Docker-targets v2 (#10346)

* Revert "Revert "Merge pull request #8242 from ethereum-optimism/go-docker-targets""

This reverts commit d972c460.

It also fixes up some conflicts / inconsistencies,
 since op-conductor was added after the original revert.

* ops: experimental cross-build fixes

* Retrieve git tag in Circle CI and use to set op version within docker image

* Update dispute-mon and da-server to use new docker build flow

* Fix GIT_VERSION script in Circle CI config.yml

* Update ops-bedrock docker-compose to use new docker build flow

* Load pre-built op-challenger image in devnet tests

* Save op-challenger.tar to avoid docker rebuild in devnet tests

* Add Circle CI job for check-cross-platform

* Allow env var to override VERSION in Makefiles

* Pass version to op-program components except op-program-client

* Wrap all docker-bake variable names in quotes

---------
Co-authored-by: protolambda <proto@protolambda.com>

Makefile

@@ -41,6 +41,42 @@ golang-docker:
 			op-node op-batcher op-proposer op-challenger op-dispute-mon
 .PHONY: golang-docker
 
+docker-builder-clean:
+	docker buildx rm buildx-build
+.PHONY: docker-builder-clean
+
+docker-builder:
+	docker buildx create \
+		--driver=docker-container --name=buildx-build --bootstrap --use
+.PHONY: docker-builder
+
+# add --print to dry-run
+cross-op-node:
+	# We don't use a buildx builder here, and just load directly into regular docker, for convenience.
+	GIT_COMMIT=$$(git rev-parse HEAD) \
+	GIT_DATE=$$(git show -s --format='%ct') \
+	IMAGE_TAGS=$$(git rev-parse HEAD),latest \
+	PLATFORMS="linux/arm64" \
+	GIT_VERSION=$(shell tags=$$(git tag --points-at $(GITCOMMIT) | grep '^op-node/' | sed 's/op-node\///' | sort -V); \
+             preferred_tag=$$(echo "$$tags" | grep -v -- '-rc' | tail -n 1); \
+             if [ -z "$$preferred_tag" ]; then \
+                 if [ -z "$$tags" ]; then \
+                     echo "untagged"; \
+                 else \
+                     echo "$$tags" | tail -n 1; \
+                 fi \
+             else \
+                 echo $$preferred_tag; \
+             fi) \
+	docker buildx bake \
+			--progress plain \
+			--builder=buildx-build \
+			--load \
+			--no-cache \
+			-f docker-bake.hcl \
+			op-node
+.PHONY: golang-docker
+
 chain-mon-docker:
 	# We don't use a buildx builder here, and just load directly into regular docker, for convenience.
 	GIT_COMMIT=$$(git rev-parse HEAD) \

cannon/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

docker-bake.hcl

@@ -14,8 +14,10 @@ variable "GIT_DATE" {
   default = "0"
 }
 
+// The default version to embed in the built images.
+// During CI release builds this is set to <<pipeline.git.tag>>
 variable "GIT_VERSION" {
-  default = "docker"  // original default as set in proxyd file, not used by full go stack, yet
+  default = "v0.0.0"
 }
 
 variable "IMAGE_TAGS" {
@@ -27,133 +29,159 @@ variable "PLATFORMS" {
   // Only a specify a single platform when `--load` ing into docker.
   // Multi-platform is supported when outputting to disk or pushing to a registry.
   // Multi-platform builds can be tested locally with:  --set="*.output=type=image,push=false"
-  default = "linux/amd64"
+  default = ""
 }
 
-target "op-stack-go" {
+// Each of the services can have a customized version, but defaults to the global specified version.
+variable "OP_NODE_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "OP_BATCHER_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "OP_PROPOSER_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "OP_CHALLENGER_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "OP_DISPUTE_MON_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "OP_HEARTBEAT_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "OP_PROGRAM_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "CANNON_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+variable "OP_CONDUCTOR_VERSION" {
+  default = "${GIT_VERSION}"
+}
+
+
+target "op-node" {
   dockerfile = "ops/docker/op-stack-go/Dockerfile"
   context = "."
   args = {
     GIT_COMMIT = "${GIT_COMMIT}"
     GIT_DATE = "${GIT_DATE}"
+    OP_NODE_VERSION = "${OP_NODE_VERSION}"
   }
-  platforms = split(",", PLATFORMS)
-  tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-stack-go:${tag}"]
-}
-
-target "op-node" {
-  dockerfile = "Dockerfile"
-  context = "./op-node"
-  args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
-  }
+  target = "op-node-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-node:${tag}"]
 }
 
 target "op-batcher" {
-  dockerfile = "Dockerfile"
-  context = "./op-batcher"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    OP_BATCHER_VERSION = "${OP_BATCHER_VERSION}"
   }
+  target = "op-batcher-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-batcher:${tag}"]
 }
 
 target "op-proposer" {
-  dockerfile = "Dockerfile"
-  context = "./op-proposer"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    OP_PROPOSER_VERSION = "${OP_PROPOSER_VERSION}"
   }
+  target = "op-proposer-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-proposer:${tag}"]
 }
 
 target "op-challenger" {
-  dockerfile = "Dockerfile"
-  context = "./op-challenger"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    OP_CHALLENGER_VERSION = "${OP_CHALLENGER_VERSION}"
   }
+  target = "op-challenger-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-challenger:${tag}"]
 }
 
 target "op-dispute-mon" {
-  dockerfile = "Dockerfile"
-  context = "./op-dispute-mon"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    OP_DISPUTE_MON_VERSION = "${OP_DISPUTE_MON_VERSION}"
   }
+  target = "op-dispute-mon-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-dispute-mon:${tag}"]
 }
 
 target "op-conductor" {
-  dockerfile = "Dockerfile"
-  context = "./op-conductor"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    OP_CONDUCTOR_VERSION = "${OP_CONDUCTOR_VERSION}"
   }
+  target = "op-conductor-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-conductor:${tag}"]
 }
 
 target "op-heartbeat" {
-  dockerfile = "Dockerfile"
-  context = "./op-heartbeat"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    OP_HEARTBEAT_VERSION = "${OP_HEARTBEAT_VERSION}"
   }
+  target = "op-heartbeat-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-heartbeat:${tag}"]
 }
 
 target "da-server" {
-  dockerfile = "Dockerfile"
-  context = "./op-plasma"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
   }
+  target = "da-server-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/da-server:${tag}"]
 }
 
 target "op-program" {
-  dockerfile = "Dockerfile"
-  context = "./op-program"
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
   args = {
-    OP_STACK_GO_BUILDER = "op-stack-go"
-  }
-  contexts = {
-    op-stack-go: "target:op-stack-go"
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    OP_PROGRAM_VERSION = "${OP_PROGRAM_VERSION}"
   }
+  target = "op-program-target"
   platforms = split(",", PLATFORMS)
   tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-program:${tag}"]
 }
@@ -171,6 +199,19 @@ target "op-ufm" {
   tags      = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/op-ufm:${tag}"]
 }
 
+target "cannon" {
+  dockerfile = "ops/docker/op-stack-go/Dockerfile"
+  context = "."
+  args = {
+    GIT_COMMIT = "${GIT_COMMIT}"
+    GIT_DATE = "${GIT_DATE}"
+    CANNON_VERSION = "${CANNON_VERSION}"
+  }
+  target = "cannon-target"
+  platforms = split(",", PLATFORMS)
+  tags = [for tag in split(",", IMAGE_TAGS) : "${REGISTRY}/${REPOSITORY}/cannon:${tag}"]
+}
+
 target "proxyd" {
   dockerfile = "./proxyd/Dockerfile"
   context = "./"

op-batcher/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-
-FROM alpine:3.18
-
-COPY --from=builder /usr/local/bin/op-batcher /usr/local/bin/op-batcher
-
-CMD ["op-batcher"]

op-batcher/Dockerfile.dockerignore

-# ignore everything but the dockerfile, the op-stack-go base image performs the build
-*

op-bootnode/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

op-challenger/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-
-FROM alpine:3.18
-
-# Make the bundled op-program the default cannon server
-COPY --from=builder /usr/local/bin/op-program /usr/local/bin/op-program
-ENV OP_CHALLENGER_CANNON_SERVER /usr/local/bin/op-program
-
-# Make the bundled cannon the default cannon executable
-COPY --from=builder /usr/local/bin/cannon /usr/local/bin/cannon
-ENV OP_CHALLENGER_CANNON_BIN /usr/local/bin/cannon
-
-COPY --from=builder /usr/local/bin/op-challenger /usr/local/bin/op-challenger
-
-CMD ["op-challenger"]

op-challenger/Dockerfile.dockerignore

-# ignore everything but the dockerfile, the op-stack-go base image performs the build
-*

op-challenger/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

op-conductor/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-
-FROM alpine:3.18
-
-COPY --from=builder /usr/local/bin/op-conductor /usr/local/bin/op-conductor
-
-CMD ["op-conductor"]

op-conductor/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

op-dispute-mon/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

op-heartbeat/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-
-FROM alpine:3.18
-
-COPY --from=builder /usr/local/bin/op-heartbeat /usr/local/bin/op-heartbeat
-
-CMD ["op-heartbeat"]

op-heartbeat/Dockerfile.dockerignore

-# ignore everything but the dockerfile, the op-stack-go base image performs the build
-*

op-heartbeat/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

op-node/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-
-FROM alpine:3.18
-
-COPY --from=builder /usr/local/bin/op-node /usr/local/bin/op-node
-
-CMD ["op-node"]

op-node/Dockerfile.dockerignore

-# ignore everything but the dockerfile, the op-stack-go base image performs the build
-*

op-plasma/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

op-program/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-
-FROM alpine:3.18
-
-COPY --from=builder /usr/local/bin/op-program /usr/local/bin/op-program
-
-CMD ["op-program"]

op-program/Dockerfile.dockerignore

-# ignore everything but the dockerfile, the op-stack-go base image performs the build
-*

op-program/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)
-LDFLAGSSTRING +=-X github.com/ethereum-optimism/optimism/op-program/version.Version=$(VERSION)
 LDFLAGSSTRING +=-X github.com/ethereum-optimism/optimism/op-program/version.Meta=$(VERSION_META)
-LDFLAGS := -ldflags "$(LDFLAGSSTRING)"
+
+# op-program-client version must ALWAYS be set to the same value (v0.0.0) to ensure exact build is reproducible
+PC_LDFLAGSSTRING := $(LDFLAGSSTRING)
+PC_LDFLAGSSTRING +=-X github.com/ethereum-optimism/optimism/op-program/version.Version=v0.0.0
+
+LDFLAGSSTRING +=-X github.com/ethereum-optimism/optimism/op-program/version.Version=$(VERSION)
 
 COMPAT_DIR := temp/compat
 
@@ -16,18 +20,18 @@ op-program: \
 	op-program-client-mips
 
 op-program-host:
-	env GO111MODULE=on GOOS=$(TARGETOS) GOARCH=$(TARGETARCH) go build -v $(LDFLAGS) -o ./bin/op-program ./host/cmd/main.go
+	env GO111MODULE=on GOOS=$(TARGETOS) GOARCH=$(TARGETARCH) go build -v -ldflags "$(LDFLAGSSTRING)" -o ./bin/op-program ./host/cmd/main.go
 
 op-program-client:
-	env GO111MODULE=on GOOS=$(TARGETOS) GOARCH=$(TARGETARCH) go build -v $(LDFLAGS) -o ./bin/op-program-client ./client/cmd/main.go
+	env GO111MODULE=on GOOS=$(TARGETOS) GOARCH=$(TARGETARCH) go build -v -ldflags "$(PC_LDFLAGSSTRING)" -o ./bin/op-program-client ./client/cmd/main.go
 
 op-program-client-mips:
-	env GO111MODULE=on GOOS=linux GOARCH=mips GOMIPS=softfloat go build -v $(LDFLAGS) -o ./bin/op-program-client.elf ./client/cmd/main.go
+	env GO111MODULE=on GOOS=linux GOARCH=mips GOMIPS=softfloat go build -v -ldflags "$(LDFLAGSSTRING)" -o ./bin/op-program-client.elf ./client/cmd/main.go
 	# verify output with: readelf -h bin/op-program-client.elf
 	# result is mips32, big endian, R3000
 
 op-program-client-riscv:
-	env GO111MODULE=on GOOS=linux GOARCH=riscv64 go build -v -gcflags="all=-d=softfloat" $(LDFLAGS) -o ./bin/op-program-client-riscv.elf ./client/cmd/main.go
+	env GO111MODULE=on GOOS=linux GOARCH=riscv64 go build -v -gcflags="all=-d=softfloat" -ldflags "$(LDFLAGSSTRING)" -o ./bin/op-program-client-riscv.elf ./client/cmd/main.go
 
 reproducible-prestate:
 	@docker build --output ./bin/ --progress plain -f Dockerfile.repro ../

op-proposer/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-
-FROM alpine:3.18
-
-COPY --from=builder /usr/local/bin/op-proposer /usr/local/bin/op-proposer
-
-CMD ["op-proposer"]

op-proposer/Dockerfile.dockerignore

-# ignore everything but the dockerfile, the op-stack-go base image performs the build
-*

op-wheel/Dockerfile

-ARG OP_STACK_GO_BUILDER=us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:latest
-FROM $OP_STACK_GO_BUILDER as builder
-# See "make golang-docker" and /ops/docker/op-stack-go
-FROM alpine:3.18
-
-COPY --from=builder /app/op-wheel/bin/op-wheel /usr/local/bin
-
-CMD ["op-wheel"]

op-wheel/Dockerfile.dockerignore

-# ignore everything but the dockerfile, the op-stack-go base image performs the build
-*

op-wheel/Makefile

 GITCOMMIT ?= $(shell git rev-parse HEAD)
 GITDATE ?= $(shell git show -s --format='%ct')
-VERSION := v0.0.0
+VERSION ?= v0.0.0
 
 LDFLAGSSTRING +=-X main.GitCommit=$(GITCOMMIT)
 LDFLAGSSTRING +=-X main.GitDate=$(GITDATE)

ops-bedrock/docker-compose.yml

@@ -14,15 +14,6 @@ volumes:
 
 
 services:
-  op_stack_go_builder:  # Not an actual service, but builds the prerequisite go images
-    build:
-      context: ../
-      dockerfile: ops/docker/op-stack-go/Dockerfile
-      args:
-        GIT_COMMIT: "dev"
-        GIT_DATE: "0"
-    image: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:devnet
-    entrypoint: ["echo", "build complete"]
 
   l1:
     build:
@@ -59,14 +50,12 @@ services:
 
   op-node:
     depends_on:
-      - op_stack_go_builder
       - l1
       - l2
     build:
       context: ../
-      dockerfile: ./op-node/Dockerfile
-      args:
-        OP_STACK_GO_BUILDER: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:devnet
+      dockerfile: ops/docker/op-stack-go/Dockerfile
+      target: op-node-target
     image: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-node:devnet
     command: >
       op-node
@@ -110,15 +99,13 @@ services:
 
   op-proposer:
     depends_on:
-      - op_stack_go_builder
       - l1
       - l2
       - op-node
     build:
       context: ../
-      dockerfile: ./op-proposer/Dockerfile
-      args:
-        OP_STACK_GO_BUILDER: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:devnet
+      dockerfile: ops/docker/op-stack-go/Dockerfile
+      target: op-proposer-target
     image: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-proposer:devnet
     ports:
       - "6062:6060"
@@ -142,15 +129,13 @@ services:
 
   op-batcher:
     depends_on:
-      - op_stack_go_builder
       - l1
       - l2
       - op-node
     build:
       context: ../
-      dockerfile: ./op-batcher/Dockerfile
-      args:
-        OP_STACK_GO_BUILDER: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:devnet
+      dockerfile: ops/docker/op-stack-go/Dockerfile
+      target: op-batcher-target
     image: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-batcher:devnet
     ports:
       - "6061:6060"
@@ -175,15 +160,13 @@ services:
 
   op-challenger:
     depends_on:
-      - op_stack_go_builder
       - l1
       - l2
       - op-node
     build:
       context: ../
-      dockerfile: ./op-challenger/Dockerfile
-      args:
-        OP_STACK_GO_BUILDER: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:devnet
+      dockerfile: ops/docker/op-stack-go/Dockerfile
+      target: op-challenger-target
     image: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-challenger:devnet
     volumes:
       - "challenger_data:/db"
@@ -210,14 +193,11 @@ services:
       OP_CHALLENGER_NUM_CONFIRMATIONS: 1
 
   da-server:
-    depends_on:
-      - op_stack_go_builder
     image: us-docker.pkg.dev/oplabs-tools-artifacts/images/da-server:devnet
     build:
       context: ../
-      dockerfile: ./op-plasma/Dockerfile
-      args:
-        OP_STACK_GO_BUILDER: us-docker.pkg.dev/oplabs-tools-artifacts/images/op-stack-go:devnet
+      dockerfile: ops/docker/op-stack-go/Dockerfile
+      target: da-server-target
     command: >
       da-server
       --file.path=/data

ops/docker/op-stack-go/Dockerfile

+# automatically set by buildkit, can be changed with --platform flag
+# see https://docs.docker.com/engine/reference/builder/#automatic-platform-args-in-the-global-scope
+# TARGETOS
+# TARGETARCH
+# TARGETPLATFORM
+# BUILDPLATFORM
+ARG TARGETOS
+ARG TARGETARCH
+
+# All target images use this as base image, and add the final build results.
+# It will default to the target platform.
+ARG TARGET_BASE_IMAGE=alpine:3.18
+
+# We may be cross-building for another platform. Specify which platform we need as builder.
 FROM --platform=$BUILDPLATFORM golang:1.21.3-alpine3.18 as builder
 
 RUN apk add --no-cache make gcc musl-dev linux-headers git jq bash
@@ -11,6 +25,7 @@ WORKDIR /app
 RUN echo "go mod cache: $(go env GOMODCACHE)"
 RUN echo "go build cache: $(go env GOCACHE)"
 
+# warm-up the cache
 RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/go-build go mod download
 
 # NOTE: the Dockerfile.dockerignore file effectively describes all dependencies
@@ -23,70 +38,123 @@ COPY . /app
 ARG GIT_COMMIT
 ARG GIT_DATE
 
-ARG CANNON_VERSION=v0.0.0
-ARG OP_PROGRAM_VERSION=v0.0.0
-
-ARG OP_HEARTBEAT_VERSION=v0.0.0
-ARG OP_WHEEL_VERSION=v0.0.0
-
-ARG OP_NODE_VERSION=v0.0.0
-ARG OP_CHALLENGER_VERSION=v0.0.0
-ARG OP_DISPUTE_MON_VERSION=v0.0.0
-ARG OP_BATCHER_VERSION=v0.0.0
-ARG OP_PROPOSER_VERSION=v0.0.0
-ARG OP_CONDUCTOR_VERSION=v0.0.0
-
-
 # separate docker-builds:
 # - op-ufm
 # - proxyd
 # - any JS/TS/smart-contract builds
 
+# TODO: if the build involves optional CGO, then:
+# 1) we may have to disable CGO explicitly
+# 3) apk install cross-build gcc,
+#    and specify to go to use that, with the CC flag
+
 ARG TARGETOS TARGETARCH
 
 # Build the Go services, utilizing caches and share the many common packages.
 # The "id" defaults to the value of "target", the cache will thus be reused during this build.
 # "sharing" defaults to "shared", the cache will thus be available to other concurrent docker builds.
-
+FROM --platform=$BUILDPLATFORM builder as cannon-builder
+ARG CANNON_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd cannon && make cannon  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE VERSION="$CANNON_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as op-program-builder
+ARG OP_PROGRAM_VERSION=v0.0.0
 # note: we only build the host, that's all the user needs. No Go MIPS cross-build in docker
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-program && make op-program-host  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE VERSION="$OP_PROGRAM_VERSION"
 
+FROM --platform=$BUILDPLATFORM builder as op-heartbeat-builder
+ARG OP_HEARTBEAT_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-heartbeat && make op-heartbeat  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE VERSION="$OP_HEARTBEAT_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as op-wheel-builder
+ARG OP_WHEEL_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-wheel && make op-wheel  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE  VERSION="$OP_WHEEL_VERSION"
 
+FROM --platform=$BUILDPLATFORM builder as op-node-builder
+ARG OP_NODE_VERSION=v0.0.0
+RUN echo TARGETOS=$TARGETOS TARGETARCH=$TARGETARCH BUILDPLATFORM=$BUILDPLATFORM TARGETPLATFORM=$TARGETPLATFORM OP_NODE_VERSION=$OP_NODE_VERSION
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-node && make op-node  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE VERSION="$OP_NODE_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as op-challenger-builder
+ARG OP_CHALLENGER_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-challenger && make op-challenger  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE  VERSION="$OP_CHALLENGER_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as op-dispute-mon-builder
+ARG OP_DISPUTE_MON_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-dispute-mon && make op-dispute-mon  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE  VERSION="$OP_DISPUTE_MON_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as op-batcher-builder
+ARG OP_BATCHER_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-batcher && make op-batcher  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE  VERSION="$OP_BATCHER_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as op-proposer-builder
+ARG OP_PROPOSER_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-proposer && make op-proposer  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE  VERSION="$OP_PROPOSER_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as op-conductor-builder
+ARG OP_CONDUCTOR_VERSION=v0.0.0
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-conductor && make op-conductor  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE  VERSION="$OP_CONDUCTOR_VERSION"
+
+FROM --platform=$BUILDPLATFORM builder as da-server-builder
 RUN --mount=type=cache,target=/root/.cache/go-build cd op-plasma && make da-server  \
     GOOS=$TARGETOS GOARCH=$TARGETARCH GITCOMMIT=$GIT_COMMIT GITDATE=$GIT_DATE
 
-
-FROM alpine:3.18
-
-COPY --from=builder /app/cannon/bin/cannon /usr/local/bin/
-COPY --from=builder /app/op-program/bin/op-program /usr/local/bin/
-
-COPY --from=builder /app/op-heartbeat/bin/op-heartbeat /usr/local/bin/
-COPY --from=builder /app/op-wheel/bin/op-wheel /usr/local/bin/
-
-COPY --from=builder /app/op-node/bin/op-node /usr/local/bin/
-COPY --from=builder /app/op-challenger/bin/op-challenger /usr/local/bin/
-COPY --from=builder /app/op-dispute-mon/bin/op-dispute-mon /usr/local/bin/
-COPY --from=builder /app/op-batcher/bin/op-batcher /usr/local/bin/
-COPY --from=builder /app/op-proposer/bin/op-proposer /usr/local/bin/
-COPY --from=builder /app/op-conductor/bin/op-conductor /usr/local/bin/
-COPY --from=builder /app/op-plasma/bin/da-server /usr/local/bin/
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as cannon-target
+COPY --from=cannon-builder /app/cannon/bin/cannon /usr/local/bin/
+CMD ["cannon"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-program-target
+COPY --from=op-program-builder /app/op-program/bin/op-program /usr/local/bin/
+CMD ["op-program"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-heartbeat-target
+COPY --from=op-heartbeat-builder /app/op-heartbeat/bin/op-heartbeat /usr/local/bin/
+CMD ["op-heartbeat"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-wheel-target
+COPY --from=op-wheel-builder /app/op-wheel/bin/op-wheel /usr/local/bin/
+CMD ["op-wheel"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-node-target
+COPY --from=op-node-builder /app/op-node/bin/op-node /usr/local/bin/
+CMD ["op-node"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-challenger-target
+COPY --from=op-challenger-builder /app/op-challenger/bin/op-challenger /usr/local/bin/
+# Make the bundled op-program the default cannon server
+COPY --from=op-program-builder /app/op-program/bin/op-program /usr/local/bin/
+ENV OP_CHALLENGER_CANNON_SERVER /usr/local/bin/op-program
+# Make the bundled cannon the default cannon executable
+COPY --from=cannon-builder /app/cannon/bin/cannon /usr/local/bin/
+ENV OP_CHALLENGER_CANNON_BIN /usr/local/bin/cannon
+CMD ["op-challenger"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-dispute-mon-target
+COPY --from=op-dispute-mon-builder /app/op-dispute-mon/bin/op-dispute-mon /usr/local/bin/
+CMD ["op-dispute-mon"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-batcher-target
+COPY --from=op-batcher-builder /app/op-batcher/bin/op-batcher /usr/local/bin/
+CMD ["op-batcher"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-proposer-target
+COPY --from=op-proposer-builder /app/op-proposer/bin/op-proposer /usr/local/bin/
+CMD ["op-proposer"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as op-conductor-target
+COPY --from=op-conductor-builder /app/op-conductor/bin/op-conductor /usr/local/bin/
+CMD ["op-conductor"]
+
+FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE as da-server-target
+COPY --from=da-server-builder /app/op-plasma/bin/da-server /usr/local/bin/
+CMD ["da-server"]