bob-l1: modularize init-container extra commands

Author: ilyaluk

bob-common/mkosi.extra/usr/bin/init-container.sh

@@ -5,10 +5,17 @@ NAME=searcher-container
 
 # PORT FORWARDS
 SEARCHER_SSH_PORT=10022
-ENGINE_API_PORT=8551
 EL_P2P_PORT=30303
 SEARCHER_INPUT_CHANNEL=27017
 
+# Run extra commands which are customized per image,
+# see bob*/mkosi.extra/etc/bob/searcher-container-before-init
+#
+# `source` is not supported in dash
+. /etc/bob/searcher-container-before-init
+
+# BOB_SEARCHER_EXTRA_PODMAN_FLAGS is unescaped, it's sourced from trusted hardcoded file
+
 echo "Starting $NAME..."
 su -s /bin/sh searcher -c "cd ~ && podman run -d \
     --name $NAME --replace \
@@ -24,6 +31,7 @@ su -s /bin/sh searcher -c "cd ~ && podman run -d \
     -v /persistent/lighthouse_logs:/var/log/lighthouse:ro \
     -v /tmp/jwt.hex:/secrets/jwt.hex:ro \
     -v /etc/searcher-logrotate.conf:/tmp/searcher.conf:ro \
+    $BOB_SEARCHER_EXTRA_PODMAN_FLAGS \
     docker.io/library/ubuntu:24.04 \
     /bin/sh -c ' \
         DEBIAN_FRONTEND=noninteractive apt-get update && \
@@ -41,7 +49,7 @@ su -s /bin/sh searcher -c "cd ~ && podman run -d \
         while true; do /usr/sbin/sshd -D -e; sleep 5; done'"
 
 # Attempt a quick check that the container is running
-for i in 1 2 3 4 5; do
+for i in $(seq 1 5); do
     status=$(su -s /bin/sh - searcher -c "podman inspect --format '{{.State.Status}}' $NAME 2>/dev/null || true")
     if [ "$status" = "running" ]; then
         break
@@ -63,24 +71,25 @@ if [ -z "$pid" ] || [ "$pid" = "0" ]; then
 fi
 
 echo "Applying iptables rules in $NAME (PID: $pid) network namespace..."
+ns_iptables() {
+    nsenter --target "$pid" --net iptables "$@"
+}
+
+ns_iptables -A OUTPUT -d 169.254.169.254 -j DROP
 
-# Enter network namespace and apply DROP rules on port 9000 TCP/UDP
-nsenter --target "$pid" --net iptables -A OUTPUT -p tcp --dport 9000 -j DROP
-nsenter --target "$pid" --net iptables -A OUTPUT -p udp --dport 9000 -j DROP
+ns_iptables -A OUTPUT -p tcp --dport 9000 -j DROP
+ns_iptables -A OUTPUT -p udp --dport 9000 -j DROP
 
-# Enter network namespace and apply DROP rule on port 123 UDP
-nsenter --target "$pid" --net iptables -A OUTPUT -p udp --dport 123 -j DROP
+ns_iptables -A OUTPUT -p udp --dport 123 -j DROP
 
-# Drop outbound traffic from SEARCHER_INPUT_CHANNEL
-nsenter --target "$pid" --net iptables -A OUTPUT -p udp --sport $SEARCHER_INPUT_CHANNEL -j DROP
-nsenter --target "$pid" --net iptables -A OUTPUT -p tcp --sport $SEARCHER_INPUT_CHANNEL -j DROP
+ns_iptables -A OUTPUT -p udp --sport $SEARCHER_INPUT_CHANNEL -j DROP
+ns_iptables -A OUTPUT -p tcp --sport $SEARCHER_INPUT_CHANNEL -j DROP
 
-echo "Injecting static hosts into $NAME..."
+# Helper, only used in sourced script below
+exec_in_container() {
+    su -s /bin/sh searcher -c "podman exec $NAME /bin/sh -c '$1'"
+}
 
-su -s /bin/sh searcher -c "podman exec $NAME /bin/sh -c '
-    echo \"3.149.14.12 tx.tee-searcher.flashbots.net\" >> /etc/hosts &&
-    echo \"3.136.107.142 tx.tee-searcher.flashbots.net\" >> /etc/hosts &&
-    echo \"18.221.59.61 backruns.tee-searcher.flashbots.net\" >> /etc/hosts &&
-    echo \"3.15.88.156 backruns.tee-searcher.flashbots.net\" >> /etc/hosts &&
-    echo \"52.207.17.217 fbtee.titanbuilder.xyz\" >> /etc/hosts
-'"
+# Run extra commands which are customized per image,
+# see bob*/mkosi.extra/etc/bob/searcher-container-after-init
+. /etc/bob/searcher-container-after-init

bob-l1/mkosi.extra/etc/bob/searcher-container-after-init

@@ -0,0 +1,12 @@
+# This script is sourced from init-container.sh and contains image-specific stuff
+# See also: bob-common/mkosi.extra/usr/bin/init-container.sh
+
+echo "Injecting static hosts into searcher container..."
+exec_in_container '
+    cat <<EOF >> /etc/hosts
+3.149.14.12   tx.tee-searcher.flashbots.net
+3.136.107.142 tx.tee-searcher.flashbots.net
+18.221.59.61  backruns.tee-searcher.flashbots.net
+3.15.88.156   backruns.tee-searcher.flashbots.net
+52.207.17.217 fbtee.titanbuilder.xyz
+EOF'

bob-l1/mkosi.extra/etc/bob/searcher-container-before-init

@@ -0,0 +1,10 @@
+# This script is sourced from init-container.sh and contains image-specific stuff
+# See also: bob-common/mkosi.extra/usr/bin/init-container.sh
+
+ENGINE_API_PORT=8551
+
+BOB_SEARCHER_EXTRA_PODMAN_FLAGS="
+    -p ${ENGINE_API_PORT}:${ENGINE_API_PORT} \
+    -v /persistent/lighthouse_logs:/var/log/lighthouse:ro \
+    -v /tmp/jwt.hex:/secrets/jwt.hex:ro
+"