore: /.*/
           docker_name: op-conductor
           docker_tags: <<pipeline.git.revision>>
-          requires: ['op-stack-go-docker-build-release']
+          requires: ['hold']
           platforms: "linux/amd64,linux/arm64"
           publish: true
           release: true
           context:
             - oplabs-gcr-release
+      - check-cross-platform:
+          name: op-conductor-cross-platform
+          op_component: op-conductor
+          requires:
+            - op-conductor-docker-release
       - docker-build:
           name: da-server-docker-release
           filters:
@@ -2035,12 +2110,17 @@ workflows:
               ignore: /.*/
           docker_name: da-server
           docker_tags: <<pipeline.git.revision>>
-          requires: ['op-stack-go-docker-build-release']
+          requires: ['hold']
           platforms: "linux/amd64,linux/arm64"
           publish: true
           release: true
           context:
             - oplabs-gcr-release
+      - check-cross-platform:
+          name: da-server-cross-platform
+          op_component: da-server
+          requires:
+            - da-server-docker-release
       - docker-build:
           name: op-ufm-docker-release
           filters:
@@ -2235,19 +2315,10 @@ workflows:
     when:
       equal: [ build_hourly, <<pipeline.schedule.name>> ]
     jobs:
-      - docker-build: # just to warm up the cache (other jobs run in parallel)
-          name: op-stack-go-docker-build-publish
-          docker_name: op-stack-go
-          docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          platforms: "linux/amd64,linux/arm64"
-          context:
-            - oplabs-gcr
-            - slack
       - docker-build:
           name: op-node-docker-publish
           docker_name: op-node
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: [ 'op-stack-go-docker-build-publish' ]
           platforms: "linux/amd64,linux/arm64"
           publish: true
           context:
@@ -2257,7 +2328,6 @@ workflows:
           name: op-batcher-docker-publish
           docker_name: op-batcher
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: [ 'op-stack-go-docker-build-publish' ]
           platforms: "linux/amd64,linux/arm64"
           publish: true
           context:
@@ -2267,7 +2337,6 @@ workflows:
           name: op-program-docker-publish
           docker_name: op-program
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: [ 'op-stack-go-docker-build-publish' ]
           platforms: "linux/amd64,linux/arm64"
           publish: true
           context:
@@ -2277,7 +2346,6 @@ workflows:
           name: op-proposer-docker-publish
           docker_name: op-proposer
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: [ 'op-stack-go-docker-build-publish' ]
           platforms: "linux/amd64,linux/arm64"
           publish: true
           context:
@@ -2287,7 +2355,6 @@ workflows:
           name: op-challenger-docker-publish
           docker_name: op-challenger
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: [ 'op-stack-go-docker-build-publish' ]
           platforms: "linux/amd64,linux/arm64"
           publish: true
           context:
@@ -2297,7 +2364,6 @@ workflows:
           name: op-dispute-mon-docker-publish
           docker_name: op-dispute-mon
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: [ 'op-stack-go-docker-build-publish' ]
           platforms: "linux/amd64,linux/arm64"
           publish: true
           context:
@@ -2307,7 +2373,6 @@ workflows:
           name: op-conductor-docker-publish
           docker_name: op-conductor
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: [ 'op-stack-go-docker-build-publish' ]
           platforms: "linux/amd64,linux/arm64"
           publish: true
           context:
@@ -2317,7 +2382,6 @@ workflows:
           name: op-heartbeat-docker-publish
           docker_name: op-heartbeat
           docker_tags: <<pipeline.git.revision>>,<<pipeline.git.branch>>
-          requires: [ 'op-stack-go-docker-build-publish' ]
           platforms: "linux/amd64,linux/arm64"
           publish: true
           context:

Makefile

@@ -41,6 +41,42 @@ golang-docker:
 			op-node op-batcher op-proposer op-challenger op-dispute-mon
 .PHONY: golang-docker
 
+docker-builder-clean:
+	docker buildx rm buildx-build
+.PHONY: docker-builder-clean
+
+docker-builder:
+	docker buildx create \
+		--driver=docker-container --name=buildx-build --bootstrap --use
+.PHONY: docker-builder
+
+# add --print to dry-run
+cross-op-node:
+	# We don't use a buildx builder here, and just load directly into regular docker, for convenience.
+	GIT_COMMIT=$$(git rev-parse HEAD) \
+	GIT_DATE=$$(git show -s --format='%ct') \
+	IMAGE_TAGS=$$(git rev-parse HEAD),latest \
+	PLATFORMS="linux/arm64" \
+	GIT_VERSION=$(shell tags=$$(git tag --points-at $(GITCOMMIT) | grep '^op-node/' | sed 's/op-node\///' | sort -V); \
+             preferred_tag=$$(echo "$$tags" | grep -v -- '-rc' | tail -n 1); \
+             if [ -z "$$preferred_tag" ]; then \
+                 if [ -z "$$tags" ]; then \
+                     echo "untagged"; \
+                 else \
+                     echo "$$tags" | tail -n 1; \
+                 fi \
+             else \
+                 echo $$preferred_tag; \
+             fi) \
+	docker buildx bake \
+			--progress plain \
+			--builder=buildx-build \
+			--load \
+			--no-cache \
+			-f docker-bake.hcl \
+			op-node
+.PHONY: golang-docker
+
 chain-mon-docker:
 	# We don't use a buildx builder here, and just load directly into regular docker, for convenience.
 	GIT_COMMIT=$$(git rev-parse HEAD) \

cannon/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

docker-bake.hcl

@@ -14,8 +14,10 @@ variable "GIT_DATE" {
   default = "0"
 }
 
+// The default version to embed in the built images.
+// During CI release builds this is set to <<pipeline.git.tag>>
 variable "GIT_VERSION" {
-  default = "docker"  // original default as set in proxyd file, not used by full go stack, yet
+  default = "v0.0.0"
 }
 
 variable "IMAGE_TAGS" {
@@ -27,148 +29,187 @@ variable "PLATFORMS" {
   // Only a specify a single platform when `--load` ing into docker.
   // Multi-platform is supported when outputting to disk or pushing to a registry.
   // Multi-platform builds can be tested locally with:  --set="*.output=type=image,push=false"
-  default = "linux/amd64"
+  default = ""
 }
 
-target "op-stack-go" {
+// Each of the services can have a customized version, but defaults to the global specified version.
+variable "OP_NODE_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "OP_BATCHER_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "OP_PROPOSER_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "OP_CHALLENGER_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "OP_DISPUTE_MON_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "OP_HEARTBEAT_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "OP_PROGRAM_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "CANNON_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "OP_CONDUCTOR_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+
+target "op-node" {
   dockerfile = "ops/docker/op-stack-go/Dockerfile"
   context = "."
   args = {
     GIT_COMMIT = "${GIT_COMMIT}"
     GIT_DATE = "${GIT_DATE}"
+    OP_NODE_VERSION = "${OP_NODE_VERSION}"
   }
-  platforms = split(",", PLATFORMS)
-  tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-stack-go:${tag}"]
-}
-
-target "op-node" {
-  dockerfile = "Dockerfile"
-  context = "./op-node"
-  args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
-  }
+  target = "op-node-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-node:${tag}"]
 }
 
 target "op-batcher" {
-  dockerfile = "Dockerfile"
-  context = "./op-batcher"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    OP_BATCHER_VERSION = "${OP_BATCHER_VERSION}"
   }
+  target = "op-batcher-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-batcher:${tag}"]
 }
 
 target "op-proposer" {
-  dockerfile = "Dockerfile"
-  context = "./op-proposer"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    OP_PROPOSER_VERSION = "${OP_PROPOSER_VERSION}"
   }
+  target = "op-proposer-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-proposer:${tag}"]
 }
 
 target "op-challenger" {
-  dockerfile = "Dockerfile"
-  context = "./op-challenger"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    OP_CHALLENGER_VERSION = "${OP_CHALLENGER_VERSION}"
   }
+  target = "op-challenger-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-challenger:${tag}"]
 }
 
 target "op-dispute-mon" {
-  dockerfile = "Dockerfile"
-  context = "./op-dispute-mon"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    OP_DISPUTE_MON_VERSION = "${OP_DISPUTE_MON_VERSION}"
   }
+  target = "op-dispute-mon-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-dispute-mon:${tag}"]
 }
 
 target "op-conductor" {
-  dockerfile = "Dockerfile"
-  context = "./op-conductor"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    OP_CONDUCTOR_VERSION = "${OP_CONDUCTOR_VERSION}"
   }
+  target = "op-conductor-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-conductor:${tag}"]
 }
 
 target "op-heartbeat" {
-  dockerfile = "Dockerfile"
-  context = "./op-heartbeat"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    OP_HEARTBEAT_VERSION = "${OP_HEARTBEAT_VERSION}"
   }
+  target = "op-heartbeat-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-heartbeat:${tag}"]
 }
 
 target "da-server" {
-  dockerfile = "Dockerfile"
-  context = "./op-plasma"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
   }
+  target = "da-server-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/da-server:${tag}"]
 }
 
 target "op-program" {
-  dockerfile = "Dockerfile"
-  context = "./op-program"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    OP_PROGRAM_VERSION = "${OP_PROGRAM_VERSION}"
   }
+  target = "op-program-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-program:${tag}"]
 }
 
 target "op-ufm" {
   dockerfile = "./op-ufm/Dockerfile"
-  context = "./"
-  args = {
+  context    = "./"
+  args       = {
     // op-ufm dockerfile has no _ in the args
-    GITCOMMIT = "${GIT_COMMIT}"
-    GITDATE = "${GIT_DATE}"
+    GITCOMMIT  = "${GIT_COMMIT}"
+    GITDATE    = "${GIT_DATE}"
     GITVERSION = "${GIT_VERSION}"
   }
   platforms = split(",", PLATFORMS)
-  tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-ufm:${tag}"]
+  tags      = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-ufm:${tag}"]
+}
+
+target "cannon" {
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
+  args = {
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    CANNON_VERSION = "${CANNON_VERSION}"
+  }
+  target = "cannon-target"
+  platforms = split(",", PLATFORMS)
+  tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/cannon:${tag}"]
 }
 
 target "proxyd" {

op-batcher/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-
-FROM alpine:3.18
-
-COPY --from=builder /usr/local/bin/op-batcher /usr/local/bin/op-batcher
-
-CMD ["op-batcher"]

op-batcher/Dockerfile.dockerignore

-# ignore everything but the dockerfile, the op-stack-go base image performs the build
-*

op-bootnode/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

op-challenger/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-
-FROM alpine:3.18
-
-# Make the bundled op-program the default cannon server
-COPY --from=builder /usr/local/bin/op-program /usr/local/bin/op-program
-ENV OP_CHALLENGER_CANNON_SERVER /usr/local/bin/op-program
-
-# Make the bundled cannon the default cannon executable
-COPY --from=builder /usr/local/bin/cannon /usr/local/bin/cannon
-ENV OP_CHALLENGER_CANNON_BIN /usr/local/bin/cannon
-
-COPY --from=builder /usr/local/bin/op-challenger /usr/local/bin/op-challenger
-
-CMD ["op-challenger"]

op-challenger/Dockerfile.dockerignore

-# ignore everything but the dockerfile, the op-stack-go base image performs the build
-*

op-challenger/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

op-conductor/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-
-FROM alpine:3.18
-
-COPY --from=builder /usr/local/bin/op-conductor /usr/local/bin/op-conductor
-
-CMD ["op-conductor"]

op-conductor/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

op-dispute-mon/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

op-heartbeat/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-
-FROM alpine:3.18
-
-COPY --from=builder /usr/local/bin/op-heartbeat /usr/local/bin/op-heartbeat
-
-CMD ["op-heartbeat"]

op-heartbeat/Dockerfile.dockerignore

-# ignore everything but the dockerfile, the op-stack-go base image performs the build
-*

op-heartbeat/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

op-node/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-
-FROM alpine:3.18
-
-COPY --from=builder /usr/local/bin/op-node /usr/local/bin/op-node
-
-CMD ["op-node"]

op-node/Dockerfile.dockerignore

-# ignore everything but the dockerfile, the op-stack-go base image performs the build
-*

op-plasma/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

op-program/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-
-FROM alpine:3.18
-
-COPY --from=builder /usr/local/bin/op-program /usr/local/bin/op-program
-
-CMD ["op-program"]

op-program/Dockerfile.dockerignore

-# ignore everything but the dockerfile, the op-stack-go base image performs the build
-*

op-program/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)
-LDFLAGSSTRING +=-X github.com/ethereum-optimism/optimism/op-program/version.Version=$(VERSION)
 LDFLAGSSTRING +=-X github.com/ethereum-optimism/optimism/op-program/version.Meta=$(VERSION_META)
-LDFLAGS := -ldflags "$(LDFLAGSSTRING)"
+
+# op-program-client version must ALWAYS be set to the same value (v0.0.0) to ensure exact build is reproducible
+PC_LDFLAGSSTRING := $(LDFLAGSSTRING)
+PC_LDFLAGSSTRING +=-X github.com/ethereum-optimism/optimism/op-program/version.Version=v0.0.0
+
+LDFLAGSSTRING +=-X github.com/ethereum-optimism/optimism/op-program/version.Version=$(VERSION)
 
 COMPAT_DIR := temp/compat
 
@@ -16,18 +20,18 @@ op-program: \
 	op-program-client-mips
 
 op-program-host:
-	env GO111MODULE=on GOOS=$(TARGETOS) GOARCH=$(TARGETARCH) go build -v $(LDFLAGS) -o ./bin/op-program ./host/cmd/main.go
+	env GO111MODULE=on GOOS=$(TARGETOS) GOARCH=$(TARGETARCH) go build -v -ldflags "$(LDFLAGSSTRING)" -o ./bin/op-program ./host/cmd/main.go
 
 op-program-client:
-	env GO111MODULE=on GOOS=$(TARGETOS) GOARCH=$(TARGETARCH) go build -v $(LDFLAGS) -o ./bin/op-program-client ./client/cmd/main.go
+	env GO111MODULE=on GOOS=$(TARGETOS) GOARCH=$(TARGETARCH) go build -v -ldflags "$(PC_LDFLAGSSTRING)" -o ./bin/op-program-client ./client/cmd/main.go
 
 op-program-client-mips:
-	env GO111MODULE=on GOOS=linux GOARCH=mips GOMIPS=softfloat go build -v $(LDFLAGS) -o ./bin/op-program-client.elf ./client/cmd/main.go
+	env GO111MODULE=on GOOS=linux GOARCH=mips GOMIPS=softfloat go build -v -ldflags "$(LDFLAGSSTRING)" -o ./bin/op-program-client.elf ./client/cmd/main.go
 	# verify output with: readelf -h bin/op-program-client.elf
 	# result is mips32, big endian, R3000
 
 op-program-client-riscv:
-	env GO111MODULE=on GOOS=linux GOARCH=riscv64 go build -v -gcflags="all=-d=softfloat" $(LDFLAGS) -o ./bin/op-program-client-riscv.elf ./client/cmd/main.go
+	env GO111MODULE=on GOOS=linux GOARCH=riscv64 go build -v -gcflags="all=-d=softfloat" -ldflags "$(LDFLAGSSTRING)" -o ./bin/op-program-client-riscv.elf ./client/cmd/main.go
 
 reproducible-prestate:
 	@docker build --output ./bin/ --progress plain -f Dockerfile.repro ../

op-proposer/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-
-FROM alpine:3.18
-
-COPY --from=builder /usr/local/bin/op-proposer /usr/local/bin/op-proposer
-
-CMD ["op-proposer"]

op-proposer/Dockerfile.dockerignore

-# ignore everything but the dockerfile, the op-stack-go base image performs the build
-*

op-wheel/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-FROM alpine:3.18
-
-COPY --from=builder /app/op-wheel/bin/op-wheel /usr/local/bin
-
-CMD ["op-wheel"]

op-wheel/Dockerfile.dockerignore

-# ignore everything but the dockerfile, the op-stack-go base image performs the build
-*

op-wheel/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

ops-bedrock/docker-compose.yml

@@ -14,15 +14,6 @@ volumes:
 
 
 services:
-  op_stack_go_builder:  # Not an actual service, but builds the prerequisite go images
-    build:
-      context: ../
-      dockerfile: ops/docker/op-stack-go/Dockerfile
-      args:
-        GIT_COMMIT: "dev"
-        GIT_DATE: "0"
-    image: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:devnet
-    entrypoint: ["echo", "build complete"]
 
   l1:
     build:
@@ -59,14 +50,12 @@ services:
 
   op-node:
     depends_on:
-      - op_stack_go_builder
       - l1
       - l2
     build:
       context: ../
-      dockerfile: ./op-node/Dockerfile
-      args:
-        OP_STACK_GO_BUILDER: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:devnet
+      dockerfile: ops/docker/op-stack-go/Dockerfile
+      target: op-node-target
     image: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-node:devnet
     command: >
       op-node
@@ -110,15 +99,13 @@ services:
 
   op-proposer:
     depends_on:
-      - op_stack_go_builder
       - l1
       - l2
       - op-node
     build:
       context: ../
-      dockerfile: ./op-proposer/Dockerfile
-      args:
-        OP_STACK_GO_BUILDER: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:devnet
+      dockerfile: ops/docker/op-stack-go/Dockerfile
+      target: op-proposer-target
     image: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-proposer:devnet
     ports:
       - "6062:6060"
@@ -142,15 +129,13 @@ services:
 
   op-batcher:
     depends_on:
-      - op_stack_go_builder
       - l1
       - l2
       - op-node
     build:
       context: ../
-      dockerfile: ./op-batcher/Dockerfile
-      args:
-        OP_STACK_GO_BUILDER: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:devnet
+      dockerfile: ops/docker/op-stack-go/Dockerfile
+      target: op-batcher-target
     image: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-batcher:devnet
     ports:
       - "6061:6060"
@@ -175,15 +160,13 @@ services:
 
   op-challenger:
     depends_on:
-      - op_stack_go_builder
       - l1
       - l2
       - op-node
     build:
       context: ../
-      dockerfile: ./op-challenger/Dockerfile
-      args:
-        OP_STACK_GO_BUILDER: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:devnet
+      dockerfile: ops/docker/op-stack-go/Dockerfile
+      target: op-challenger-target
     image: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-challenger:devnet
     volumes:
       - "challenger_data:/db"
@@ -210,14 +193,11 @@ services:
       OP_CHALLENGER_NUM_CONFIRMATIONS: 1
 
   da-server:
-    depends_on:
-      - op_stack_go_builder
     image: us-docker.pkg.dev/oplabs-tools-artifacts/images/da-server:devnet
     build:
       context: ../
-      dockerfile: ./op-plasma/Dockerfile
-      args:
-        OP_STACK_GO_BUILDER: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:devnet
+      dockerfile: ops/docker/op-stack-go/Dockerfile
+      target: da-server-target
     command: >
       da-server
       --file.path=/data

ops/docker/op-stack-go/Dockerfile

+# automatically set by buildkit, can be changed with --platform flag
+# see https://docs.docker.com/engine/reference/builder/#automatic-platform-args-in-the-global-scope
+# TARGETOS
+# TARGETARCH
+# TARGETPLATFORM
+# BUILDPLATFORM
+ARG TARGETOS
+ARG TARGETARCH
+
+# All target images use this as base image, and add the final build results.
+# It will default to the target platform.
+ARG TARGET_BASE_IMAGE=alpine:3.18
+
+# We may be cross-building for another platform. Specify which platform we need as builder.
 FROM --platform=$BUILDPLATFORM golang:1.21.3-alpine3.18 as builder
 
 RUN apk add --no-cache make gcc musl-dev linux-headers git jq bash
@@ -11,6 +25,7 @@ WORKDIR /app
 RUN echo "go mod cache: $(go env GOMODCACHE)"
 RUN echo "go build cache: $(go env GOCACHE)"
 
+# warm-up the cache
 RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build go mod download
 
 # NOTE: the Dockerfile.dockerignore file effectively describes all dependencies
@@ -23,70 +38,123 @@ COPY . /app
 ARG GIT_COMMIT
 ARG GIT_DATE
 
-ARG CANNON_VERSION=v0.0.0
-ARG OP_PROGRAM_VERSION=v0.0.0
-
-ARG OP_HEARTBEAT_VERSION=v0.0.0
-ARG OP_WHEEL_VERSION=v0.0.0
-
-ARG OP_NODE_VERSION=v0.0.0
-ARG OP_CHALLENGER_VERSION=v0.0.0
-ARG OP_DISPUTE_MON_VERSION=v0.0.0
-ARG OP_BATCHER_VERSION=v0.0.0
-ARG OP_PROPOSER_VERSION=v0.0.0
-ARG OP_CONDUCTOR_VERSION=v0.0.0
-
-
 # separate docker-builds:
 # - op-ufm
 # - proxyd
 # - any JS/TS/smart-contract builds
 
+# TODO: if the build involves optional CGO, then:
+# 1) we may have to disable CGO explicitly
+# 3) apk install cross-build gcc,
+#    and specify to go to use that, with the CC flag
+
 ARG TARGETOS TARGETARCH
 
 # Build the Go services, utilizing caches and share the many common packages.
 # The "id" defaults to the value of "target", the cache will thus be reused during this build.
 # "sharing" defaults to "shared", the cache will thus be available to other concurrent docker builds.
-
+FROM --platform=$BUILDPLATFORM builder as cannon-builder
+ARG CANNON_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd cannon && make cannon  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE VERSION="$CANNON_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as op-program-builder
+ARG OP_PROGRAM_VERSION=v0.0.0
 # note: we only build the host, that's all the user needs. No Go MIPS cross-build in docker
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-program && make op-program-host  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE VERSION="$OP_PROGRAM_VERSION"
 
+FROM --platform=$BUILDPLATFORM builder as op-heartbeat-builder
+ARG OP_HEARTBEAT_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-heartbeat && make op-heartbeat  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE VERSION="$OP_HEARTBEAT_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as op-wheel-builder
+ARG OP_WHEEL_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-wheel && make op-wheel  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE  VERSION="$OP_WHEEL_VERSION"
 
+FROM --platform=$BUILDPLATFORM builder as op-node-builder
+ARG OP_NODE_VERSION=v0.0.0
+RUN echo TARGETOS=$TARGETOS TARGETARCH=$TARGETARCH BUILDPLATFORM=$BUILDPLATFORM TARGETPLATFORM=$TARGETPLATFORM OP_NODE_VERSION=$OP_NODE_VERSION
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-node && make op-node  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE VERSION="$OP_NODE_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as op-challenger-builder
+ARG OP_CHALLENGER_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-challenger && make op-challenger  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE  VERSION="$OP_CHALLENGER_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as op-dispute-mon-builder
+ARG OP_DISPUTE_MON_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-dispute-mon && make op-dispute-mon  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE  VERSION="$OP_DISPUTE_MON_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as op-batcher-builder
+ARG OP_BATCHER_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-batcher && make op-batcher  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE  VERSION="$OP_BATCHER_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as op-proposer-builder
+ARG OP_PROPOSER_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-proposer && make op-proposer  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE  VERSION="$OP_PROPOSER_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as op-conductor-builder
+ARG OP_CONDUCTOR_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-conductor && make op-conductor  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE  VERSION="$OP_CONDUCTOR_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as da-server-builder
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-plasma && make da-server  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE
 
-
-FROM alpine:3.18
-
-COPY --from=builder /app/cannon/bin/cannon /usr/local/bin/
-COPY --from=builder /app/op-program/bin/op-program /usr/local/bin/
-
-COPY --from=builder /app/op-heartbeat/bin/op-heartbeat /usr/local/bin/
-COPY --from=builder /app/op-wheel/bin/op-wheel /usr/local/bin/
-
-COPY --from=builder /app/op-node/bin/op-node /usr/local/bin/
-COPY --from=builder /app/op-challenger/bin/op-challenger /usr/local/bin/
-COPY --from=builder /app/op-dispute-mon/bin/op-dispute-mon /usr/local/bin/
-COPY --from=builder /app/op-batcher/bin/op-batcher /usr/local/bin/
-COPY --from=builder /app/op-proposer/bin/op-proposer /usr/local/bin/
-COPY --from=builder /app/op-conductor/bin/op-conductor /usr/local/bin/
-COPY --from=builder /app/op-plasma/bin/da-server /usr/local/bin/
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as cannon-target
+COPY --from=cannon-builder /app/cannon/bin/cannon /usr/local/bin/
+CMD ["cannon"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-program-target
+COPY --from=op-program-builder /app/op-program/bin/op-program /usr/local/bin/
+CMD ["op-program"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-heartbeat-target
+COPY --from=op-heartbeat-builder /app/op-heartbeat/bin/op-heartbeat /usr/local/bin/
+CMD ["op-heartbeat"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-wheel-target
+COPY --from=op-wheel-builder /app/op-wheel/bin/op-wheel /usr/local/bin/
+CMD ["op-wheel"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-node-target
+COPY --from=op-node-builder /app/op-node/bin/op-node /usr/local/bin/
+CMD ["op-node"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-challenger-target
+COPY --from=op-challenger-builder /app/op-challenger/bin/op-challenger /usr/local/bin/
+# Make the bundled op-program the default cannon server
+COPY --from=op-program-builder /app/op-program/bin/op-program /usr/local/bin/
+ENV OP_CHALLENGER_CANNON_SERVER /usr/local/bin/op-program
+# Make the bundled cannon the default cannon executable
+COPY --from=cannon-builder /app/cannon/bin/cannon /usr/local/bin/
+ENV OP_CHALLENGER_CANNON_BIN /usr/local/bin/cannon
+CMD ["op-challenger"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-dispute-mon-target
+COPY --from=op-dispute-mon-builder /app/op-dispute-mon/bin/op-dispute-mon /usr/local/bin/
+CMD ["op-dispute-mon"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-batcher-target
+COPY --from=op-batcher-builder /app/op-batcher/bin/op-batcher /usr/local/bin/
+CMD ["op-batcher"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-proposer-target
+COPY --from=op-proposer-builder /app/op-proposer/bin/op-proposer /usr/local/bin/
+CMD ["op-proposer"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-conductor-target
+COPY --from=op-conductor-builder /app/op-conductor/bin/op-conductor /usr/local/bin/
+CMD ["op-conductor"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as da-server-target
+COPY --from=da-server-builder /app/op-plasma/bin/da-server /usr/local/bin/
+CMD ["da-server"]