0xMiden · Mirko-von-Leipzig · Jul 29, 2026 · Jul 29, 2026 · Jul 29, 2026 · Jul 29, 2026
diff --git a/.github/actions/publish-compose/action.yml b/.github/actions/publish-compose/action.yml
@@ -0,0 +1,116 @@
+# Publishes a Compose model that uses local includes as one portable OCI
+# application. OCI Compose artifacts cannot contain local includes, so the
+# action flattens the model before applying the publication-only override while
+# leaving interpolation and project resource naming deferred to the consumer.
+name: "Publish Compose application"
+description: "Flatten local Compose includes and publish the resulting OCI application"
+
+inputs:
+  compose-file:
+    description: "Path to the root Compose file"
+    required: true
+  mode:
+    description: "Publication mode: dry-run or publish"
+    required: true
+  registry-prefix:
+    description: "Registry hostname and namespace, for example ghcr.io/0xmiden"
+    required: true
+  package:
+    description: "OCI package name"
+    required: true
+  tag:
+    description: "OCI package tag"
+    required: true
+  publish-override-file:
+    description: "Path to the portability override applied before publishing"
+    required: false
+    default: "compose/publish.yml"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Validate inputs
+      shell: bash
+      env:
+        COMPOSE_FILE: ${{ inputs.compose-file }}
+        MODE: ${{ inputs.mode }}
+        PUBLISH_OVERRIDE_FILE: ${{ inputs.publish-override-file }}
+      run: |
+        set -euo pipefail
+
+        case "${MODE}" in
+          dry-run | publish) ;;
+          *)
+            echo "::error::Unsupported Compose publication mode: ${MODE}"
+            exit 1
+            ;;
+        esac
+
+        if [[ ! -f "${COMPOSE_FILE}" ]]; then
+          echo "::error::Compose file does not exist: ${COMPOSE_FILE}"
+          exit 1
+        fi
+
+        if [[ ! -f "${PUBLISH_OVERRIDE_FILE}" ]]; then
+          echo "::error::Compose publish override does not exist: ${PUBLISH_OVERRIDE_FILE}"
+          exit 1
+        fi
+
+    - name: Build publishable Compose model
+      shell: bash
+      env:
+        COMPOSE_FILE: ${{ inputs.compose-file }}
+        PUBLISH_OVERRIDE_FILE: ${{ inputs.publish-override-file }}
+      run: |
+        set -euo pipefail
+
+        docker compose \
+          -f "${COMPOSE_FILE}" \
+          --profile "*" \
+          config \
+          --no-interpolate \
+          --no-normalize \
+          --output "${RUNNER_TEMP}/compose.flattened.yml"
+        docker compose \
+          -f "${RUNNER_TEMP}/compose.flattened.yml" \
+          -f "${PUBLISH_OVERRIDE_FILE}" \
+          --profile "*" \
+          config \
+          --no-interpolate \
+          --no-normalize \
+          --output "${RUNNER_TEMP}/compose.publish.yml"
+
+    - name: Publish Compose application
+      shell: bash
+      env:
+        MODE: ${{ inputs.mode }}
+        PACKAGE: ${{ inputs.package }}
+        REGISTRY_PREFIX: ${{ inputs.registry-prefix }}
+        TAG: ${{ inputs.tag }}
+      run: |
+        set -euo pipefail
+
+        artifact_destination="${REGISTRY_PREFIX}/${PACKAGE}:${TAG}"
+
+        case "${MODE}" in
+          dry-run)
+            docker compose \
+              -f "${RUNNER_TEMP}/compose.publish.yml" \
+              --profile "*" \
+              publish \
+              --with-env \
+              --yes \
+              --dry-run \
+              "${artifact_destination}"
+            ;;
+          publish)
+            docker compose \
+              -f "${RUNNER_TEMP}/compose.publish.yml" \
+              --profile "*" \
+              publish \
+              --with-env \
+              --yes \
+              --resolve-image-digests \
+              "${artifact_destination}"
+            ;;
+        esac
diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
@@ -97,19 +97,16 @@ jobs:
           persist-credentials: false
 
       - name: Dry-run Compose publishing
+        uses: ./.github/actions/publish-compose
         env:
           MIDEN_NODE_IMAGE: ghcr.io/0xmiden/miden-node:dry-run
           MIDEN_VALIDATOR_IMAGE: ghcr.io/0xmiden/miden-validator:dry-run
           MIDEN_NTX_BUILDER_IMAGE: ghcr.io/0xmiden/miden-ntx-builder:dry-run
           MIDEN_REMOTE_PROVER_IMAGE: ghcr.io/0xmiden/miden-remote-prover:dry-run
           MIDEN_NETWORK_MONITOR_IMAGE: ghcr.io/0xmiden/miden-network-monitor:dry-run
-        run: |
-          docker compose \
-            -f docker-compose.yml \
-            -f compose/publish.yml \
-            --profile "*" \
-            publish \
-            --with-env \
-            --yes \
-            --dry-run \
-            ghcr.io/0xmiden/miden-local-network:dry-run
+        with:
+          compose-file: docker-compose.yml
+          mode: dry-run
+          package: miden-local-network
+          registry-prefix: ghcr.io/0xmiden
+          tag: dry-run
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -314,24 +314,19 @@ jobs:
           persist-credentials: false
 
       - name: Dry-run Compose publishing
+        uses: ./.github/actions/publish-compose
         env:
-          COMPOSE_PACKAGE: ${{ env.REGISTRY }}/0xmiden/miden-local-network
           MIDEN_NODE_IMAGE: ${{ env.REGISTRY }}/0xmiden/miden-node:${{ needs.preflight.outputs.tag }}
           MIDEN_VALIDATOR_IMAGE: ${{ env.REGISTRY }}/0xmiden/miden-validator:${{ needs.preflight.outputs.tag }}
           MIDEN_NTX_BUILDER_IMAGE: ${{ env.REGISTRY }}/0xmiden/miden-ntx-builder:${{ needs.preflight.outputs.tag }}
           MIDEN_REMOTE_PROVER_IMAGE: ${{ env.REGISTRY }}/0xmiden/miden-remote-prover:${{ needs.preflight.outputs.tag }}
           MIDEN_NETWORK_MONITOR_IMAGE: ${{ env.REGISTRY }}/0xmiden/miden-network-monitor:${{ needs.preflight.outputs.tag }}
-          TAG: ${{ needs.preflight.outputs.tag }}
-        run: |
-          docker compose \
-            -f docker-compose.yml \
-            -f compose/publish.yml \
-            --profile "*" \
-            publish \
-            --with-env \
-            --yes \
-            --dry-run \
-            "${COMPOSE_PACKAGE}:${TAG}"
+        with:
+          compose-file: docker-compose.yml
+          mode: dry-run
+          package: miden-local-network
+          registry-prefix: ${{ env.REGISTRY }}/0xmiden
+          tag: ${{ needs.preflight.outputs.tag }}
 
   publish-docker:
     name: Publish Docker ${{ matrix.component }}
@@ -433,24 +428,19 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Publish Compose application
+        uses: ./.github/actions/publish-compose
         env:
-          COMPOSE_PACKAGE: ${{ env.REGISTRY }}/0xmiden/miden-local-network
           MIDEN_NODE_IMAGE: ${{ env.REGISTRY }}/0xmiden/miden-node:${{ needs.preflight.outputs.tag }}
           MIDEN_VALIDATOR_IMAGE: ${{ env.REGISTRY }}/0xmiden/miden-validator:${{ needs.preflight.outputs.tag }}
           MIDEN_NTX_BUILDER_IMAGE: ${{ env.REGISTRY }}/0xmiden/miden-ntx-builder:${{ needs.preflight.outputs.tag }}
           MIDEN_REMOTE_PROVER_IMAGE: ${{ env.REGISTRY }}/0xmiden/miden-remote-prover:${{ needs.preflight.outputs.tag }}
           MIDEN_NETWORK_MONITOR_IMAGE: ${{ env.REGISTRY }}/0xmiden/miden-network-monitor:${{ needs.preflight.outputs.tag }}
-          TAG: ${{ needs.preflight.outputs.tag }}
-        run: |
-          docker compose \
-            -f docker-compose.yml \
-            -f compose/publish.yml \
-            --profile "*" \
-            publish \
-            --with-env \
-            --yes \
-            --resolve-image-digests \
-            "${COMPOSE_PACKAGE}:${TAG}"
+        with:
+          compose-file: docker-compose.yml
+          mode: publish
+          package: miden-local-network
+          registry-prefix: ${{ env.REGISTRY }}/0xmiden
+          tag: ${{ needs.preflight.outputs.tag }}
 
   publish-github-release:
     name: Publish GitHub release

diff --git a/compose/bootstrap.yml b/compose/bootstrap.yml
@@ -0,0 +1,103 @@
+services:
+  bootstrap-validator:
+    image: ${MIDEN_VALIDATOR_IMAGE:-miden-validator}
+    pull_policy: missing
+    volumes:
+      - node-data:/data
+      - type: bind
+        source: ${MIDEN_GENESIS_CONFIG_FILE:-./genesis/dummy.toml}
+        target: /genesis.toml
+        read_only: true
+    environment:
+      MIDEN_NODE_VALIDATOR_USE_GENESIS_CONFIG: ${MIDEN_GENESIS_CONFIG_FILE:-}
+    entrypoint: ["/bin/sh", "-c"]
+    command:
+      - |
+        set -e
+        if [ -f /data/validator/.bootstrapped ]; then
+          echo "Validator already bootstrapped."
+          exit 0
+        fi
+
+        echo "Cleaning incomplete validator bootstrap state..."
+        rm -rf /data/genesis /data/validator /data/accounts
+        mkdir -p /data/genesis /data/validator /data/accounts
+
+        GENESIS_CONFIG_ARGS=""
+        if [ -n "$${MIDEN_NODE_VALIDATOR_USE_GENESIS_CONFIG:-}" ]; then
+          if [ ! -f /genesis.toml ]; then
+            echo "Genesis config requested but /genesis.toml is not mounted."
+            exit 1
+          fi
+
+          GENESIS_CONFIG_ARGS="--config /genesis.toml"
+        fi
+
+        echo "Building genesis block..."
+        miden-validator genesis \
+          --genesis-block-directory /data/genesis \
+          --accounts-directory /data/accounts \
+          $$GENESIS_CONFIG_ARGS
+
+        echo "Bootstrapping validator..."
+        miden-validator bootstrap \
+          --data-directory /data/validator \
+          --genesis /data/genesis/genesis.dat
+
+        touch /data/validator/.bootstrapped
+
+  bootstrap-node:
+    image: ${MIDEN_NODE_IMAGE:-miden-node}
+    pull_policy: missing
+    volumes:
+      - node-data:/data
+    entrypoint: ["/bin/sh", "-c"]
+    depends_on:
+      bootstrap-validator:
+        condition: service_completed_successfully
+    command:
+      - |
+        set -e
+        if [ -f /data/node/.bootstrapped ]; then
+          echo "Node already bootstrapped."
+          exit 0
+        fi
+
+        echo "Cleaning incomplete node bootstrap state..."
+        rm -rf /data/node
+        mkdir -p /data/node
+
+        echo "Bootstrapping node..."
+        miden-node bootstrap \
+          --data-directory /data/node \
+          --genesis /data/genesis/genesis.dat
+
+        touch /data/node/.bootstrapped
+
+  bootstrap-ntx-builder:
+    image: ${MIDEN_NTX_BUILDER_IMAGE:-miden-ntx-builder}
+    pull_policy: missing
+    volumes:
+      - node-data:/data
+    entrypoint: ["/bin/sh", "-c"]
+    depends_on:
+      bootstrap-node:
+        condition: service_completed_successfully
+    command:
+      - |
+        set -e
+        if [ -f /data/ntx-builder/.bootstrapped ]; then
+          echo "Network transaction builder already bootstrapped."
+          exit 0
+        fi
+
+        echo "Cleaning incomplete network transaction builder bootstrap state..."
+        rm -rf /data/ntx-builder
+        mkdir -p /data/ntx-builder
+
+        echo "Bootstrapping network transaction builder..."
+        miden-ntx-builder bootstrap \
+          --data-directory /data/ntx-builder \
+          --genesis /data/genesis/genesis.dat
+
+        touch /data/ntx-builder/.bootstrapped
diff --git a/compose/monitor.yml b/compose/monitor.yml
@@ -0,0 +1,20 @@
+services:
+  monitor:
+    profiles: [monitor]
+    image: ${MIDEN_NETWORK_MONITOR_IMAGE:-miden-network-monitor}
+    pull_policy: missing
+    depends_on:
+      otel-collector:
+        condition: service_started
+      sequencer:
+        condition: service_started
+    command:
+      - miden-network-monitor
+      - start
+    environment:
+      MIDEN_MONITOR_RPC_URL: http://sequencer:57291
+      MIDEN_MONITOR_PORT: "3001"
+      MIDEN_MONITOR_NETWORK_NAME: Localhost
+      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4317
+    ports:
+      - "127.0.0.1:3001:3001"
diff --git a/compose/node.yml b/compose/node.yml
@@ -0,0 +1,26 @@
+services:
+  sequencer:
+    image: ${MIDEN_NODE_IMAGE:-miden-node}
+    pull_policy: missing
+    volumes:
+      - node-data:/data
+    depends_on:
+      bootstrap-node:
+        condition: service_completed_successfully
+      otel-collector:
+        condition: service_started
+      validator:
+        condition: service_started
+    command:
+      - miden-node
+      - sequencer
+      - --rpc.listen=0.0.0.0:57291
+      - --data-directory=/data/node
+      - --validator.url=http://validator:50101
+      - --ntx-builder.url=http://ntx-builder:50301
+      - --rpc.network-tx-auth-header-value=secret_value
+    environment:
+      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4317
+      OTEL_RESOURCE_ATTRIBUTES: service.instance.id=sequencer
+    ports:
+      - "127.0.0.1:57291:57291"
diff --git a/compose/ntx-builder.yml b/compose/ntx-builder.yml
@@ -0,0 +1,25 @@
+services:
+  ntx-builder:
+    image: ${MIDEN_NTX_BUILDER_IMAGE:-miden-ntx-builder}
+    pull_policy: missing
+    volumes:
+      - node-data:/data
+    depends_on:
+      bootstrap-ntx-builder:
+        condition: service_completed_successfully
+      otel-collector:
+        condition: service_started
+      sequencer:
+        condition: service_started
+      tx-prover:
+        condition: service_started
+    command:
+      - miden-ntx-builder
+      - start
+      - --listen=0.0.0.0:50301
+      - --rpc.url=http://sequencer:57291
+      - --rpc.auth-header-value=secret_value
+      - --tx-prover.url=${MIDEN_REMOTE_PROVER_URL:-http://tx-prover:50051}
+      - --data-directory=/data/ntx-builder
+    environment:
+      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector:4317