IA1.6.1 Add batcher service running in TEE

.github/workflows/docker-images.yml

@@ -348,3 +348,58 @@ jobs:
             TARGET_BASE_IMAGE=alpine:3.22
             TARGETOS=linux
             TARGETARCH=amd64
+
+  build-op-batcher-tee:
+    needs: prepare-deployment
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Download deployment artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: deployment-artifacts
+
+      - name: Copy config for op-batcher
+        run: |
+          mkdir -p packages/contracts-bedrock/lib/superchain-registry/ops/testdata/monorepo
+          # Copy any required config files here, or create placeholder
+          echo "Config prepared for op-batcher"
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE_PREFIX }}/op-batcher-tee
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            type=sha,prefix={{branch}}-,enable={{is_default_branch}}
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=pr-${{ github.event.number }},enable=${{ github.event_name == 'pull_request' }}
+
+      - name: Build and push OP Batcher TEE
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: espresso/docker/op-stack/Dockerfile
+          target: op-batcher-enclave-target
+          platforms: linux/amd64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            TARGET_BASE_IMAGE=alpine:3.22
+            TARGETOS=linux
+            TARGETARCH=amd64

README_ESPRESSO.md

@@ -294,10 +294,19 @@ docker compose down -v --remove-orphans
 ./scripts/prepare-allocs.sh
 ```
 
+* Make sure you're on a machine with AWS Nitro Enclaves enabled. Build the enclave image.
+```console
+./scripts/batcher-enclave-tool-image.sh
+```
+
 * Build and start all services in the background.
 ```console
 docker compose up --build -d
 ```
+If you're on a machine with AWS Nitro Enclaves enabled, use the `tee` profile instead to start the enclave batcher.
+```console
+COMPOSE_PROFILES=tee docker compose up --build -d
+```
 
 * Run the services and check the log.
 ```console

espresso/.env

@@ -36,3 +36,5 @@ OPERATOR_ADDRESS=0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266
 
 L1_CHAIN_ID=11155111
 L2_CHAIN_ID=22266222
+
+COMPOSE_PROFILES=default

espresso/docker-compose-op-geth.yml

@@ -21,5 +21,5 @@ services:
       OP_HTTP_PORT: ${OP_HTTP_PORT:?err}
       OP_ENGINE_PORT: ${OP_ENGINE_PORT:?err}
     ports:
-      - "${OP_HTTP_PORT}"
-      - "${OP_ENGINE_PORT}"
+      - "${OP_HTTP_PORT}:${OP_HTTP_PORT}"
+      - "${OP_ENGINE_PORT}:${OP_ENGINE_PORT}"