fix: aztec sandbox compose fixes (AztecProtocol#3634)

* Make `aztec-sandbox` properly clean up after itself.
* Fix compose file to actually use arguments and not spraff warnings.
* Always mount home dir into containers, nothing else.
* Fix build system r.e. multiarch success tags.
* Fix lying default cli comment.
* Convert all bash shebang lines to use bash from PATH rather than
/usr/bin. Some scripts need bash 4 or above which requires a brew
install on mac.
* Convert noir and downstream containers to be ubuntu, from alpine:
  * Still need to do several others e.g. bb.
  * Alpine has given us several issue, weird threading slowdowns in bb.
  * 10x worse performance in nargo.
  * Slower startup times in node.
* Enough is enough! We can now have a unified development and execution
environment. Lovely.

.circleci/config.yml

@@ -358,15 +358,15 @@ jobs:
           command: build yarn-project-prod | add_timestamps
 
   yarn-project-formatting:
-    machine:
-      image: ubuntu-2204:2023.07.2
-    resource_class: large
+    docker:
+      - image: aztecprotocol/alpine-build-image
+    resource_class: small
     steps:
       - *checkout
       - *setup_env
       - run:
           name: Check Formatting
-          command: cond_run_container yarn-project formatting | add_timestamps
+          command: cond_spot_run_container yarn-project 8 formatting | add_timestamps
 
   yarn-project-tests:
     docker:

aztec-up/bin/.aztec-run

@@ -13,68 +13,53 @@ VERSION=${VERSION:-"latest"}
 DOCKER_HOST_BINDS=""
 
 # Volumes to pass to the container.
-DOCKER_VOLUME=""
+DOCKER_VOLUME="-v $HOME:/root"
+
+# Colors.
+y="\033[33m"
+r="\033[0m"
+
+function warn {
+  echo -e "${y}$1${r}"
+}
 
 if ! command -v docker &> /dev/null; then
-  echo "No docker found."
+  warn "No docker found."
   exit 1
 fi
 
-# Colors.
-yellow="\033[33m"
-reset="\033[0m"
+if [[ $PWD != ${HOME}* ]]; then
+  warn "Due to how we containerize our applications, we require your working directory to be somewhere within $HOME."
+fi
 
 # Set up host.docker.internal alias on Linux, just like it is on mac.
 UNAME=$(uname -s)
 if [ "$UNAME" == "Linux" ]; then
   if docker info 2>/dev/null | grep -q rootless; then
     # We're in rootless docker. Probe for the host ip and use that.
     ip=$(hostname -I | head | tr -d ' ')
-    echo -e "${yellow}WARNING: Running within rootless docker. Using $ip as host ip. Ensure listening services are listening on this interface.${reset}"
+    warn "WARNING: Running within rootless docker. Using $ip as host ip. Ensure listening services are listening on this interface."
     DOCKER_HOST_BINDS="$DOCKER_HOST_BINDS --add-host host.docker.internal:$ip"
   else
     DOCKER_HOST_BINDS="$DOCKER_HOST_BINDS --add-host host.docker.internal:host-gateway"
   fi
 fi
 
-# Build a list of mount points
-function add_mount() {
-  DIR="${1:-}"
-
-  # Grab its dirname if its a file.
-  if [ -f "$DIR" ]; then
-    DIR=$(dirname "$DIR")
-  fi
-
-  if [ ! -d "$DIR" ]; then
-    return
-  fi
-
-  # Check if it's already been added.
-  REALDIR=$(realpath $DIR)
-  if [[ "$DOCKER_VOLUME" =~ "$REALDIR:" ]]; then
-    return
-  fi
-
-  DOCKER_VOLUME="$DOCKER_VOLUME -v $REALDIR:$REALDIR"
-}
-
-# Always mount the CWD into the container.
-add_mount "$PWD"
-
 # Substitute any references to localhost with our host gateway.
+# TODO: In node, we can hook the resolve override for localhost with host.docker.internal.
+# Consider if we should just do that, but that wouldn't help e.g. nargo.
 args=("$@")
 for i in "${!args[@]}"; do
     args[$i]=${args[$i]//localhost/host.docker.internal}
 done
 
-# Check if it's either a filename or a directory that exists outside the CWD.
-# If it is then mount inside the container.
-# NOTE: This won't work with assignement-style flags, e.g. --outdir=/foo
+# Check if it's either a filename or a directory that exists outside the HOME.
+# If so, warn and exit.
 for i in "${!args[@]}"; do
     arg=${args[$i]}
-    if [[ -f "$arg" || -d "$arg" && $(realpath $arg) != ${PWD}* ]]; then
-      add_mount "$arg"
+    if [[ -f "$arg" || -d "$arg" && $(realpath $arg) != ${HOME}* ]]; then
+      warn "Due to how we containerize our applications, paths outside of $HOME cannot be referenced."
+      exit 1
     fi
 done
 
@@ -91,8 +76,7 @@ DOCKER_VOLUME="$DOCKER_VOLUME -v cache:/cache"
 docker run \
   -ti \
   --rm \
-  --user $(id -u):$(id -g) \
-  --workdir "$PWD" \
+  --workdir "${PWD/$HOME/\/root}" \
   $DOCKER_HOST_BINDS \
   $DOCKER_ENV \
   $DOCKER_VOLUME \

aztec-up/bin/aztec-install

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # Colors
@@ -29,7 +29,16 @@ function title() {
   echo -e "Welcome to the ${bold}${b}Aztec${r} installer! Your journey into blockchain privacy begins... ${bold}${p}now${r}."
   echo -e "We presently leverage docker to simplify releases of our complex project."
   echo -e "Please ensure it's installed for your platform: https://docs.docker.com/engine/install"
-  echo
+  if [ "$(uname -s)" == "Darwin" ]; then
+    echo
+    echo -e "${y}WARNING: For best performance we recommend adjusting your default docker settings:"
+    echo -e     "         - Under general, enable VirtioFS."
+    echo -e     "         - Under resources, set CPUs to ~80-100% your maximum."
+    echo -e     "         - Under resources, set Memory to ~80% your maximum."
+    echo -e     "You may receive a warning about your home directory being mounted into a container."
+    echo -e     "This is requested so we can read and write project files, that is all."
+    echo -e "${r}"
+  fi
   echo -e "This will install the following scripts and update your PATH if necessary:"
   echo -e "  ${bold}${g}aztec${r}         - launches various infrastructure subsystems (sequencer, prover, pxe, etc)."
   echo -e "  ${bold}${g}aztec-cli${r}     - a command line tool for interfacing and experimenting with infrastructure."
@@ -91,10 +100,12 @@ function pull_container {
   fi
 }
 
-info "Pulling aztec version $VERSION..."
-pull_container aztec-sandbox
-pull_container cli
-pull_container noir
+if [ -z "${SKIP_PULL:-}" ]; then
+  info "Pulling aztec version $VERSION..."
+  pull_container aztec-sandbox
+  pull_container cli
+  pull_container noir
+fi
 
 # Download the Docker Compose file. Used by aztec-start.
 curl -fsSL http://$INSTALL_HOST/docker-compose.yml -o $BIN_PATH/docker-compose.yml

aztec-up/bin/aztec-sandbox

@@ -1,11 +1,21 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
-# Change working dir, so relative volume mounts are in the right place.
-cd ~/.aztec
-
 # Favour 'docker compose', falling back on docker-compose.
 CMD="docker compose"
 $CMD &>/dev/null || CMD="docker-compose"
 
-$CMD -f ~/.aztec/bin/docker-compose.yml up
+ARGS="-f $HOME/.aztec/bin/docker-compose.yml -p sandbox"
+
+# Function to be executed when SIGINT is received.
+cleanup() {
+  $CMD $ARGS down
+}
+
+# Set trap to catch SIGINT and call the cleanup function.
+trap cleanup SIGINT
+
+# Change working dir, so relative volume mounts are in the right place.
+cd ~/.aztec
+
+$CMD $ARGS up --force-recreate --remove-orphans

aztec-up/bin/aztec-up

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 export SKIP_TITLE=1

aztec-up/bin/docker-compose.yml

@@ -1,27 +1,28 @@
-version: '3'
+version: "3"
 services:
   ethereum:
     image: ghcr.io/foundry-rs/foundry@sha256:29ba6e34379e79c342ec02d437beb7929c9e254261e8032b17e187be71a2609f
-    entrypoint: >
-      sh -c '
-      if [ -n "$FORK_BLOCK_NUMBER" ] && [ -n "$FORK_URL" ]; then
-        exec anvil -p 8545 --host 0.0.0.0 --chain-id 31337 --silent --fork-url "$FORK_URL" --fork-block-number "$FORK_BLOCK_NUMBER"
-      elif [ -n "$FORK_URL" ]; then
-        exec anvil -p 8545 --host 0.0.0.0 --chain-id 31337 --silent --fork-url "$FORK_URL"
-      else
-        exec anvil -p 8545 --host 0.0.0.0 --chain-id 31337 --silent
-      fi'
+    command: >
+      '
+      [ -n "$$FORK_URL" ] && ARGS="$$ARGS --fork-url $$FORK_URL";
+      [ -n "$$FORK_BLOCK_NUMBER" ] && ARGS="$$ARGS --fork-block-number $$FORK_BLOCK_NUMBER";
+      echo anvil -p 8545 --host 0.0.0.0 --chain-id 31337 --silent $$ARGS;
+      anvil -p 8545 --host 0.0.0.0 --chain-id 31337 --silent $$ARGS
+      '
     ports:
-      - '${SANDBOX_ANVIL_PORT:-8545}:8545'
+      - "${SANDBOX_ANVIL_PORT:-8545}:8545"
+    environment:
+      FORK_URL:
+      FORK_BLOCK_NUMBER:
 
   aztec:
-    image: 'aztecprotocol/aztec-sandbox'
+    image: "aztecprotocol/aztec-sandbox"
     ports:
-      - '${SANDBOX_AZTEC_NODE_PORT:-8079}:8079'
-      - '${SANDBOX_PXE_PORT:-8080}:8080'
+      - "${SANDBOX_AZTEC_NODE_PORT:-8079}:8079"
+      - "${SANDBOX_PXE_PORT:-8080}:8080"
     environment:
       DEBUG: # Loaded from the user shell if explicitly set
-      HOST_WORKDIR: '${PWD}' # Loaded from the user shell to show log files absolute path in host
+      HOST_WORKDIR: "${PWD}" # Loaded from the user shell to show log files absolute path in host
       ETHEREUM_HOST: http://ethereum:8545
       CHAIN_ID: 31337
       ARCHIVER_POLLING_INTERVAL_MS: 50

barretenberg/acir_tests/Dockerfile.noir_acir_tests

@@ -3,7 +3,7 @@
 # So, it lives here.
 # This chains off the nargo build, and creates a container with a compiled set of acir tests.
 FROM 278380418400.dkr.ecr.eu-west-2.amazonaws.com/noir
-RUN apk add bash jq
+RUN apt update && apt install -y jq && rm -rf /var/lib/apt/lists/* && apt-get clean
 ENV PATH="/usr/src/noir/target/release:${PATH}"
 WORKDIR /usr/src/noir/test_programs
 COPY . .

barretenberg/acir_tests/bash_helpers/catch.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # Handler for SIGCHLD, cleanup if child exit with error
 handle_sigchild() {

barretenberg/acir_tests/bench_acir_tests.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 TEST_NAMES=("$@")
 THREADS=(1 4 16 32 64)

barretenberg/acir_tests/clone_test_vectors.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -eu
 
 TEST_SRC=${TEST_SRC:-../../noir/test_programs/acir_artifacts}

barretenberg/acir_tests/gen_inner_proof_inputs.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Env var overrides:
 #   BIN: to specify a different binary to test with (e.g. bb.js or bb.js-dev).
 set -eu

barretenberg/acir_tests/run_acir_tests.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Env var overrides:
 #   BIN: to specify a different binary to test with (e.g. bb.js or bb.js-dev).
 #   VERBOSE: to enable logging for each test.
@@ -80,8 +80,8 @@ else
     # If parallel flag is set, run in parallel
     if [ -n "${PARALLEL:-}" ]; then
       test $TEST_NAME &
-    else 
-      test $TEST_NAME 
+    else
+      test $TEST_NAME
     fi
   done
 fi

barretenberg/acir_tests/run_acir_tests_browser.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -em
 
 cleanup() {

barretenberg/bootstrap.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -eu
 
 cd "$(dirname "$0")"

barretenberg/cpp/bootstrap.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -eu
 
 # Navigate to script folder

barretenberg/cpp/format.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -e
 
 if [ "$1" == "staged" ]; then

barretenberg/cpp/scripts/bb-tests.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # This script runs all test suites that have not been broken out into their own jobs for parallelisation.
 # Might be better to list exclusions here rather than inclusions as risky to maintain.
 set -eu

barretenberg/cpp/scripts/benchmarks.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -eu
 
 # Move above script dir.

barretenberg/cpp/scripts/collect_coverage_information.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 if [ $# -ne 2 ]; then
     echo "Usage: $0 <llvm-profdata command> <llvm-cov command>"

barretenberg/cpp/scripts/collect_heap_information.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -eu
 
 PRESET=gperftools

barretenberg/cpp/scripts/collect_profile_information.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -eu
 
 # can also be 'xray-1thread'

barretenberg/cpp/scripts/install-wasi-sdk.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -eu
 
 if [[ -d ./src/wasi-sdk-20.0 && -d ./src/wasi-sdk-20.0+threads ]]; then

barretenberg/cpp/scripts/run_tests

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # This is the default test runner which takes the as arguments:
 # 1. The number of ignition transcripts to download.
 # 2. The set of gtest binary names to run.

barretenberg/cpp/src/barretenberg/benchmark/compare_branch_vs_baseline.sh

@@ -1,7 +1,7 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 # This script is used to compare a suite of benchmarks between baseline (default: master) and
-# the branch from which the script is run. Simply check out the branch of interest, ensure 
+# the branch from which the script is run. Simply check out the branch of interest, ensure
 # it is up to date with local master, and run the script.
 
 # Specify the benchmark suite and the "baseline" branch against which to compare
@@ -43,7 +43,7 @@ BASELINE_RESULTS="$BENCH_RESULTS_DIR/results_baseline.json"
 echo -e "\nRunning $BENCH_TARGET in master.."
 bin/$BENCH_TARGET --benchmark_format=json > $BASELINE_RESULTS
 
-# Call compare.py on the results (json) to get high level statistics. 
+# Call compare.py on the results (json) to get high level statistics.
 # See docs at https://github.com/google/benchmark/blob/main/docs/tools.md for more details.
 $BENCH_TOOLS_DIR/compare.py benchmarks $BASELINE_RESULTS $BRANCH_RESULTS