ops: Add oneshot deployment container (#3393)

* ops: Add oneshot deployment container

Adds a one-shot container that runs both op-geth and op-node in the same container. It also embeds the configuration for a specific network in the container in order to cut down on deployment errors.

See README.md for full usage and architecture.

* remove env var

ops-bedrock/oneshot/Dockerfile.oneshot

+ARG op_node_image
+ARG op_geth_image
+
+FROM us-central1-docker.pkg.dev/bedrock-goerli-development/images/op-node:$op_node_image as op_node
+
+FROM ethereumoptimism/op-geth:$op_geth_image as op_geth
+
+FROM alpine:3.16.2
+
+ARG network_name
+ARG S6_OVERLAY_VERSION=3.1.0.1
+
+ENV JWT_SECRET=dummy
+ENV P2P_SECRET=dummy
+
+ENV OP_GETH_VERBOSITY=3 \
+	OP_GETH_HTTP_ADDR="0.0.0.0" \
+	OP_GETH_HTTP_CORSDOMAIN="*" \
+	OP_GETH_HTTP_VHOSTS="*" \
+	OP_GETH_HTTP_PORT=8545 \
+	OP_GETH_WS_ADDR="0.0.0.0" \
+	OP_GETH_WS_PORT=8546 \
+	OP_GETH_WS_ORIGINS="*" \
+	OP_GETH_MAX_PEERS=1 \
+	OP_GETH_SEQUENCER_HTTP="https://$network_name-sequencer.bedrock-goerli.optimism.io"
+
+RUN apk add --no-cache curl jq bash hexdump musl-dev linux-headers
+
+COPY --from=op_node /usr/local/bin/op-node /usr/local/bin/op-node
+COPY --from=op_geth /usr/local/bin/geth /usr/local/bin/geth
+
+ADD https://storage.googleapis.com/bedrock-goerli-regenesis-data/$network_name/rollup.json /etc/op-node/rollup.json
+ADD https://storage.googleapis.com/bedrock-goerli-regenesis-data/$network_name/genesis.json /etc/op-geth/genesis.json
+ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz /tmp
+ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-noarch.tar.xz.sha256 /tmp
+ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-x86_64.tar.xz /tmp
+ADD https://github.com/just-containers/s6-overlay/releases/download/v${S6_OVERLAY_VERSION}/s6-overlay-x86_64.tar.xz.sha256 /tmp
+
+COPY ./s6-rc.d /etc/s6-overlay/s6-rc.d
+COPY ./op-init.sh /usr/local/bin/op-init.sh
+
+RUN cd /tmp && \
+	sha256sum -c *.sha256 && \
+	tar -C / -Jxpf /tmp/s6-overlay-noarch.tar.xz && \
+	tar -C / -Jxpf /tmp/s6-overlay-x86_64.tar.xz && \
+	chmod +x /usr/local/bin/op-init.sh
+
+ENV OP_NODE_L1_ETH_RPC=dummy \
+	OP_NODE_RPC_ADDR=0.0.0.0 \
+	OP_NODE_RPC_PORT=9545 \
+	OP_NODE_P2P_DISABLE=false \
+	OP_NODE_P2P_NO_DISCOVERY=false \
+	OP_NODE_P2P_LISTEN_IP=0.0.0.0 \
+	OP_NODE_P2P_LISTEN_TCP_PORT=9003 \
+	OP_NODE_P2P_LISTEN_UDP_PORT=9003 \
+	OP_NODE_P2P_ADVERTISE_TCP=9003 \
+	OP_NODE_P2P_ADVERTISE_UDP=9003 \
+	OP_NODE_METRICS_ENABLED=true \
+	OP_NODE_METRICS_ADDR=0.0.0.0 \
+	OP_NODE_METRICS_PORT=7300 \
+	OP_NODE_SEQUENCER_L1_CONFS=4 \
+	OP_NODE_VERIFIER_L1_CONFS=4 \
+	OP_NODE_LOG_FORMAT=json \
+	OP_NODE_PPROF_ENABLED=false \
+	OP_NODE_PPROF_PORT=6666 \
+	OP_NODE_PPROF_ADDR=0.0.0.0 \
+	OP_NODE_HEARTBEAT_ENABLED=true
+
+VOLUME ["/db", "/p2p"]
+
+ENTRYPOINT ["/init"]
\ No newline at end of file

ops-bedrock/oneshot/README.md

+# Oneshot Builds
+
+This build creates a single image that runs both `op-geth` and `op-node` against a specific network. It also exposes various environment variables that are useful to configure a Bedrock replica. 
+
+## Usage
+
+The only thing you need to set to get your replica working is the `OP_NODE_L1_ETH_RPC` environment variable. Set this to an L1 RPC you control, and the container will take care of the rest. The full list of env vars you can set is below:
+
+**Opnode Configuration**
+
+Env Var|Default|Usage
+---|---|---
+`OP_NODE_L1_ETH_RPC`|dummy|RPC URL for an L1 Ethereum node.
+`OP_NODE_RPC_PORT`|9545|RPC port for the op node to listen on.
+`OP_NODE_P2P_DISABLE`|false|Whether or not P2P should be disabled.
+`OP_NODE_P2P_NO_DISCOVERY`|false|Whether or not peer discovery should be disabled.
+`OP_NODE_P2P_LISTEN_IP`|0.0.0.0|P2P listen IP.
+`OP_NODE_P2P_LISTEN_TCP_PORT`|9222|TCP port the P2P stack should listen on.
+`OP_NODE_P2P_LISTEN_UDP_PORT`|9222|UDP port the P2P stack should listen on.
+`OP_NODE_P2P_ADVERTISE_TCP`|9222|Port the P2P stack should listen on. Should usually be `OP_NODE_P2P_ADVERTISE_TCP`.
+`OP_NODE_P2P_ADVERTISE_UDP`|9222|Port the P2P stack should listen on. Should usually be `OP_NODE_P2P_ADVERTISE_UDP`.
+`OP_NODE_METRICS_ENABLED`|true|Enables Prometheus metrics.
+`OP_NODE_METRICS_ADDR`|0.0.0.0|Address the metrics server should listen on.
+`OP_NODE_METRICS_PORT`|7300|Port the metrics server should listen on.
+`OP_NODE_LOG_FORMAT`|json|Log format. Can be JSON or text.
+`OP_NODE_PPROF_ENABLED`|false|Enables `pprof` for profiling.
+`OP_NODE_PPROF_PORT`|6666|Port `pprof` should listen on.
+`OP_NODE_PPROF_ADDR`|0.0.0.0|Address `pprof` should listen on.
+`OP_NODE_HEARTBEAT_ENABLED`|true|Whether or not to enable heartbeating.
+`OP_NODE_HEARTBEAT_MONIKER`||Optional moniker to use while heartbeating.
+
+**op-geth Configuration**
+
+Env Var|Default|Usage
+---|---|---
+`OP_GETH_VERBOSITY`|3|Number 1-5 that controls how verbosely Geth should log.
+`OP_GETH_HTTP_ADDR`|0.0.0.0|Address Geth should listen on.
+`OP_GETH_HTTP_CORSDOMAIN`|*|CORS domain Geth should allow.
+`OP_GETH_HTTP_PORT`|8545|HTTP port Geth should listen on.
+`OP_GETH_WS_ADDR`|0.0.0.0|WS address Geth should listen on.
+`OP_GETH_WS_PORT`|8546|WS port Geth should listeno n.
+`OP_GETH_WS_ORIGINS`|*|WS origins Geth should allow.
+
+**Other Configuration**
+
+Additionally, the node exposes the following volumes should you wish to mount them somewhere yourself:
+
+- `/db` contains Geth's database.
+- `/p2p` contains the opnode's peer store.
+
+
+## Architecture
+
+Oneshot uses s6-overlay under the hood to supervise the processes it runs. It includes three services:
+
+1. `op-init`: A oneshot service that `op-init` and `op-node` use to initialize themselves.
+2. `op-geth`: A longrun service that manages the Geth node.
+3. `op-node`: A longrun service that manages the opnode.
\ No newline at end of file

ops-bedrock/oneshot/op-init.sh

+#!/command/with-contenv bash
+
+set -eu
+
+GETH_DATA_DIR=/db
+GETH_CHAINDATA_DIR="$GETH_DATA_DIR/geth/chaindata"
+GETH_KEYSTORE_DIR="$GETH_DATA_DIR/keystore"
+GENESIS_FILE_PATH="/etc/op-geth/genesis.json"
+
+mkdir -p /etc/secrets
+
+if [ "$OP_NODE_L1_ETH_RPC" = "dummy" ]; then
+	echo "You must specify the OP_NODE_L1_ETH_RPC environment variable."
+	exit 1	
+fi
+
+if [ "$JWT_SECRET" = "dummy" ]; then
+	echo "Regenerating JWT secret."
+	hexdump -vn32 -e'4/4 "%08X" 1 ""' /dev/urandom > /etc/secrets/jwt-secret.txt
+else
+	echo "Found JWT secret."
+fi
+
+if [ "$P2P_SECRET" = "dummy" ]; then
+	echo "Regenerating P2P private key."
+	hexdump -vn32 -e'4/4 "%08X" 1 ""' /dev/urandom > /etc/secrets/p2p-private-key.txt
+else
+	echo "Found P2P private key."
+fi
+
+if [ ! -d "$GETH_CHAINDATA_DIR" ]; then
+	echo "$GETH_CHAINDATA_DIR missing, running init"
+	echo "Initializing genesis."
+	geth --verbosity="$OP_GETH_VERBOSITY" init \
+		--datadir="$GETH_DATA_DIR" \
+		"$GENESIS_FILE_PATH"
+else
+	echo "$GETH_CHAINDATA_DIR exists."
+fi
\ No newline at end of file

ops-bedrock/oneshot/s6-rc.d/op-geth/run

+#!/command/with-contenv bash
+
+set -eu
+
+GETH_DATA_DIR=/db
+CHAIN_ID=$(cat "/etc/op-geth/genesis.json" | jq -r .config.chainId)
+
+# Warning: Archive mode is required, otherwise old trie nodes will be
+# pruned within minutes of starting the devnet.
+
+exec geth \
+	--datadir="$GETH_DATA_DIR" \
+	--verbosity="$OP_GETH_VERBOSITY" \
+	--http \
+	--http.addr="$OP_GETH_HTTP_ADDR" \
+	--http.corsdomain="$OP_GETH_HTTP_CORSDOMAIN" \
+	--http.vhosts="$OP_GETH_HTTP_VHOSTS" \
+	--http.port="$OP_GETH_HTTP_PORT" \
+	--http.api=web3,debug,eth,txpool,net,engine \
+	--ws \
+	--ws.addr="$OP_GETH_WS_ADDR" \
+	--ws.port="$OP_GETH_WS_PORT" \
+	--ws.origins="$OP_GETH_WS_ORIGINS" \
+	--ws.api=debug,eth,txpool,net,engine \
+	--syncmode=full \
+	--nodiscover \
+	--maxpeers="$OP_GETH_MAX_PEERS" \
+	--networkid=$CHAIN_ID \
+	--gcmode=archive \
+	--rollup.sequencerhttp="$OP_GETH_SEQUENCER_HTTP" \
+	--authrpc.jwtsecret=/etc/secrets/jwt-secret.txt
+	"$@"
\ No newline at end of file

ops-bedrock/oneshot/s6-rc.d/op-geth/type

+longrun
\ No newline at end of file

ops-bedrock/oneshot/s6-rc.d/op-init/type

+oneshot
\ No newline at end of file

ops-bedrock/oneshot/s6-rc.d/op-init/up

+/usr/local/bin/op-init.sh
\ No newline at end of file

ops-bedrock/oneshot/s6-rc.d/op-node/run

+#!/command/with-contenv bash
+set -eu
+
+export OP_NODE_ROLLUP_CONFIG=/etc/op-node/rollup.json
+export OP_NODE_L2_ETH_RPC=ws://0.0.0.0:$OP_GETH_WS_PORT
+export OP_NODE_L2_ENGINE_RPC=ws://0.0.0.0:$OP_GETH_WS_PORT
+export OP_NODE_L2_ENGINE_AUTH=/etc/secrets/jwt-secret.txt
+export OP_NODE_P2P_PRIV_PATH=/etc/secrets/p2p-private-key.txt
+export OP_NODE_P2P_PEERSTORE_PATH=/p2p/
+export OP_NODE_P2P_DISCOVERY_PATH=/p2p/discovery
+
+printenv
+
+exec op-node
\ No newline at end of file

ops-bedrock/oneshot/s6-rc.d/op-node/type

+longrun
\ No newline at end of file