14 files changed, 242 insertions, 0 deletions
diff --git a/docker/arkd.Dockerfile b/docker/arkd.Dockerfile
new file mode 100644
index 00000000..08deb403
--- /dev/null
+++ b/docker/arkd.Dockerfile
@@ -0,0 +1,6 @@
+FROM asoltys/arkd AS source
+
+FROM ghcr.io/coinos/base
+USER root
+COPY --from=source /app/arkd /app/ark /usr/local/bin/
+ENTRYPOINT ["arkd"]
diff --git a/docker/base.Dockerfile b/docker/base.Dockerfile
new file mode 100644
index 00000000..594b0d70
--- /dev/null
+++ b/docker/base.Dockerfile
@@ -0,0 +1,26 @@
+# docker build -f docker/base.Dockerfile -t ghcr.io/coinos/base docker/
+FROM debian:trixie-slim
+
+ARG BUN_VERSION=1.4.3
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    curl unzip ca-certificates wget \
+    libpq5 libsodium23 libatomic1 jq socat inotify-tools \
+    liblmdb0 libsecp256k1-2 tini \
+    && curl -fsSL https://bun.sh/install | bash -s "bun-v${BUN_VERSION}" \
+    && mv /root/.bun/bin/bun /usr/local/bin/bun \
+    && ln -s /usr/local/bin/bun /usr/local/bin/bunx \
+    && rm -rf /root/.bun \
+    && apt-get purge -y curl unzip \
+    && apt-get autoremove -y \
+    && rm -rf /var/lib/apt/lists/* \
+       /usr/share/doc /usr/share/man /usr/share/locale \
+       /usr/share/info /var/log/* /tmp/*
+
+COPY bun-distrust.ts /tmp/
+RUN cp /usr/local/bin/bun /tmp/bun \
+    && /tmp/bun /tmp/bun-distrust.ts /usr/local/bin/bun \
+    && rm /tmp/bun /tmp/bun-distrust.ts
+
+RUN groupadd -g 1000 bun && useradd -u 1000 -g bun -m -s /bin/sh bun
+WORKDIR /home/bun/app
diff --git a/docker/bitcoin.Dockerfile b/docker/bitcoin.Dockerfile
new file mode 100644
index 00000000..d222d0a5
--- /dev/null
+++ b/docker/bitcoin.Dockerfile
@@ -0,0 +1,11 @@
+FROM ghcr.io/coinos/base AS builder
+ARG VERSION=30.2
+USER root
+RUN wget -qO- https://bitcoincore.org/bin/bitcoin-core-$VERSION/bitcoin-$VERSION-x86_64-linux-gnu.tar.gz | tar -xz --strip-components=1 -C /usr/local
+
+FROM ghcr.io/coinos/base
+USER root
+COPY --from=builder /usr/local/bin/bitcoind /usr/local/bin/bitcoin-cli /usr/local/bin/
+RUN usermod -l bitcoin bun && usermod -d /home/bitcoin -m bitcoin && groupmod -n bitcoin bun
+USER bitcoin
+ENTRYPOINT ["bitcoind"]
diff --git a/docker/bun-distrust.ts b/docker/bun-distrust.ts
new file mode 100644
index 00000000..df27f619
--- /dev/null
+++ b/docker/bun-distrust.ts
@@ -0,0 +1,41 @@
+// Bun (1.4+) compiles Mozilla's root store into its binary as DER, and NODE_USE_SYSTEM_CA
+// only adds to it. Until a Bun release drops a distrusted root, overwrite its
+// DER in place with a same-length self-signed placeholder whose key was thrown
+// away (zeroing it instead makes every TLS handshake fail).
+//
+// Usage: bun bun-distrust.ts <path to a bun binary> (not the one running it)
+import { readFileSync, writeFileSync } from "node:fs";
+
+const distrust = [
+  {
+    // eMudhra intermediate key compromise, CVE-2026-111943.
+    // sha256 86:A1:EC:BA:08:9C:4A:8D:3B:BE:27:34:C6:12:BA:34:1D:81:3E:04:3C:F9:E8:A8:62:CD:5C:57:A3:6B:BE:6B
+    name: "emSign ECC Root CA - G3",
+    der: "MIICTjCCAdOgAwIBAgIKPPYHqWhwDtqLhDAKBggqhkjOPQQDAzBrMQswCQYDVQQGEwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMwHhcNMTgwMjE4MTgzMDAwWhcNNDMwMjE4MTgzMDAwWjBrMQswCQYDVQQGEwJJTjETMBEGA1UECxMKZW1TaWduIFBLSTElMCMGA1UEChMcZU11ZGhyYSBUZWNobm9sb2dpZXMgTGltaXRlZDEgMB4GA1UEAxMXZW1TaWduIEVDQyBSb290IENBIC0gRzMwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQjpQy4LRL1KPOxst3iAhKAnjlfSU2fySU0WXTsuwYc58Byr+iuL+FBVIcUqEqy6HyC5ltqtdyzdc6LBtCGI79G1Y4PPwT01xySfvalY8L1X44uT6EYGQIrMgqCZH0Wk9GjQjBAMB0GA1UdDgQWBBR8XQKEE9TMipuBzhccLikenEhjQjAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAwNpADBmAjEAvvNhzwIQHWSVB7gYboiFBS+DCBeQyh+KTOgNG3qxrdWBCUfvO6wIBHxcmbHtRwfSAjEAnbpV/KlK6O3t5nYBQnvI+GDZjVGLVTv7jHvrZQnD+JbNR6iC8hZVdyR+EhCVBCyj",
+    placeholder:
+      "MIICTjCCAdSgAwIBAgIUfFrc+EjEsB3lBo+k60ijjiGPT/IwCgYIKoZIzj0EAwIwXjEfMB0GA1UEAwwWeHh4eHh4eHh4eHh4eHh4eHh4eHh4eDE7MDkGA1UECgwyY29pbm9zIHJldm9rZWQgZW1TaWduIEVDQyBSb290IENBIC0gRzMgcGxhY2Vob2xkZXIwHhcNMjYxMDIxMTI1NjQzWhcNMzYxMDE4MTI1NjQzWjBeMR8wHQYDVQQDDBZ4eHh4eHh4eHh4eHh4eHh4eHh4eHh4MTswOQYDVQQKDDJjb2lub3MgcmV2b2tlZCBlbVNpZ24gRUNDIFJvb3QgQ0EgLSBHMyBwbGFjZWhvbGRlcjB2MBAGByqGSM49AgEGBSuBBAAiA2IABBBYruwA2K1haT213dKQAOYRE5Gdy1PMXpM7V57BH6VwUToz9hkWTCXqeOr7/NctfY1fpqbT+tcKl0/OnTVwZuO3ePtUkTvREL/fuVKd9LTU/eTMT1Pqf2GQfVTmkS8C76NTMFEwHQYDVR0OBBYEFARKTDRI5W1qeguIYelguHqh3gvBMB8GA1UdIwQYMBaAFARKTDRI5W1qeguIYelguHqh3gvBMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwIDaAAwZQIwIW/6zsZDBk7LGTetfJJzKqXbhsvMo+4ykb8JSHjLn5zoIsuyBPGvox71gdDPcttgAjEAu3xr0zjPLGQnlM4cwgv6mKTgiiXbt7HneYNN2hu/DvSuCj99c0KuGKEyfHGqotCL",
+  },
+];
+
+const bin = process.argv[2];
+const buf = readFileSync(bin);
+let patched = false;
+
+for (const { name, der: d, placeholder } of distrust) {
+  const der = Buffer.from(d, "base64");
+  const repl = Buffer.from(placeholder, "base64");
+  if (repl.length !== der.length)
+    throw new Error(`${name}: placeholder is ${repl.length} bytes, need ${der.length}`);
+  const at = buf.indexOf(der);
+  if (at < 0) {
+    console.log(`${name}: not in ${bin}, nothing to do`);
+    continue;
+  }
+  if (buf.indexOf(der, at + 1) >= 0)
+    throw new Error(`${name}: more than one copy in ${bin}`);
+  repl.copy(buf, at);
+  patched = true;
+  console.log(`${name}: replaced at offset ${at}`);
+}
+
+if (patched) writeFileSync(bin, buf);
diff --git a/docker/bun.Dockerfile b/docker/bun.Dockerfile
new file mode 100644
index 00000000..8ca4aefb
--- /dev/null
+++ b/docker/bun.Dockerfile
@@ -0,0 +1,9 @@
+# oven/bun with distrusted roots taken out of its built-in store (bun-distrust.ts)
+# docker build -f docker/bun.Dockerfile --build-arg BUN_VERSION=1.4.3 -t ghcr.io/coinos/bun:1.4.3 docker/
+ARG BUN_VERSION=1.4.3
+FROM oven/bun:${BUN_VERSION}
+
+COPY bun-distrust.ts /tmp/
+RUN cp /usr/local/bin/bun /tmp/bun \
+    && /tmp/bun /tmp/bun-distrust.ts /usr/local/bin/bun \
+    && rm /tmp/bun /tmp/bun-distrust.ts
diff --git a/docker/chopsticks.Dockerfile b/docker/chopsticks.Dockerfile
new file mode 100644
index 00000000..c4cc3f27
--- /dev/null
+++ b/docker/chopsticks.Dockerfile
@@ -0,0 +1,6 @@
+FROM ghcr.io/vulpemventures/nigiri-chopsticks AS source
+
+FROM ghcr.io/coinos/base
+USER root
+COPY --from=source /app /usr/local/bin/chopsticks
+ENTRYPOINT ["chopsticks"]
diff --git a/docker/electrs.Dockerfile b/docker/electrs.Dockerfile
new file mode 100644
index 00000000..6a16942d
--- /dev/null
+++ b/docker/electrs.Dockerfile
@@ -0,0 +1,6 @@
+FROM ghcr.io/vulpemventures/electrs AS source
+
+FROM ghcr.io/coinos/base
+USER root
+COPY --from=source /build/electrs /build/electrs
+ENTRYPOINT ["/build/electrs"]
diff --git a/docker/elements.Dockerfile b/docker/elements.Dockerfile
new file mode 100644
index 00000000..3351be82
--- /dev/null
+++ b/docker/elements.Dockerfile
@@ -0,0 +1,14 @@
+FROM ghcr.io/coinos/base AS builder
+ARG VERSION=23.3.4
+ARG SHA256=a758151ace3f21008ab162067ffce9e0e526a1b5d55995e2c30d9cd7ccda41a0
+USER root
+RUN wget -qO /tmp/elements.tar.gz https://github.com/ElementsProject/elements/releases/download/elements-$VERSION/elements-$VERSION-x86_64-linux-gnu.tar.gz \
+ && echo "$SHA256  /tmp/elements.tar.gz" | sha256sum -c - \
+ && tar -xz --strip-components=1 -C /usr/local -f /tmp/elements.tar.gz && rm /tmp/elements.tar.gz
+
+FROM ghcr.io/coinos/base
+USER root
+COPY --from=builder /usr/local/bin/elementsd /usr/local/bin/elements-cli /usr/local/bin/
+RUN usermod -l elements bun && usermod -d /home/elements -m elements && groupmod -n elements bun
+USER elements
+ENTRYPOINT ["elementsd"]
diff --git a/docker/kvrocks.Dockerfile b/docker/kvrocks.Dockerfile
new file mode 100644
index 00000000..c486a1b2
--- /dev/null
+++ b/docker/kvrocks.Dockerfile
@@ -0,0 +1,6 @@
+FROM apache/kvrocks AS source
+
+FROM ghcr.io/coinos/base
+USER root
+COPY --from=source /usr/bin/kvrocks /usr/bin/kvrocks
+ENTRYPOINT ["kvrocks"]
diff --git a/docker/lightningd.Dockerfile b/docker/lightningd.Dockerfile
new file mode 100644
index 00000000..116852c5
--- /dev/null
+++ b/docker/lightningd.Dockerfile
@@ -0,0 +1,13 @@
+FROM elementsproject/lightningd:v26.06.9 AS source
+
+FROM ghcr.io/coinos/base
+USER root
+COPY --from=source /usr/local/ /usr/local/
+COPY --from=source /usr/bin/bitcoin-cli /usr/bin/
+COPY --from=source /entrypoint.sh /entrypoint.sh
+
+ENV LIGHTNINGD_DATA=/root/.lightning
+ENV LIGHTNINGD_NETWORK=bitcoin
+EXPOSE 9735 9835
+VOLUME ["/root/.lightning"]
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/docker/nutshell.Dockerfile b/docker/nutshell.Dockerfile
new file mode 100644
index 00000000..ddf5098f
--- /dev/null
+++ b/docker/nutshell.Dockerfile
@@ -0,0 +1,57 @@
+# Nutshell (cashu mint) on the coinos base image.
+#
+# Source comes from our fork, github.com/coinos/nutshell, at NUTSHELL_REF:
+#   limited-invoices-<ver>             → `mint`
+#   panic-mode-limited-invoices-<ver>  → `mint-old`
+#
+#   docker build -f docker/nutshell.Dockerfile \
+#     --build-arg NUTSHELL_REF=limited-invoices-0.21.0 \
+#     -t ghcr.io/coinos/nutshell:0.21.0-limited-invoices .
+#
+# The interpreter comes from python:3.12-slim-trixie rather than trixie's own
+# python3 (3.13): coincurve 20 publishes cp312 wheels but no cp313, so 3.13
+# would mean compiling the libsecp256k1 bindings from source. The builder is
+# the same Debian release as ghcr.io/coinos/base, so /usr/local (interpreter +
+# site-packages) copies over ABI-compatible, the same way lightningd.Dockerfile
+# lifts /usr/local out of the upstream CLN image.
+
+FROM python:3.12-slim-trixie AS build
+
+ARG NUTSHELL_REPO=https://github.com/coinos/nutshell.git
+ARG NUTSHELL_REF=limited-invoices-0.21.0
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git ca-certificates curl build-essential pkg-config libffi-dev libpq-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN curl -sSL https://install.python-poetry.org | python3 - --version 2.3.2
+ENV PATH="/root/.local/bin:$PATH" \
+    POETRY_VIRTUALENVS_CREATE=false \
+    PIP_NO_CACHE_DIR=1
+
+RUN git clone --depth 1 --branch "$NUTSHELL_REF" "$NUTSHELL_REPO" /app \
+    && rm -rf /app/.git
+WORKDIR /app
+
+# editable root install → /app must ship in the runtime image
+RUN poetry install --without dev --no-root \
+    && poetry install --only-root \
+    && find /usr/local/lib/python3.12 -name __pycache__ -prune -exec rm -rf {} +
+
+FROM ghcr.io/coinos/base
+
+USER root
+# shared libs the CPython build and its wheels link against that base lacks
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libexpat1 libffi8 libsqlite3-0 libbz2-1.0 liblzma5 zlib1g libssl3t64 \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=build /usr/local /usr/local
+COPY --from=build /app /app
+
+WORKDIR /app
+# runtime config is nutshell's /app/.env (bind-mounted, takes precedence over
+# container env); data lives under CASHU_DIR (/app/data/mint)
+EXPOSE 3338
+ENTRYPOINT ["tini", "--"]
+CMD ["mint"]
diff --git a/docker/postgres.Dockerfile b/docker/postgres.Dockerfile
new file mode 100644
index 00000000..da3b35ff
--- /dev/null
+++ b/docker/postgres.Dockerfile
@@ -0,0 +1,23 @@
+FROM postgres:18 AS pg
+FROM ghcr.io/coinos/base
+USER root
+COPY --from=pg /usr/lib/postgresql /usr/lib/postgresql
+COPY --from=pg /usr/share/postgresql /usr/share/postgresql
+COPY --from=pg /usr/local/bin/docker-entrypoint.sh /usr/local/bin/
+COPY --from=pg /lib/x86_64-linux-gnu/libpq.so.5* /lib/x86_64-linux-gnu/
+COPY --from=pg /usr/local/bin/gosu /usr/local/bin/
+RUN ln -s /usr/lib/postgresql/18/bin/* /usr/local/bin/ \
+ && apt-get update && apt-get install -y --no-install-recommends libicu76 libreadline8t64 libxml2 libxslt1.1 libssl3t64 liblz4-1 libzstd1 libnuma1 liburing2 locales \
+ && rm -rf /var/lib/apt/lists/* \
+ && sed -i '/en_US.UTF-8/s/^# //' /etc/locale.gen && locale-gen \
+ && groupadd -r postgres --gid=999 && useradd -r -g postgres --uid=999 --home-dir=/var/lib/postgresql --shell=/bin/bash postgres \
+ && mkdir -p /var/run/postgresql /var/lib/postgresql /docker-entrypoint-initdb.d \
+ && chown -R postgres:postgres /var/run/postgresql /var/lib/postgresql
+WORKDIR /
+ENV PGDATA=/var/lib/postgresql/data
+ENV PG_MAJOR=18
+STOPSIGNAL SIGINT
+USER postgres
+EXPOSE 5432
+ENTRYPOINT ["docker-entrypoint.sh"]
+CMD ["postgres"]
diff --git a/docker/strfry.Dockerfile b/docker/strfry.Dockerfile
new file mode 100644
index 00000000..dff5448d
--- /dev/null
+++ b/docker/strfry.Dockerfile
@@ -0,0 +1,18 @@
+FROM debian:trixie-slim AS builder
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git g++ make pkg-config ca-certificates \
+    liblmdb-dev libflatbuffers-dev libsecp256k1-dev \
+    libb2-dev libzstd-dev libssl-dev zlib1g-dev \
+    && rm -rf /var/lib/apt/lists/*
+RUN git clone --depth 1 https://github.com/hoytech/strfry.git /build
+WORKDIR /build
+RUN git submodule update --init
+RUN make setup-golpe && make -j$(nproc)
+RUN strip --strip-unneeded strfry
+
+FROM ghcr.io/coinos/base
+USER root
+WORKDIR /app
+COPY --from=builder /build/strfry /app/strfry
+ENTRYPOINT ["tini", "--"]
+CMD ["/app/strfry", "relay"]
diff --git a/docker/tigerbeetle.Dockerfile b/docker/tigerbeetle.Dockerfile
new file mode 100644
index 00000000..a85ad165
--- /dev/null
+++ b/docker/tigerbeetle.Dockerfile
@@ -0,0 +1,6 @@
+FROM ghcr.io/tigerbeetle/tigerbeetle AS source
+
+FROM ghcr.io/coinos/base
+USER root
+COPY --from=source /tigerbeetle /usr/local/bin/tigerbeetle
+ENTRYPOINT ["tigerbeetle"]