feat(docker): add Docker support with Dockerfile and docker-compose c…

.dockerignore

@@ -0,0 +1,12 @@
+.git
+.github
+.agents
+.codex
+.bitcoin-rs
+.env
+target
+**/target
+crash-*
+perf.data*
+flamegraph.svg
+docs/benchmarks/data

.env.example

@@ -0,0 +1,13 @@
+# Node network: mainnet, testnet3, testnet4, signet, or regtest.
+BITCOIN_RS_NETWORK=mainnet
+
+# JSON-RPC is published to 127.0.0.1 on the Docker host.
+BITCOIN_RS_RPC_PORT=8332
+BITCOIN_RS_RPC_USER=bitcoin-rs
+BITCOIN_RS_RPC_PASSWORD=
+
+# P2P is published on all Docker host interfaces so other nodes can connect.
+BITCOIN_RS_P2P_PORT=8333
+
+# Runtime tracing filter.
+BITCOIN_RS_LOG_LEVEL=info

.gitignore

@@ -14,6 +14,7 @@ heap-profile-*
 core.*
 /tmp/
 /.bitcoin-rs/
+/.env
 
 # Re-include project plan tracked in-repo (global ~/.gitignore drops PLAN.md).
 !PLAN.md

Dockerfile

@@ -0,0 +1,45 @@
+# syntax=docker/dockerfile:1.7
+
+FROM rust:1.95-bookworm AS builder
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        build-essential \
+        clang \
+        cmake \
+        libboost-dev \
+        libclang-dev \
+        libzmq3-dev \
+        pkg-config \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace
+COPY . .
+
+# Build the production verifier with the default fjall storage backend, while
+# leaving the other storage engines out of the runtime image.
+RUN cargo build --locked --release -p bitcoin-rs \
+    --no-default-features --features fjall,kernel
+
+FROM debian:bookworm-slim AS runtime
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        ca-certificates \
+        curl \
+        libgcc-s1 \
+        libstdc++6 \
+        libzmq5 \
+    && rm -rf /var/lib/apt/lists/* \
+    && groupadd --gid 10001 bitcoin-rs \
+    && useradd --uid 10001 --gid bitcoin-rs --no-create-home bitcoin-rs \
+    && install -d -o bitcoin-rs -g bitcoin-rs /data
+
+COPY --from=builder /workspace/target/release/bitcoin-rs /usr/local/bin/bitcoin-rs
+
+USER bitcoin-rs
+VOLUME ["/data"]
+EXPOSE 8332 8333
+
+ENTRYPOINT ["bitcoin-rs"]
+CMD ["--data-dir", "/data", "--rpc-bind", "0.0.0.0:8332", "--p2p-listen", "0.0.0.0:8333"]

README.md

@@ -36,6 +36,35 @@ That starts a mainnet node storing state in `.bitcoin-rs` and serving JSON-RPC
 on `127.0.0.1:8332`. See [docs/getting-started.md](docs/getting-started.md) for
 backend selection, RPC authentication, and checking sync progress.
 
+### Docker Compose
+
+The included Compose configuration builds the production `fjall` +
+`bitcoinkernel` profile, keeps chain state in a named volume, exposes P2P on
+port 8333, and binds RPC to the Docker host's loopback interface only.
+
+Set non-default RPC credentials in `.env`, then start the node:
+
+```sh
+cp .env.example .env
+# Edit .env and set BITCOIN_RS_RPC_PASSWORD before starting the node.
+
+docker compose up --build -d
+docker compose logs -f node
+```
+
+Check sync progress through the host RPC port:
+
+```sh
+. ./.env
+curl --user "$BITCOIN_RS_RPC_USER:$BITCOIN_RS_RPC_PASSWORD" \
+  -H 'content-type: application/json' \
+  -d '{"jsonrpc":"1.0","id":"sync","method":"getblockchaininfo","params":[]}' \
+  http://127.0.0.1:8332/
+```
+
+Stop the process without deleting its chain data with `docker compose down`.
+Deleting the named volume requires the explicit `docker compose down -v` form.
+
 ## Measured performance
 
 Full verification replay of mainnet blocks 0 to 150,000 (1,718,407

docker-compose.yaml

@@ -0,0 +1,40 @@
+name: bitcoin-rs
+
+services:
+  node:
+    build:
+      context: .
+      dockerfile: Dockerfile
+    image: bitcoin-rs:local
+    restart: unless-stopped
+    init: true
+    stop_grace_period: 30s
+    environment:
+      BITCOIN_RS_NETWORK: "${BITCOIN_RS_NETWORK:-mainnet}"
+      BITCOIN_RS_STORAGE_BACKEND: fjall
+      BITCOIN_RS_RPC_USER: "${BITCOIN_RS_RPC_USER:-bitcoin-rs}"
+      BITCOIN_RS_RPC_PASSWORD: "${BITCOIN_RS_RPC_PASSWORD:-bitcoin-rs}"
+      BITCOIN_RS_LOG_LEVEL: "${BITCOIN_RS_LOG_LEVEL:-info}"
+    volumes:
+      - bitcoin-rs-data:/data
+    ports:
+      # Keep RPC private to the Docker host. Change this deliberately if a
+      # trusted remote client must connect.
+      - "127.0.0.1:${BITCOIN_RS_RPC_PORT:-8332}:8332"
+      - "${BITCOIN_RS_P2P_PORT:-8333}:8333"
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - >-
+          curl --fail --silent --show-error
+          --user "$${BITCOIN_RS_RPC_USER}:$${BITCOIN_RS_RPC_PASSWORD}"
+          --header 'content-type: application/json'
+          --data '{"jsonrpc":"1.0","id":"health","method":"getblockchaininfo","params":[]}'
+          http://127.0.0.1:8332/ >/dev/null
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 30s
+
+volumes:
+  bitcoin-rs-data: