ref(docker): create a standalone docker artifact to run lightwalletd

.dockerignore

@@ -0,0 +1,25 @@
+# Before the docker CLI sends the context to the docker daemon, it looks for a file
+# named .dockerignore in the root directory of the context. If this file exists, the
+# CLI modifies the context to exclude files and directories that match patterns in it.
+#
+# You may want to specify which files to include in the context, rather than which
+# to exclude. To achieve this, specify * as the first pattern, followed by one or
+# more ! exception patterns.
+#
+# https://docs.docker.com/engine/reference/builder/#dockerignore-file
+
+# Exclude everything:
+#
+*
+
+# Now un-exclude required files and folders:
+#
+!go.mod
+!go.sum
+!main.go
+!docker
+!cmd
+!common
+!frontend
+!parser
+!walletrpc

Dockerfile

@@ -1,22 +1,110 @@
-FROM golang:1.22 AS lightwalletd_base
+# /************************************************************************
+ #  File: Dockerfile
+ #  Author: gustavovalverde
+ #  Date: 26/02/2023
+ #  Description:  Used for devs that have not built zcashd or lightwalletd on
+ #                on existing system
+ #  USAGE:
+ #
+ #  To build image: docker build --target runner  --tag zcash_lwd_base .
+ #  To run container: docker run --detach -it -p 9067:9067 -p 9068:9068 zcash_lwd_base
+ #
+ #  Once the block height is at least 280,000 you can go ahead and start lightwalletd
+ #  make docker_img_run_lightwalletd_insecure_server
+ #
+ #  If you need a random bash session in the container, use:
+ #  docker exec -it zcashdlwd bash
+ #
+ #  If you get kicked out of docker or it locks up...
+ #  To restart, check to see what container you want to restart via docker ps -a
+ #  Then, docker restart <container id>
+ #  The reattach to it, docker attach <container id>
+ #
+ #  Known bugs/missing features/todos:
+ #
+ #  *** DO NOT USE IN PRODUCTION ***
+ #
+ #  - Create docker-compose with according .env scaffolding
+ #  - Determine librustzcash bug that breaks zcashd alpine builds at runtime
+ #  - Once versioning is stable add config flags for images
+ #  - Add mainnet config once lightwalletd stack supports it
+ #
+ # ************************************************************************/
+ARG APP_HOME=/srv/lightwalletd
+ARG ZCASHD_CONF_PATH=$APP_HOME/zcash.conf
+ARG LWD_GRPC_PORT=9067
+ARG LWD_HTTP_PORT=9068
 
-ADD . /go/src/github.com/zcash/lightwalletd
-WORKDIR /go/src/github.com/zcash/lightwalletd
-RUN make \
-  && /usr/bin/install -c ./lightwalletd /usr/local/bin/ \
-  && mkdir -p /var/lib/lightwalletd/db \
-  && chown 2002:2002 /var/lib/lightwalletd/db
+##
+## Builder
+##
+# Create layer in case you want to modify local lightwalletd code
+FROM golang:1.22 AS build
 
+# Create and change to the app directory.
+WORKDIR /app
+
+# Retrieve application dependencies.
+# This allows the container build to reuse cached dependencies.
+# Expecting to copy go.mod and if present go.sum.
+COPY go.mod ./
+COPY go.sum ./
+
+# Do not use `go get` as it updates the requirements listed in your go.mod file.
+# `go mod download` does not add new requirements or update existing requirements.
+RUN go mod download
+
+# Copy local code to the container image.
+COPY . ./
+
+# Build and install the binary.
+RUN go build -v -o /usr/local/bin/lightwalletd
+
+ARG ZCASHD_CONF_PATH
+
+RUN set -ex; \
+  { \
+    echo "rpcuser=zcashrpc"; \
+    echo "rpcpassword=`head /dev/urandom | tr -dc A-Za-z0-9 | head -c 13 ; echo ''`" \
+    echo "rpcbind=zcashd"; \
+    echo "rpcport=3434"; \
+  } > "/etc/zcash.conf"
+
+##
+## Runner
+##
+FROM debian:bookworm-slim as runner
+
+# Get the needed ARGs values
+ARG APP_HOME
+ARG ZCASHD_CONF_PATH
+ARG LWD_GRPC_PORT
+ARG LWD_HTTP_PORT
 ARG LWD_USER=lightwalletd
 ARG LWD_UID=2002
 
-RUN useradd --home-dir /srv/$LWD_USER \
-            --shell /bin/bash \
-            --create-home \
-            --uid $LWD_UID\
-            $LWD_USER
-USER $LWD_USER
-WORKDIR /srv/$LWD_USER
+# Always run a container with a non-root user. Running as root inside the container is running as root in the Docker host
+# If an attacker manages to break out of the container, they will have root access to the host
+RUN groupadd --gid ${LWD_UID} ${LWD_USER}  && \
+    useradd --home-dir ${APP_HOME} --no-create-home --gid ${LWD_USER} --uid ${LWD_UID} --shell /bin/sh ${LWD_USER}
+
+# Create the directory for the database and certificates to keep backwards compatibility
+RUN mkdir -p /var/lib/lightwalletd/db && \
+    mkdir -p /secrets/lightwallted && \
+    chown ${LWD_USER}:${LWD_USER} /var/lib/lightwalletd/db && \
+    chown ${LWD_USER}:${LWD_USER} /secrets/lightwallted
+
+WORKDIR ${APP_HOME}
+
+COPY --from=build /usr/local/bin/lightwalletd /usr/local/bin
+COPY --from=build --chown=${LWD_USER}:${LWD_USER} /etc/zcash.conf ./
+COPY ./docker/cert.key ./
+COPY ./docker/cert.pem ./
+
+EXPOSE $LWD_GRPC_PORT
+EXPOSE $LWD_HTTP_PORT
+
+USER ${LWD_USER}
 
 ENTRYPOINT ["lightwalletd"]
-CMD ["--help"]
+CMD ["--tls-cert=cert.pem", "--tls-key=cert.key", "--grpc-bind-addr=0.0.0.0:9067",  "--http-bind-addr=0.0.0.0:9068", "--log-file=/dev/stdout", "--log-level=7"]

Makefile

@@ -71,7 +71,7 @@ coverage:
 
 # Generate code coverage report
 coverage_report: coverage
-	go tool cover -func=coverage.out 
+	go tool cover -func=coverage.out
 
 # Generate code coverage report in HTML
 coverage_html: coverage
@@ -102,31 +102,33 @@ lwd-api.html: walletrpc/compact_formats.proto walletrpc/service.proto
 
 # Generate docker image
 docker_img:
-	docker build -t zcash_lwd_base .
+	docker build --target runner --tag zcash_lwd_base .
 
 # Run the above docker image in a container
 docker_img_run:
-	docker run -i --name zcashdlwd zcash_lwd_base
+	docker run --detach -it --name zcashdlwd zcash_lwd_base
 
 # Execute a bash process on zcashdlwdcontainer
 docker_img_bash:
 	docker exec -it zcashdlwd bash
 
+# TODO: Check these instructions as `zcashd` and `zcash-cli` binaries are not installed in the container
 # Start the zcashd process in the zcashdlwd container
-docker_img_run_zcashd:
-	docker exec -i zcashdlwd zcashd -printtoconsole
+# docker_img_run_zcashd:
+# 	docker exec -i zcashdlwd zcashd -printtoconsole
 
 # Stop the zcashd process in the zcashdlwd container
-docker_img_stop_zcashd:
-	docker exec -i zcashdlwd zcash-cli stop
+# docker_img_stop_zcashd:
+# 	docker exec -i zcashdlwd zcash-cli stop
 
 # Start the lightwalletd server in the zcashdlwd container
 docker_img_run_lightwalletd_insecure_server:
 	docker exec -i zcashdlwd server --no-tls-very-insecure=true --conf-file /home/zcash/.zcash/zcash.conf --log-file /logs/server.log --bind-addr 127.0.0.1:18232
 
+# TODO: remove this command as its destructive for people using Docker for other purposes
 # Remove and delete ALL images and containers in Docker; assumes containers are stopped
-docker_remove_all:
-	docker system prune -f
+# docker_remove_all:
+# 	docker system prune -f
 
 # Get dependencies
 dep: