feat(node): official kth node Docker image + GHCR publish workflow (#2)

* feat(node): add kth full node image and GHCR publish workflow

Adds the first official Docker image of the kth node, alongside the existing base/ and gcc/ toolchain images.

node/Dockerfile builds FROM the kthnode/gcc15-ubuntu24.04 toolchain and installs kth via 'conan install --requires=kth/<version> --deployer=direct_deploy --build=missing'. The kth package and its heavy dependencies are pulled prebuilt from packages.kth.cash; only pieces without a matching prebuilt for this profile (currently utxoz) are compiled, ~1-2 min. The runtime stage is a slim ubuntu:24.04 (~103 MB) carrying only the GCC 15 C++ runtime, the CA bundle and the kth binary, so it needs no package manager.

build-node.yml is a reusable (workflow_call) + manually dispatchable workflow that builds node/ for a given version and pushes ghcr.io/<owner>/kth:<version> and :latest, authenticating with the built-in GITHUB_TOKEN (no secrets required).

* fix(node): run as non-root and harden the publish workflow

Addresses review feedback:

- Dockerfile: add an unprivileged 'kth' user, own /data, and USER kth before the entrypoint instead of running the node as root.

- build-node.yml: validate the version input against a strict pattern via an env var (avoids shell injection from workflow inputs) and set persist-credentials: false on checkout.

Action refs and the toolchain tag are kept as-is for consistency with the existing knuth.yml workflow and the repo's :latest toolchain convention.

* fix(ci): reject version build-metadata that is not a valid Docker tag

Drop '+' from the accepted version pattern: Docker tags allow only [A-Za-z0-9_.-], so a value like 1.0.0+meta would pass validation but fail at push time. Reject it up front instead.

* rename node/ → kth/ and align action versions

- Move node/Dockerfile to kth/Dockerfile so the directory name matches
  the published image (ghcr.io/k-nuth/kth) and the project naming
  convention elsewhere in the org.
- Update build context in build-node.yml accordingly.
- Bump pinned action versions:
  actions/checkout v4 → v7
  docker/setup-buildx-action v3 → v4
  docker/login-action v3 → v4
  docker/build-push-action v6 → v7

* address remaining CodeRabbit comments on the node image

- Tighten the version regex: only `-` may introduce a prerelease
  suffix. `1.2.3.rc1` (dot-separated) used to slip past the guard and
  fail later in conan; now it's rejected up front.
- Skip the `:latest` tag for prereleases. An `-rc.N` build no longer
  displaces the stable `:latest` — only X.Y.Z without a `-` suffix
  publishes `:latest`.
- Pin the toolchain image by sha256 digest instead of `:latest`. A
  future retag of `gcc15-ubuntu24.04:latest` would otherwise silently
  change the binaries we produce. Bump the digest deliberately when
  the toolchain moves.
- Fix a stale comment that still pointed at `node/` after the rename
  to `kth/`.

---------

Co-authored-by: CyberAshven <cyberashven@users.noreply.github.com>
Co-authored-by: Fernando Pelliccioni <fpelliccioni@gmail.com>

Author: CyberAshven

.github/workflows/build-node.yml

@@ -0,0 +1,97 @@
+name: Build node image
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: kth version to build (e.g. v1.0.0 or 1.0.0)
+        required: true
+        type: string
+  workflow_dispatch:
+    inputs:
+      version:
+        description: kth version to build (e.g. v1.0.0 or 1.0.0)
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-node-docker-image:
+    runs-on: ubuntu-latest
+    steps:
+      # Explicit repository/ref: when this reusable workflow is invoked from
+      # k-nuth/kth, the default checkout would be the caller (kth); we need this
+      # repo's kth/ build context instead.
+      - uses: actions/checkout@v7
+        with:
+          repository: k-nuth/docker-images
+          ref: master
+          persist-credentials: false
+
+      - id: meta
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+          REPO_OWNER: ${{ github.repository_owner }}
+        run: |
+          version="${INPUT_VERSION#v}"
+          # SemVer-ish: X.Y.Z with optional `-prerelease` suffix.
+          # `-` is the only legal separator for the prerelease segment;
+          # `1.2.3.rc1` (dot-separated) would slip into conan as a real
+          # version and fail later.
+          if ! [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+            echo "::error::Invalid version '$INPUT_VERSION' (expected e.g. v1.0.0 or v1.0.0-rc.1)"
+            exit 1
+          fi
+          owner="$(echo "$REPO_OWNER" | tr '[:upper:]' '[:lower:]')"
+          # Stable releases also update the `:latest` tag. Pre-releases
+          # (anything with a `-` suffix) tag only the version itself so
+          # an `-rc` build doesn't displace the most recent stable.
+          if [[ "$version" == *-* ]]; then
+            tags=":${version}"
+          else
+            tags=":${version},:latest"
+          fi
+          {
+            echo "version=${version}"
+            echo "image=ghcr.io/${owner}/kth"
+            echo "tags=${tags}"
+          } >> "$GITHUB_OUTPUT"
+
+      - uses: docker/setup-buildx-action@v4
+
+      - uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - id: tags
+        env:
+          IMAGE: ${{ steps.meta.outputs.image }}
+          SUFFIXES: ${{ steps.meta.outputs.tags }}
+        run: |
+          # tags = ":version" or ":version,:latest" — expand to full refs
+          out=""
+          IFS=',' read -ra parts <<< "$SUFFIXES"
+          for s in "${parts[@]}"; do
+            out+="${IMAGE}${s}"$'\n'
+          done
+          {
+            echo "list<<EOF"
+            echo "${out}"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - uses: docker/build-push-action@v7
+        with:
+          context: ./kth
+          push: true
+          build-args: |
+            KNUTH_VERSION=${{ steps.meta.outputs.version }}
+          tags: ${{ steps.tags.outputs.list }}
+          labels: |
+            org.opencontainers.image.source=https://github.com/k-nuth/kth
+            org.opencontainers.image.version=${{ steps.meta.outputs.version }}

kth/Dockerfile

@@ -0,0 +1,73 @@
+# syntax=docker/dockerfile:1
+#
+# Knuth (kth) Bitcoin Cash full node.
+#
+# The build stage reuses the project's own toolchain image so the compile
+# profile matches the binaries published on packages.kth.cash. The kth package
+# and all of its heavy dependencies (boost, openssl, lmdb, gmp, ...) are pulled
+# prebuilt from that remote; only the few pieces that have no matching prebuilt
+# for this profile (currently utxoz) are compiled here, which takes ~1-2 min.
+
+# Pinned by digest so a future `:latest` retag of the toolchain image
+# doesn't silently change the binaries we produce. Bump deliberately when
+# the toolchain moves (GCC bump, base distro bump, ...).
+ARG TOOLCHAIN=kthnode/gcc15-ubuntu24.04@sha256:4988fdeb3654c2b5ea591ffa4454f67e1a631549449c62e35060ba69da79eb67
+ARG RUNTIME=ubuntu:24.04
+
+FROM ${TOOLCHAIN} AS build
+
+# kth release version without the leading "v" (e.g. 1.0.0).
+ARG KNUTH_VERSION
+ARG CURRENCY=BCH
+
+RUN test -n "${KNUTH_VERSION}" || { echo "KNUTH_VERSION build-arg is required"; exit 1; }
+
+# kthbuild is required to load the kth Conan recipe.
+RUN pip install --no-cache-dir --upgrade "kthbuild>=4,<5"
+
+RUN conan profile detect --force \
+ && conan remote add kth https://packages.kth.cash/api/ --force \
+ && conan install --requires=kth/${KNUTH_VERSION} \
+      --deployer=direct_deploy --output-folder=/deploy --build=missing \
+      -o "kth/*:currency=${CURRENCY}" \
+      -o "kth/*:console=True" \
+      -o "utxoz/*:with_tests=False" \
+      -o "utxoz/*:with_benchmarks=False" \
+      -o "utxoz/*:with_large_benchmarks=False" \
+      -s compiler.cppstd=23
+
+
+FROM ${RUNTIME} AS runtime
+
+LABEL org.opencontainers.image.title="Knuth (kth) node" \
+      org.opencontainers.image.description="Knuth Bitcoin Cash full node" \
+      org.opencontainers.image.source="https://github.com/k-nuth/kth" \
+      org.opencontainers.image.url="https://kth.cash" \
+      org.opencontainers.image.licenses="MIT"
+
+# The binary is compiled with GCC 15; ship its matching C++ runtime so the image
+# does not depend on the base distro's (older) libstdc++ / libgcc ABI. The CA
+# bundle is copied too, so the runtime stage needs no package manager at all.
+COPY --from=build /usr/local/lib64/libstdc++.so.6* /opt/kth/lib/
+COPY --from=build /usr/local/lib64/libgcc_s.so.1*  /opt/kth/lib/
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+RUN echo /opt/kth/lib > /etc/ld.so.conf.d/kth.conf && ldconfig
+
+COPY --from=build /deploy/direct_deploy/kth/bin/kth /usr/local/bin/kth
+
+# Run the node as an unprivileged user. /data is owned by it so the node can
+# persist its state there (and named volumes inherit that ownership).
+RUN useradd --system --user-group --no-create-home --home-dir /data kth \
+ && mkdir -p /data \
+ && chown kth:kth /data
+USER kth
+
+# kth writes its data (blockchain/, archive/, hosts.cache, logs) relative to the
+# working directory, so anchor it to a single mountable location.
+WORKDIR /data
+VOLUME ["/data"]
+
+# P2P port (mainnet). Other ports depend on the chosen network / configuration.
+EXPOSE 8333
+
+ENTRYPOINT ["kth"]