docker: Additional private network options and container tweaks.

[winder]

Summary

Add support for configuring a private network with networking enabled, and for adding peers to a non-standard relay.

This is done by adding the following options:

• GENESIS_ADDRESS - allows a peer node to resolve genesis.json through the REST API.
• GOSSIP_PORT - sets the NetAddress, ensures DisableNetworking is false, and sets IncomingConnectionsLimit to 1000.

Additional tweaks:

• Add ALGORAND_DATA value sanity check. It should not be overridden.
• Switch from runuser to gosu to more closely follow conventions in other high quality docker images.

Test Plan

Manual testing:

1. Same tests used previously for kmd startup delay docker: Start kmd in the background. #5514.
2. The following docker-compose:

version: '3'

services:
  algod-private:
    #image: "algorand/algod:stable"
    image: "wwinder/algod:peertest"
    ports:
      - 4190:8080
      - 4191:7833
    environment:
      TOKEN: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      ADMIN_TOKEN: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      GOSSIP_PORT: 10000

  algod-follower:
    #image: "algorand/algod:stable"
    image: "wwinder/algod:peertest"
    # the genesis file must be downloaded from algod-private
    # if this image starts first, keep restarting until algod-private
    # is available.
    restart: unless-stopped
    # follower node is internal
    ports:
      - 5190:8080 # exposed for testing.
    environment:
      NETWORK: private
      TOKEN: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      ADMIN_TOKEN: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
      PROFILE: conduit
      GENESIS_ADDRESS: algod-private:8080
      PEER_ADDRESS: algod-private:10000
    depends_on:
      - algod-private

[codecov]

Codecov Report

Merging #5525 (cbe25a5) into master (f54e7a7) will decrease coverage by 0.03%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #5525      +/-   ##
==========================================
- Coverage   55.83%   55.80%   -0.03%     
==========================================
  Files         446      446              
  Lines       63258    63258              
==========================================
- Hits        35321    35303      -18     
- Misses      25561    25577      +16     
- Partials     2376     2378       +2     

see 8 files with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[excalq]

Makes sense to me. I've familiarized myself a bit with gosu, which directly Docker's own user handling code for privilege de-escalation.

I'd be interested to know more about testing this private network configuration. It could even be useful for dogfooding new telemetry configurations.