@mysten-incubation/devstack 0.0.0

package/images/seal/Dockerfile

@@ -0,0 +1,68 @@
+# syntax=docker/dockerfile:1
+# devstack-rewrite seal-key-server image. Vendored Dockerfile fed to
+# the `dockerImage({build})` runner via `ContainerRuntime.ensureImage`
+# (content-addressed builds — same Dockerfile + build args produce
+# the same tag).
+#
+# Pulls the published `seal-cli` and `key-server` binaries from the
+# seal GitHub release — no Rust compile (the seal release workflow
+# already builds and uploads platform binaries). First build is ~30 s
+# vs. the ~5–8 min cargo path the old devstack started with.
+#
+# The move/seal package is NOT staged inside the image: the seal
+# plugin's local-keygen mode fetches the Move source out-of-band via
+# the lifted `source-fetch` sibling and publishes via the SDK, so the
+# in-image staging would be dead weight here.
+#
+# Multi-arch: TARGETARCH (arm64 / amd64) → PLATFORM
+# (linux-aarch64 / linux-x86_64) — the seal release renames `seal-cli`
+# to `seal-${platform}` for the asset name; we rename it back inside
+# the image so the `seal-cli` invocation works unchanged.
+
+FROM ubuntu:24.04 AS bin-fetch
+ARG SEAL_VERSION
+ARG TARGETARCH
+
+RUN apt-get update \
+	&& apt-get install -y --no-install-recommends ca-certificates curl \
+	&& rm -rf /var/lib/apt/lists/*
+
+RUN set -eux; \
+	case "$TARGETARCH" in \
+		arm64) PLATFORM=linux-aarch64 ;; \
+		amd64) PLATFORM=linux-x86_64 ;; \
+		*) echo "unsupported TARGETARCH=$TARGETARCH" >&2; exit 1 ;; \
+	esac; \
+	base="https://github.com/MystenLabs/seal/releases/download/${SEAL_VERSION}"; \
+	curl -fsSL "$base/seal-${PLATFORM}" -o /tmp/seal-cli; \
+	curl -fsSL "$base/key-server-${PLATFORM}" -o /tmp/key-server; \
+	chmod +x /tmp/seal-cli /tmp/key-server
+
+# Runtime image. debian:bookworm-slim + libpq5 — the `key-server`
+# binary links against postgres client libs even when we run it
+# stand-alone. `curl` is the ready-probe shim (the plugin's
+# `/health` HTTP probe in key-server.ts shells out to curl inside
+# the container).
+FROM debian:bookworm-slim AS runtime
+
+EXPOSE 2024 9184
+
+RUN apt-get update \
+	&& apt-get install -y --no-install-recommends \
+		ca-certificates curl libpq5 \
+	&& rm -rf /var/lib/apt/lists/*
+
+COPY --from=bin-fetch /tmp/seal-cli   /usr/local/bin/seal-cli
+COPY --from=bin-fetch /tmp/key-server /usr/local/bin/key-server
+COPY _shared/signal-forward.sh /usr/local/lib/devstack/signal-forward.sh
+COPY seal/entrypoint.sh /usr/local/bin/devstack-seal-entrypoint.sh
+RUN chmod +x /usr/local/bin/devstack-seal-entrypoint.sh
+
+# Default to running the key-server through a shell wrapper that
+# traps docker's SIGTERM and forwards SIGTERM to the key-server as a
+# non-PID-1 child. See `entrypoint.sh` for the rationale (workaround
+# for seal's missing tokio signal handler — same shape as the
+# images/sui entrypoint). The keygen step overrides the entrypoint
+# via `runOneShot({ entrypoint: 'seal-cli', argv: ['genkey'] })` so
+# this wrapper only ever wraps the long-running key-server container.
+ENTRYPOINT ["/usr/local/bin/devstack-seal-entrypoint.sh"]

package/images/seal/entrypoint.sh

@@ -0,0 +1,65 @@
+#!/bin/sh
+# devstack-rewrite seal-key-server entrypoint wrapper.
+#
+# Same workaround as sui-localnet for the same upstream-bug class:
+# seal's `key-server` binary (`seal/crates/key-server/src/server.rs`'s
+# `#[tokio::main] async fn main`) installs NO signal handler — `main`
+# is just `tokio::select! { server_result = axum::serve(...), monitor_result = monitor_handle }`,
+# with no `tokio::signal::ctrl_c()` polled on either branch. So running
+# the binary as PID 1 in the container, `docker stop`'s SIGTERM is
+# ignored (PID 1 default-ignores undelivered signals) and the grace
+# timeout always expires → SIGKILL → exit 137 → the next `up` cycle
+# trips "UNCLEAN PRIOR SHUTDOWN" with a forced container recreate
+# (seal's runc-start fails because the prior shutdown left task state
+# behind).
+#
+# Workaround: run key-server as a non-PID-1 CHILD of this shell. The
+# shell traps docker's SIGTERM and forwards SIGTERM to the child.
+# Non-interactive POSIX shells may start background children with
+# SIGINT ignored, so SIGINT is not reliable for a binary with no
+# signal handler; SIGTERM's default action still terminates the
+# child cleanly enough for Seal's in-memory runtime state. The next
+# start reads MASTER_KEY from env again and recomputes everything.
+#
+# Master-key staging: the plugin bind-mounts a 0o600 env-file
+# containing `MASTER_KEY=<hex>`, then passes its container path via
+# MASTER_KEY_ENVFILE (defaulting to /etc/seal/master-key.env). We
+# source it BEFORE exec'ing the key-server so the secret lands in the
+# child's environment, NEVER in `docker inspect` / host process env.
+# Distilled-doc invariant #3.
+#
+# The keygen path (`runOneShot({ entrypoint: 'seal-cli', argv: ['genkey'] })`)
+# bypasses this entrypoint entirely via the runtime's --entrypoint
+# override, so the wrapping only affects the long-running key-server
+# container.
+#
+# The trap + wait-loop lives in `/usr/local/lib/devstack/signal-forward.sh`,
+# vendored from `images/_shared/signal-forward.sh` at build time —
+# the sui entrypoint sources the same file.
+
+set -eu
+
+# shellcheck disable=SC1091
+. /usr/local/lib/devstack/signal-forward.sh
+
+# Source the master-key env-file if it's present at the well-known
+# bind-mount path. `set -a` exports every VAR=value pair to the child
+# process environment. Idempotent: if the file is absent, we fall
+# through with no error (the binary will fail with its own typed
+# message, which is the right level of detail for callers).
+MASTER_KEY_ENVFILE_PATH="${MASTER_KEY_ENVFILE:-/etc/seal/master-key.env}"
+if [ -r "$MASTER_KEY_ENVFILE_PATH" ]; then
+	set -a
+	# shellcheck disable=SC1091
+	. "$MASTER_KEY_ENVFILE_PATH"
+	set +a
+fi
+
+/usr/local/bin/key-server "$@" &
+KS_PID=$!
+register_signal_forward "$KS_PID" TERM
+
+KS_EXIT=0
+wait_for_child "$KS_PID" || KS_EXIT=$?
+
+exit "$KS_EXIT"

package/images/sui/Dockerfile

@@ -0,0 +1,73 @@
+# Sui validator image for the rewrite's local-mode boot. Vendored
+# Dockerfile fed to `ContainerRuntime.ensureImage` (content-addressed
+# builds — same Dockerfile + build args produce the same image digest).
+#
+# Multi-arch: the upstream `mysten/sui-tools` image ships amd64 only,
+# so on Apple Silicon it runs under Rosetta and `sui start` genesis
+# stretches from ~10 s to several minutes. We download the matching
+# `ubuntu-aarch64` / `ubuntu-x86_64` release tarball at build time
+# instead so the resulting image runs natively on the host.
+#
+# `ubuntu:24.04` — the Sui release tarballs are linked against
+# glibc 2.38+; debian:bookworm (glibc 2.36) fails at runtime with a
+# GLIBC_2.38-missing error.
+
+FROM ubuntu:24.04
+
+ARG SUI_VERSION
+ARG TARGETARCH
+
+RUN apt-get update \
+	&& apt-get install -y --no-install-recommends \
+		ca-certificates curl gawk git postgresql \
+	&& PG_BIN_DIR="$(dirname "$(find /usr/lib/postgresql -name initdb -type f | sort | tail -n 1)")" \
+	&& test -x "$PG_BIN_DIR/initdb" \
+	&& ln -sf "$PG_BIN_DIR/initdb" /usr/local/bin/initdb \
+	&& ln -sf "$PG_BIN_DIR/pg_ctl" /usr/local/bin/pg_ctl \
+	&& ln -sf "$PG_BIN_DIR/postgres" /usr/local/bin/postgres \
+	&& useradd --create-home --shell /bin/sh devstack-sui \
+	&& rm -rf /var/lib/apt/lists/*
+
+# Why `gawk` + `git`:
+#   - `gawk` — the in-container Move.lock scrub uses `gawk -i inplace`
+#     (the `-i` inplace mode is gawk-only; mawk doesn't support it).
+#     Without this, the package plugin's `containerScrubShellScript`
+#     fails inside `sui move build` with `find: 'gawk': No such
+#     file or directory` (host scrub may have already run, but the
+#     in-container path still invokes gawk).
+#   - `git` — Move's dep resolver invokes `git fetch` against vendored
+#     `[dependencies]` blocks (`{ git = "..." }`). Without git on PATH,
+#     `sui move build` aborts with a dep-fetch error before reaching
+#     the bytecode pass.
+#   - `postgresql` — `sui start --with-graphql` initializes an embedded
+#     local indexer database and shells out to `initdb`/`postgres`.
+
+# Sui release-tarball fetch. The TARGETARCH branch picks the
+# native-architecture asset name and unpacks `sui` (and siblings,
+# including `sui-faucet`) into `/usr/local/bin/`.
+RUN set -eux; \
+	case "$TARGETARCH" in \
+		arm64) SUI_PLATFORM=ubuntu-aarch64 ;; \
+		amd64) SUI_PLATFORM=ubuntu-x86_64 ;; \
+		*) echo "unsupported TARGETARCH=$TARGETARCH" >&2; exit 1 ;; \
+	esac; \
+	url="https://github.com/MystenLabs/sui/releases/download/${SUI_VERSION}/sui-${SUI_VERSION}-${SUI_PLATFORM}.tgz"; \
+	curl -fsSL "$url" -o /tmp/sui.tgz; \
+	mkdir -p /tmp/sui-unpack; \
+	tar -xzf /tmp/sui.tgz -C /tmp/sui-unpack; \
+	find /tmp/sui-unpack -maxdepth 2 -type f -executable -exec mv {} /usr/local/bin/ \; ; \
+	rm -rf /tmp/sui.tgz /tmp/sui-unpack; \
+	sui --version
+
+COPY _shared/signal-forward.sh /usr/local/lib/devstack/signal-forward.sh
+COPY sui/entrypoint.sh /usr/local/bin/devstack-entrypoint.sh
+RUN chmod +x /usr/local/bin/devstack-entrypoint.sh
+
+ENV RUST_LOG=info,sui=info
+
+# RPC (9000), faucet (9123), GraphQL consistent-store helper (9124),
+# and GraphQL HTTP (9125). Local-mode boot probes the public surfaces.
+EXPOSE 9000 9123 9124 9125
+
+ENTRYPOINT ["/usr/local/bin/devstack-entrypoint.sh"]
+CMD ["start", "--with-faucet=0.0.0.0:9123", "--with-graphql=0.0.0.0:9125"]

package/images/sui/entrypoint.sh

@@ -0,0 +1,244 @@
+#!/bin/sh
+# devstack-rewrite sui-localnet entrypoint.
+#
+# `sui start --force-regenesis` is ephemeral (in-memory genesis). To
+# preserve chain state across `docker stop` + `docker start`, we
+# bootstrap once with `sui genesis -f --with-faucet` (writes a
+# persistent config dir under /home/devstack-sui/.sui/sui_config) and then run
+# `sui start` (no --force-regenesis), which resumes from the on-disk
+# state. Chain state lives in the container's writable layer — `docker
+# stop`/`start` preserves it; `docker rm` destroys it.
+#
+# Slow checkpoint pruning. Localnet's stock fullnode.yaml ships with
+# `num-epochs-to-retain: 0`, which prunes checkpoints aggressively
+# (~10 minutes of retention on a fresh chain). Downstream consumers
+# that follow the chain sequentially (e.g. walrus storage nodes via
+# the v2 LedgerService `get_full_checkpoint` gRPC) get permanently
+# stuck once their last-processed checkpoint slips below sui's
+# lowest-available-checkpoint. Default retention here is 2 prior
+# epochs (~48–72h at the localnet's default 24h epoch); override via
+# the `DEVSTACK_SUI_EPOCHS_TO_RETAIN` env var (`MAX` disables pruning).
+#
+# Signal forwarding (clean shutdown). `sui start --with-faucet` has an
+# upstream signal-handling bug: `sui_commands.rs:1278`'s
+# `start_faucet(app_state).await?` blocks on `axum::serve(...).await`
+# BEFORE the post-setup health-check loop installs
+# `tokio::signal::ctrl_c()`. So when sui runs with `--with-faucet`, no
+# SIGINT handler is ever registered (verified via `/proc/1/status`
+# SigCgt = 0x100000440 vs 0x100000442 without `--with-faucet`) and
+# `docker stop` falls back to SIGKILL → exit 137 → RocksDB checkpoint
+# drain never runs → next `up` resumes from an inconsistent checkpoint
+# (observable as walrus storage-node "checkpoint X is below
+# lowest-available" errors after restart cycles).
+#
+# Workaround until the upstream fix lands: strip only `--with-faucet`
+# from sui's args and run the standalone `sui-faucet` binary as a
+# sibling. Other `sui start` flags, including `--with-graphql`, stay on
+# the validator process. Sui without `--with-faucet` reaches its
+# ctrl_c-aware loop and exits cleanly on SIGINT. The shell becomes PID
+# 1 instead of `exec sui` so it can trap docker's SIGTERM and forward
+# SIGINT to sui. The sibling sui-faucet is stateless; it is also nudged
+# via the shared trap and is force-killed after sui exits if still alive.
+#
+# GraphQL's embedded PostgreSQL indexer refuses to initialize as root,
+# so the entrypoint performs setup as PID 1/root and then starts Sui
+# plus sui-faucet as the unprivileged `devstack-sui` user. Build helper
+# containers override this entrypoint and still run as root.
+#
+# That embedded PostgreSQL can also leave `postmaster.pid` behind after
+# an ungraceful container exit or stale writable-layer reuse. PostgreSQL
+# treats that as an active server and aborts before GraphQL binds, so we
+# clear only provably-stale pid files before starting Sui.
+#
+# The trap + wait-loop lives in `/usr/local/lib/devstack/signal-forward.sh`,
+# vendored from `images/_shared/signal-forward.sh` at build time —
+# the seal key-server entrypoint sources the same file.
+
+set -eu
+
+# shellcheck disable=SC1091
+. /usr/local/lib/devstack/signal-forward.sh
+
+SUI_USER="${DEVSTACK_SUI_USER:-devstack-sui}"
+SUI_HOME="${DEVSTACK_SUI_HOME:-/home/devstack-sui}"
+SUI_UID="$(id -u "$SUI_USER")"
+SUI_GID="$(id -g "$SUI_USER")"
+
+mkdir -p "$SUI_HOME/.sui"
+chown -R "$SUI_UID:$SUI_GID" "$SUI_HOME"
+
+run_as_sui() {
+	setpriv --reuid "$SUI_UID" --regid "$SUI_GID" --init-groups env HOME="$SUI_HOME" "$@"
+}
+
+STARTED_PID=""
+start_as_sui() {
+	setpriv --reuid "$SUI_UID" --regid "$SUI_GID" --init-groups env HOME="$SUI_HOME" "$@" &
+	STARTED_PID=$!
+}
+
+if [ ! -d "$SUI_HOME/.sui/sui_config" ]; then
+	run_as_sui sui genesis -f --with-faucet
+fi
+
+RETAIN_RAW="${DEVSTACK_SUI_EPOCHS_TO_RETAIN:-2}"
+if [ "$RETAIN_RAW" = "MAX" ]; then
+	RETAIN=18446744073709551615
+else
+	RETAIN="$RETAIN_RAW"
+fi
+patch_pruning_config() {
+	config_file="$1"
+	[ -f "$config_file" ] || return 0
+	grep -q 'authority-store-pruning-config:' "$config_file" || return 0
+
+	# Idempotent rewrite — covers volumes that pre-date this fix. `sui
+	# start` reads network.yaml / per-validator YAMLs, while fullnode.yaml
+	# is not the only live config file on localnet.
+	sed -i -E "s/^([[:space:]]*)num-epochs-to-retain: .*\$/\\1num-epochs-to-retain: ${RETAIN}/" "$config_file"
+	if grep -q '^[[:space:]]*num-epochs-to-retain-for-checkpoints:' "$config_file"; then
+		sed -i -E "s/^([[:space:]]*)num-epochs-to-retain-for-checkpoints: .*\$/\\1num-epochs-to-retain-for-checkpoints: ${RETAIN}/" "$config_file"
+	else
+		awk -v retain="$RETAIN" '
+			/^[[:space:]]*num-epochs-to-retain: / {
+				print
+				match($0, /^[[:space:]]*/)
+				indent = substr($0, RSTART, RLENGTH)
+				print indent "num-epochs-to-retain-for-checkpoints: " retain
+				next
+			}
+			{ print }
+		' "$config_file" > "${config_file}.tmp"
+		mv "${config_file}.tmp" "$config_file"
+	fi
+}
+
+for config_file in "$SUI_HOME"/.sui/sui_config/*.yaml; do
+	patch_pruning_config "$config_file"
+done
+
+clear_stale_postgres_pid() {
+	indexer_dir="$SUI_HOME/.sui/sui_config/indexer"
+	pid_file="$indexer_dir/postmaster.pid"
+	[ -f "$pid_file" ] || return 0
+
+	pid="$(sed -n '1p' "$pid_file" 2>/dev/null || true)"
+	case "$pid" in
+		'' | *[!0-9]*)
+			rm -f "$pid_file"
+			return 0
+			;;
+	esac
+
+	if kill -0 "$pid" 2>/dev/null; then
+		return 0
+	fi
+
+	rm -f "$pid_file"
+}
+
+clear_stale_postgres_pid
+
+# Strip `--with-faucet[=<addr>]` from sui's args and remember the bind
+# address. POSIX-sh argument shuffling: rebuild "$@" by collecting
+# everything that isn't the faucet flag, capturing the addr if any.
+FAUCET_BIND=""
+SUI_ARGV=""
+SUI_ARGV_COUNT=0
+SAVED_IFS=$IFS
+NL='
+'
+for arg in "$@"; do
+	case "$arg" in
+		--with-faucet=*)
+			FAUCET_BIND="${arg#--with-faucet=}"
+			;;
+		--with-faucet)
+			# Bare flag — use sui's documented localnet faucet default
+			# (0.0.0.0:9123). Devstack always passes the `=<addr>` form
+			# so this branch is belt-and-suspenders.
+			FAUCET_BIND="0.0.0.0:9123"
+			;;
+		*)
+			# Pack into SUI_ARGV using newline as separator (POSIX-sh has
+			# no real arrays). Restored via IFS=$NL below.
+			if [ "$SUI_ARGV_COUNT" -eq 0 ]; then
+				SUI_ARGV="$arg"
+			else
+				SUI_ARGV="$SUI_ARGV$NL$arg"
+			fi
+			SUI_ARGV_COUNT=$((SUI_ARGV_COUNT + 1))
+			;;
+	esac
+done
+
+# Re-expand SUI_ARGV into "$@" via IFS so sui sees args without
+# `--with-faucet`. Single-element case avoids an empty trailing arg.
+IFS=$NL
+# shellcheck disable=SC2086
+set -- $SUI_ARGV
+IFS=$SAVED_IFS
+
+# Start sui in the background. The shell stays PID 1 so it can trap
+# docker's SIGTERM and forward; sui becomes a direct child whose
+# SIGINT handler the kernel actually delivers (PID 1 ignores
+# undelivered signals; non-PID-1 children get them by default).
+start_as_sui sui "$@"
+SUI_PID=$STARTED_PID
+register_signal_forward "$SUI_PID"
+
+# Start sui-faucet as a sibling, scoped to the requested bind addr.
+# The faucet reads ~/.sui via `sui_config_dir()` and shares the wallet
+# config sui just generated above. Re-derives all in-memory state on
+# each start, so signal-induced termination is safe.
+FAUCET_PID=""
+if [ -n "$FAUCET_BIND" ]; then
+	FAUCET_HOST="${FAUCET_BIND%:*}"
+	FAUCET_PORT="${FAUCET_BIND##*:}"
+	# Wait for sui's gRPC to accept connections on 127.0.0.1:9000
+	# before starting the faucet — `LocalFaucet::new` does a wallet
+	# `get_reference_gas_price` against the RPC at construction time,
+	# and panics with `tcp connect error` if the port isn't accepting
+	# yet (`crates/sui-faucet/src/main.rs:25` is `.unwrap()`, no retry
+	# loop). curl exits 7 on connection refused; anything else
+	# (including gRPC's HTTP/2 garble) means the port is open.
+	for _ in $(seq 1 60); do
+		# Wrap curl in an `if` branch so its non-zero exit (7 = TCP
+		# refused, 28 = timeout — both common while sui is still
+		# binding) doesn't trip `set -e` and abort the entrypoint
+		# before sui even reaches its RPC bind. Anything OTHER than
+		# 7/28 means the TCP port accepted us → sui's gRPC is live
+		# enough for `LocalFaucet::new` to succeed.
+		if curl -s --max-time 2 --connect-timeout 1 -o /dev/null \
+			http://127.0.0.1:9000 2>/dev/null; then
+			break
+		else
+			RC=$?
+			if [ "$RC" != "7" ] && [ "$RC" != "28" ]; then
+				break
+			fi
+		fi
+		sleep 1
+	done
+	start_as_sui sui-faucet --host-ip "$FAUCET_HOST" --port "$FAUCET_PORT"
+	FAUCET_PID=$STARTED_PID
+	register_signal_forward "$FAUCET_PID"
+fi
+
+# Wait on sui — it's the primary. The shared helper handles dash's
+# "wait returns 128+signum on trapped signal even if child still
+# alive" quirk so we report sui's real exit code (and the container
+# actually waits for sui's checkpoint flush + RocksDB drain before
+# docker reaps it).
+SUI_EXIT=0
+wait_for_child "$SUI_PID" || SUI_EXIT=$?
+
+# Tear down the faucet if it's still alive (e.g. sui exited on its
+# own without the trap firing). SIGKILL because faucet ignores SIGINT
+# and we're already in the exit path.
+if [ -n "$FAUCET_PID" ]; then
+	kill -KILL "$FAUCET_PID" 2>/dev/null || true
+	wait "$FAUCET_PID" 2>/dev/null || true
+fi
+
+exit "$SUI_EXIT"

package/images/sui-fork/Dockerfile

@@ -0,0 +1,53 @@
+FROM rust:1.90-bookworm AS builder
+
+ARG SUI_FORK_REPO=https://github.com/MystenLabs/sui.git
+ARG SUI_FORK_REV
+
+RUN apt-get update \
+	&& apt-get install -y --no-install-recommends \
+		ca-certificates clang cmake git libclang-dev libpq-dev libssl-dev pkg-config protobuf-compiler \
+	&& rm -rf /var/lib/apt/lists/*
+
+RUN set -eux; \
+	test -n "$SUI_FORK_REV"; \
+	git clone --filter=blob:none "$SUI_FORK_REPO" /src/sui; \
+	cd /src/sui; \
+	git fetch --depth 1 origin "$SUI_FORK_REV"; \
+	git checkout FETCH_HEAD; \
+	cargo build --release -p sui-fork; \
+	strip /src/sui/target/release/sui-fork
+
+FROM ubuntu:24.04
+
+ARG SUI_CLI_VERSION
+ARG TARGETARCH
+
+RUN apt-get update \
+	&& apt-get install -y --no-install-recommends ca-certificates curl gawk git libpq5 libssl3 \
+	&& rm -rf /var/lib/apt/lists/*
+
+RUN set -eux; \
+	test -n "$SUI_CLI_VERSION"; \
+	case "$TARGETARCH" in \
+		arm64) SUI_PLATFORM=ubuntu-aarch64 ;; \
+		amd64) SUI_PLATFORM=ubuntu-x86_64 ;; \
+		*) echo "unsupported TARGETARCH=$TARGETARCH" >&2; exit 1 ;; \
+	esac; \
+	url="https://github.com/MystenLabs/sui/releases/download/${SUI_CLI_VERSION}/sui-${SUI_CLI_VERSION}-${SUI_PLATFORM}.tgz"; \
+	curl -fsSL "$url" -o /tmp/sui.tgz; \
+	mkdir -p /tmp/sui-unpack; \
+	tar -xzf /tmp/sui.tgz -C /tmp/sui-unpack; \
+	find /tmp/sui-unpack -maxdepth 2 -type f -executable -exec mv {} /usr/local/bin/ \; ; \
+	rm -rf /tmp/sui.tgz /tmp/sui-unpack; \
+	sui --version
+
+COPY --from=builder /src/sui/target/release/sui-fork /usr/local/bin/sui-fork
+COPY _shared/signal-forward.sh /usr/local/lib/devstack/signal-forward.sh
+COPY sui-fork/entrypoint.sh /usr/local/bin/devstack-sui-fork-entrypoint.sh
+RUN chmod +x /usr/local/bin/devstack-sui-fork-entrypoint.sh
+
+ENV RUST_LOG=info,sui_fork=info,sui=info
+
+EXPOSE 9000
+
+ENTRYPOINT ["/usr/local/bin/devstack-sui-fork-entrypoint.sh"]

package/images/sui-fork/entrypoint.sh

@@ -0,0 +1,51 @@
+#!/bin/sh
+
+set -eu
+
+# shellcheck disable=SC1091
+. /usr/local/lib/devstack/signal-forward.sh
+
+DATA_DIR=/var/lib/sui-fork
+EXPECT_DATA_DIR=0
+for ARG in "$@"; do
+	if [ "$EXPECT_DATA_DIR" -eq 1 ]; then
+		DATA_DIR=$ARG
+		EXPECT_DATA_DIR=0
+		continue
+	fi
+	if [ "$ARG" = "--data-dir" ]; then
+		EXPECT_DATA_DIR=1
+	fi
+done
+
+if [ -f "$DATA_DIR/seed_manifest.json" ]; then
+	FILTERED_ARGS=$(mktemp)
+	SKIP_NEXT=0
+	for ARG in "$@"; do
+		if [ "$SKIP_NEXT" -eq 1 ]; then
+			SKIP_NEXT=0
+			continue
+		fi
+		case "$ARG" in
+			--address | --object)
+				SKIP_NEXT=1
+				continue
+				;;
+		esac
+		printf '%s\n' "$ARG" >>"$FILTERED_ARGS"
+	done
+
+	set --
+	while IFS= read -r ARG; do
+		set -- "$@" "$ARG"
+	done <"$FILTERED_ARGS"
+	rm -f "$FILTERED_ARGS"
+fi
+
+sui-fork "$@" &
+SUI_FORK_PID=$!
+register_signal_forward "$SUI_FORK_PID"
+
+SUI_FORK_EXIT=0
+wait_for_child "$SUI_FORK_PID" || SUI_FORK_EXIT=$?
+exit "$SUI_FORK_EXIT"

package/images/walrus/Dockerfile

@@ -0,0 +1,122 @@
+# Walrus image for local-cluster mode. Vendored Dockerfile fed to
+# `ContainerRuntime.ensureImage` (content-addressed builds: same
+# Dockerfile + build args produce the same image digest).
+#
+# The image packages upstream release binaries only. TARGETARCH selects
+# the matching Walrus and Sui release tarballs, and the build verifies
+# the selected Walrus asset is native for that target before accepting it.
+#
+# Two binary sets baked in:
+#
+#   1. walrus / walrus-deploy / walrus-node — from the walrus release
+#      tarball at WALRUS_VERSION.
+#
+#   2. sui binary — from the sui release tarball at SUI_VERSION. The
+#      deploy/run scripts need a matching `sui` on PATH.
+#
+# Also vendored:
+#
+#   - /opt/walrus/scripts/deploy-walrus.sh — testbed deploy script. Runs
+#     once per stack via `runOneShot`. Emits per-node `dryrun-node-<i>.{yaml,
+#     keystore}` and a deploy summary file with system_object /
+#     staking_object / exchange_object ids.
+#
+#   - /opt/walrus/scripts/run-walrus.sh — long-running node entrypoint.
+#     Relocates per-node configs out of the read-only deploy mount,
+#     swaps SUI for WAL, and execs `walrus-node run`.
+#
+# `ubuntu:24.04` because the walrus + sui binaries link against
+# glibc 2.38+; debian:bookworm (glibc 2.36) fails at runtime.
+
+FROM ubuntu:24.04
+
+ARG WALRUS_VERSION
+ARG SUI_VERSION
+ARG TARGETARCH
+
+RUN apt-get update \
+	&& apt-get install -y --no-install-recommends \
+		ca-certificates curl file gawk git jq netcat-openbsd \
+	&& rm -rf /var/lib/apt/lists/*
+
+# Walrus release-tarball fetch. Asset naming:
+#   walrus-<VERSION>-{ubuntu,macos}-{aarch64,x86_64}.tgz
+# We're inside ubuntu so platform is always `ubuntu-{arch}`.
+RUN set -eux; \
+	case "$TARGETARCH" in \
+		arm64) WALRUS_PLATFORM=ubuntu-aarch64; EXPECTED_FILE_ARCH='ARM aarch64' ;; \
+		amd64) WALRUS_PLATFORM=ubuntu-x86_64; EXPECTED_FILE_ARCH='x86-64' ;; \
+		*) echo "unsupported TARGETARCH=$TARGETARCH" >&2; exit 1 ;; \
+	esac; \
+	url="https://github.com/MystenLabs/walrus/releases/download/${WALRUS_VERSION}/walrus-${WALRUS_VERSION}-${WALRUS_PLATFORM}.tgz"; \
+	curl -fsSL "$url" -o /tmp/walrus.tgz; \
+	mkdir -p /opt/walrus/bin /tmp/walrus-unpack; \
+	tar -xzf /tmp/walrus.tgz -C /tmp/walrus-unpack; \
+	find /tmp/walrus-unpack -maxdepth 2 -type f -executable -exec mv {} /opt/walrus/bin/ \; ; \
+	chmod +x /opt/walrus/bin/*; \
+	for bin in walrus walrus-node walrus-deploy; do \
+		test -x "/opt/walrus/bin/${bin}" || { \
+			echo "walrus release ${WALRUS_VERSION} missing required binary ${bin}" >&2; \
+			ls -la /opt/walrus/bin >&2; \
+			exit 1; \
+		}; \
+		file "/opt/walrus/bin/${bin}" | grep -q "$EXPECTED_FILE_ARCH" || { \
+			echo "walrus release ${WALRUS_VERSION} asset ${WALRUS_PLATFORM} is not native for TARGETARCH=${TARGETARCH}: ${bin}" >&2; \
+			file "/opt/walrus/bin/${bin}" >&2; \
+			exit 1; \
+		}; \
+	done; \
+	rm -rf /tmp/walrus.tgz /tmp/walrus-unpack; \
+	/opt/walrus/bin/walrus --version; \
+	/opt/walrus/bin/walrus-node --help >/dev/null; \
+	/opt/walrus/bin/walrus-deploy --help >/dev/null
+
+# Sui release-tarball fetch (same logic as ../sui/Dockerfile).
+RUN set -eux; \
+	case "$TARGETARCH" in \
+		arm64) SUI_PLATFORM=ubuntu-aarch64 ;; \
+		amd64) SUI_PLATFORM=ubuntu-x86_64 ;; \
+		*) echo "unsupported TARGETARCH=$TARGETARCH" >&2; exit 1 ;; \
+	esac; \
+	url="https://github.com/MystenLabs/sui/releases/download/${SUI_VERSION}/sui-${SUI_VERSION}-${SUI_PLATFORM}.tgz"; \
+	curl -fsSL "$url" -o /tmp/sui.tgz; \
+	mkdir -p /root/sui_bin /tmp/sui-unpack; \
+	tar -xzf /tmp/sui.tgz -C /tmp/sui-unpack; \
+	find /tmp/sui-unpack -maxdepth 2 -type f -executable -name sui -exec mv {} /root/sui_bin/sui \; ; \
+	chmod +x /root/sui_bin/sui; \
+	rm -rf /tmp/sui.tgz /tmp/sui-unpack; \
+	/root/sui_bin/sui --version
+
+# Walrus Move contracts (release tarball doesn't include them; the
+# walrus-deploy CLI needs `--contract-dir /opt/walrus/contracts` to
+# locate the wal/walrus Move packages). Pinned to WALRUS_VERSION so
+# the contract source stays in lockstep with the binary release.
+RUN set -eux; \
+	git clone --depth 1 --branch "${WALRUS_VERSION}" \
+		https://github.com/MystenLabs/walrus.git /tmp/walrus-src; \
+	mkdir -p /opt/walrus/contracts; \
+	cp -r /tmp/walrus-src/contracts/* /opt/walrus/contracts/; \
+	rm -rf /tmp/walrus-src
+
+# Surface both binary sets on PATH so scripts shell out cleanly.
+RUN ln -sf /opt/walrus/bin/walrus /usr/local/bin/walrus \
+	&& ln -sf /opt/walrus/bin/walrus-node /usr/local/bin/walrus-node \
+	&& ln -sf /opt/walrus/bin/walrus-deploy /usr/local/bin/walrus-deploy \
+	&& ln -sf /root/sui_bin/sui /usr/local/bin/sui
+
+RUN mkdir -p /opt/walrus/scripts /opt/walrus/outputs /var/walrus/storage
+
+COPY deploy-walrus.sh /opt/walrus/scripts/deploy-walrus.sh
+COPY run-walrus.sh /opt/walrus/scripts/run-walrus.sh
+RUN chmod +x /opt/walrus/scripts/*.sh
+
+ENV RUST_LOG=info,walrus=info
+
+# Storage-node REST port. Distilled-doc invariant 9.
+EXPOSE 9185
+
+# Default to storage-node entrypoint. The deploy one-shot overrides
+# via `runOneShot` argv: argv[0] == 'deploy' runs `deploy-walrus.sh`,
+# otherwise runs `run-walrus.sh`.
+ENTRYPOINT ["/bin/bash", "-c", "if [ \"${1:-}\" = deploy ]; then shift; exec /opt/walrus/scripts/deploy-walrus.sh \"$@\"; else exec /opt/walrus/scripts/run-walrus.sh; fi", "--"]
+CMD []