docker: add a multi-arch docker build stage to the ci
What the developer wrote
Authored by Jon Griffiths
docker: add a multi-arch docker build stage to the ci
This builds amd64 and arm64 images for the same commit ref.
Note the location of the docker image has changed from "greenaddress/"
to "blockstream/".
What changed, and why it matters
This commit adds a new CI/CD pipeline stage that builds Docker images for two processor architectures (amd64 and arm64) and pushes them to Docker Hub under the 'blockstream/' organization. It is purely an infrastructure/automation change and does not modify any library code, cryptographic logic, or user-facing behavior.
No security action required. As a routine hardening suggestion, ensure DOCKER_HUB_TOKEN is stored as a masked/protected CI variable, restrict it to protected branches/tags if possible, and review whether --network=host and the network.host insecure entitlement are strictly necessary for the Dockerfile build context.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch extends .gitlab-ci.yml with a ‘docker_build’ stage and a reusable .docker_build_template job. It uses Docker 23 with Docker-in-Docker (dind), docker buildx for multi-platform builds (linux/amd64, linux/arm64), and pushes the resulting image as blockstream/wallycore:${CI_COMMIT_SHA}. It also changes the image namespace from greenaddress/ to blockstream/. The job is manual (when: manual), requires DOCKER_HUB_TOKEN/DOCKER_HUB_USER credentials, and uses –network=host and the network.host insecure entitlement.
Changed components
.gitlab-ci.ymlInspect captured patch +37 / −0
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 19ed7b7..ecfbd16 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -4,6 +4,7 @@ variables:
stages:
- test
- release
+ - docker_build
test_with_valgrind:
stage: test
@@ -166,3 +167,39 @@ build_wally_release_files:
- cd ../..
- mv wally_dist/* dist/
- rmdir wally_dist
+
+.docker_build_template:
+ stage: docker_build
+ needs: []
+ when: manual
+ variables:
+ DOCKER_HOST: tcp://localhost:2375
+ DOCKER_TLS_CERTDIR: ""
+ DOCKER_BUILDKIT: 1
+ BUILDX_GIT_INFO: false
+ image: docker:23
+ services:
+ - docker:23-dind
+ tags:
+ - cloud
+ retry:
+ max: 2
+ when: [runner_system_failure, unknown_failure, stuck_or_timeout_failure]
+ script:
+ - echo "$DOCKER_HUB_TOKEN" | docker login --username "$DOCKER_HUB_USER" --password-stdin
+ - docker buildx create --use --platform=linux/amd64,linux/arm64 --name wally-multi-builder --buildkitd-flags '--allow-insecure-entitlement network.host'
+ - docker buildx inspect --bootstrap
+ - cd contrib
+ - docker buildx build
+ --network=host
+ -t blockstream/wallycore:${CI_COMMIT_SHA}
+ ${DOCKER_BUILD_ARGS}
+ .
+ --progress=plain
+ --push
+
+# Debian stable
+build_docker_trixie:
+ extends: .docker_build_template
+ variables:
+ DOCKER_BUILD_ARGS: -f Dockerfile_trixie --platform linux/amd64,linux/arm64
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.