Secure op geth for L2 nodes

Dockerfile

FROM golang:1.23@sha256:60deed95d3888cc5e4d9ff8a10c54e5edc008c6ae3fba6187be6fb592e19e8c0 AS build

WORKDIR /app

# Build arguments for version info
ARG OP_NODE_REPO=https://github.com/ethereum-optimism/optimism.git
ARG OP_NODE_TAG=op-node/v1.14.1
ARG OP_NODE_COMMIT=c1081e3ad0004590435e3179e583cdfdbdd6bc61

RUN git clone $OP_NODE_REPO --branch $OP_NODE_TAG --single-branch . && \\
    git switch -c branch-$OP_NODE_TAG && \\
    [ "$(git rev-parse HEAD)" = "$OP_NODE_COMMIT" ]

RUN cd op-node && \\
    GITCOMMIT=$(git rev-parse HEAD) && \\
    GITDATE=$(git show -s --format=%cI HEAD) && \\
    CGO_ENABLED=0 GOOS=linux go build -v \\
      -ldflags "-s -w -X main.GitCommit=${GITCOMMIT} -X main.GitDate=${GITDATE} -X github.com/ethereum-optimism/optimism/op-node/version.Version=${OP_NODE_TAG} -X github.com/ethereum-optimism/optimism/op-node/version.Meta=stable" \\
      -o /bin/op-node \\
      ./cmd

FROM gcr.io/distroless/static:nonroot@sha256:e8a4044e0b4ae4257efa45fc026c0bc30ad320d43bd4c1a7d5271bd241e386d0

WORKDIR /app

COPY --from=build /bin/op-node ./

USER nonroot

EXPOSE 9545 9222 9222/udp 7300

ENTRYPOINT ["./op-node"]