Dockerfile

# syntax=docker/dockerfile:1.7

# This Dockerfile performs a multi-stage build. BUILDER_IMAGE is the image used
# to compile the layerd binary. RUNTIME_IMAGE is the image that will be
# returned with the final layerd binary.
#
# Separating the builder and runtime image allows the runtime image to be
# considerably smaller because it doesn't need to have Golang installed.
ARG BUILDER_IMAGE=docker.io/golang:1.24.13-alpine
ARG RUNTIME_IMAGE=docker.io/alpine:3.20
ARG TARGETOS
ARG TARGETARCH

# Stage 1: Build the layerd binary inside a builder image that will be discarded later.
# Ignore hadolint rule because hadolint can't parse the variable.
# See https://github.com/hadolint/hadolint/issues/339
# hadolint ignore=DL3006
FROM --platform=$BUILDPLATFORM ${BUILDER_IMAGE} AS builder
ENV CGO_ENABLED=0
ENV GO111MODULE=on
# hadolint ignore=DL3018
RUN apk update && apk add --no-cache \
    gcc \
    git \
    # linux-headers are needed for Ledger support
    linux-headers \
    make \
    musl-dev
WORKDIR /layer

COPY go.mod go.sum ./
RUN --mount=type=cache,target=/go/pkg/mod \
    go mod download

COPY . .
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    uname -a &&\
    CGO_ENABLED=${CGO_ENABLED} GOOS=${TARGETOS} GOARCH=${TARGETARCH} \
    make build

# Install Cosmovisor (pinned) for automated, governance-driven binary upgrades.
RUN --mount=type=cache,target=/go/pkg/mod \
    --mount=type=cache,target=/root/.cache/go-build \
    go install cosmossdk.io/tools/cosmovisor/cmd/cosmovisor@v1.7.0

# Stage 2: Create a minimal image to run the layerd binary
# Ignore hadolint rule because hadolint can't parse the variable.
# See https://github.com/hadolint/hadolint/issues/339
# hadolint ignore=DL3006
FROM ${RUNTIME_IMAGE} AS runtime
# Use UID 1025 to match heighliner standard for Cosmos SDK chains.
# This ensures compatibility with interchaintest and other Cosmos tooling.
ARG UID=1025
ARG USER_NAME=layerdevnet
ENV LAYER_HOME=/home/${USER_NAME}
# hadolint ignore=DL3018
RUN apk update && apk add --no-cache \
    bash \
    curl \
    jq \
    tini \
    && adduser ${USER_NAME} \
    -D \
    -g ${USER_NAME} \
    -h ${LAYER_HOME} \
    -s /sbin/nologin \
    -u ${UID}
# Copy the layerd binary from the builder into the final image.
COPY --from=builder /layer/build/layerd /bin/layerd
# Copy Cosmovisor (swaps the layerd binary at the on-chain upgrade height).
COPY --from=builder /go/bin/cosmovisor /bin/cosmovisor
# Cosmovisor settings. DAEMON_HOME is derived from --home at runtime (entrypoint.sh).
# Auto-download is OFF for safety: upgrade binaries are pre-staged per release.
# UNSAFE_SKIP_BACKUP is ON: backing up the full data dir before an upgrade is
# impractical on a live node (large data dir -> slow / can fill the disk and stall
# the upgrade). We rely on external snapshots instead. Matches the install script.
ENV DAEMON_NAME=layerd \
    DAEMON_RESTART_AFTER_UPGRADE=true \
    DAEMON_ALLOW_DOWNLOAD_BINARIES=false \
    UNSAFE_SKIP_BACKUP=true
# Copy the entrypoint script into the final image.
COPY --chown=${USER_NAME}:${USER_NAME} docker/entrypoint.sh /opt/entrypoint.sh
# Set the user to layerdevnet.
USER ${USER_NAME}
# Set the working directory to the home directory.
WORKDIR ${LAYER_HOME}
# Expose ports:
# 1317 is the default API server port.
# 9090 is the default GRPC server port.
# 26656 is the default node p2p port.
# 26657 is the default RPC port.
# 26660 is the port used for Prometheus.
# 26661 is the port used for tracing.
EXPOSE 1317 9090 26656 26657 26660 26661

# Add health check to ensure container is ready
HEALTHCHECK --interval=5s --timeout=3s --start-period=10s --retries=3 \
    CMD curl -f http://localhost:26657/status || exit 1

ENTRYPOINT [ "/sbin/tini", "--", "/bin/bash", "/opt/entrypoint.sh" ]