Dockerfile.source

# Build Geth in a stock Go build container
FROM golang:1.21-alpine as builder

# Unused, this is here to avoid build time complaints
ARG DOCKER_TAG

ARG BUILD_TARGET

RUN apk update && apk add --no-cache make gcc musl-dev linux-headers git bash

WORKDIR /src

ADD go-ethereum/ go-ethereum/

RUN bash -c "cd go-ethereum && go run build/ci.go install -static"

# Pull all binaries into a second stage deploy container
FROM alpine:3

ARG USER=geth
ARG UID=10001
# GID 10002 is deliberate so it can exchange secret with CL
ARG GID=10002

RUN apk add --no-cache ca-certificates tzdata bash su-exec

RUN addgroup \
    --gid "${GID}" \
    "${USER}"

# See https://stackoverflow.com/a/55757473/12429735RUN
RUN adduser \
    --disabled-password \
    --gecos "" \
    --shell "/sbin/nologin" \
    --uid "${UID}" \
    --ingroup "${USER}" \
    "${USER}"

RUN mkdir -p /var/lib/goethereum/ee-secret && chown -R ${USER}:${USER} /var/lib/goethereum && chmod -R 700 /var/lib/goethereum && chmod 777 /var/lib/goethereum/ee-secret

# Cannot assume buildkit, hence no chmod
COPY --from=builder --chown=${USER}:${USER} /src/go-ethereum/build/bin/geth /usr/local/bin/
COPY --from=builder --chown=${USER}:${USER} /src/go-ethereum/build/bin/clef /usr/local/bin/
COPY --chown=${USER}:${USER} ./docker-entrypoint.sh /usr/local/bin/
# Belt and suspenders
RUN chmod -R 755 /usr/local/bin/*

USER ${USER}

ENTRYPOINT ["geth"]