op/geth/fraxtal-mainnet: fix EL peer injection method — change from admin_addStaticPeer to admin_addPeer for op-geth clients

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

.gitignore

@@ -11,3 +11,7 @@ peer-backups/
 snapshots/
 *.bak
 *.swp
+
+# Task C local peer capture state
+peer-state/
+

accesslog-shipper.awk

@@ -0,0 +1,18 @@
+# Streams dshackle access-log lines unchanged, and every 1000 lines OR 30s
+# injects a __shipstat__ checkpoint carrying the cumulative sent-count for this
+# connection. The splits cruncher (claude host) filters these OUT of event
+# processing and uses them to reconcile shipped-vs-ingested per gateway per hour
+# — the completeness signal the time-based floor cannot see (event-loss-by-
+# rotation, 2026-07-10). `sess` = connection-start epoch so the cruncher detects
+# counter resets on shipper reconnect (retry loop resumes at file END).
+BEGIN { sess = systime(); last = sess; n = 0 }
+{
+    n++
+    print
+    now = systime()
+    if (n % 1000 == 0 || now - last >= 30) {
+        printf "{\"__shipstat__\":1,\"sess\":%d,\"sent\":%d,\"ts\":%d}\n", sess, n, now
+        fflush()
+        last = now
+    }
+}

apply-dshackle-overrides.py

@@ -0,0 +1,143 @@
+#!/usr/bin/env python3
+"""apply-dshackle-overrides.py - weave HOST-LOCAL dshackle upstream overrides into
+the generated main_configs/*.yaml so they survive every configure-drpc regeneration.
+
+Override file (NOT in the repo - host-local, like rpc-local/compose.d):
+    /root/rpc-local/dshackle-overrides.yaml
+
+Schema (match by upstream id OR by chain; id wins):
+    upstreams:
+      uk-4-base-mainnet-op-reth-pruned:        # or e.g. "chain:base"
+        method_groups_disabled: [trace, debug] # removed from enabled, added to disabled
+        methods_disabled: [eth_getFilterLogs]  # per-method disables (methods.disabled)
+        options:
+          disable-validation: true             # merged into upstream options
+
+Rationale: heavy methods at flat per-call pay poison the chain's latency scoring
+(operator method-eviction rule 2026-07-10; see method-economics.py). The disable
+decision is local to the gateway's market, so the config lives on the gateway.
+
+Called by reload_dshackle.sh before signaling dshackle - i.e. re-applied on every
+ansible config push. NOTE: dshackle only re-reads upstream method lists on RESTART;
+this keeps the on-disk config permanently correct, the next restart activates it.
+Idempotent. Silent no-op when the override file is absent.
+"""
+import glob
+import os
+import sys
+
+import yaml
+
+OVERRIDES = '/root/rpc-local/dshackle-overrides.yaml'
+CONFIG_DIR = '/root/rpc/main_configs'
+
+
+def apply(upstream, ov):
+    changed = False
+    mg = upstream.setdefault('method-groups', {}) or {}
+    for grp in ov.get('method_groups_disabled') or []:
+        en = mg.get('enabled') or []
+        if grp in en:
+            en.remove(grp)
+            mg['enabled'] = en
+            changed = True
+        dis = mg.get('disabled') or []
+        if grp not in dis:
+            dis.append(grp)
+            mg['disabled'] = dis
+            changed = True
+    if mg:
+        upstream['method-groups'] = mg
+    for meth in ov.get('methods_disabled') or []:
+        methods = upstream.setdefault('methods', {}) or {}
+        dis = methods.get('disabled') or []
+        if not any((d.get('name') if isinstance(d, dict) else d) == meth for d in dis):
+            dis.append({'name': meth})
+            methods['disabled'] = dis
+            upstream['methods'] = methods
+            changed = True
+    for k, v in (ov.get('options') or {}).items():
+        opts = upstream.setdefault('options', {}) or {}
+        if opts.get(k) != v:
+            opts[k] = v
+            upstream['options'] = opts
+            changed = True
+    return changed
+
+
+ENVFILE = '/root/rpc/.env'
+
+
+def env_overrides():
+    """Chain-level overrides from .env (rendered from host_vars env_overrides):
+        DSHACKLE_<CHAIN>_METHOD_GROUPS_DISABLED=trace,debug
+        DSHACKLE_<CHAIN>_METHODS_DISABLED=eth_getFilterLogs
+    <CHAIN> = dshackle chain name, upper, '-' -> '_' (e.g. BASE, ETH_BEACON_CHAIN)."""
+    spec = {}
+    if not os.path.exists(ENVFILE):
+        return spec
+    import re as _re
+    for line in open(ENVFILE):
+        m = _re.match(r'DSHACKLE_([A-Z0-9_]+)_(METHOD_GROUPS|METHODS)_DISABLED=(.*)', line.strip())
+        if not m:
+            continue
+        chain = m.group(1).lower().replace('_', '-')
+        key = 'method_groups_disabled' if m.group(2) == 'METHOD_GROUPS' else 'methods_disabled'
+        vals = [v.strip() for v in m.group(3).split(',') if v.strip()]
+        if vals:
+            spec.setdefault(f'chain:{chain}', {}).setdefault(key, []).extend(vals)
+    return spec
+
+
+def main():
+    spec = env_overrides()
+    if os.path.exists(OVERRIDES):
+        for k, v in ((yaml.safe_load(open(OVERRIDES)) or {}).get('upstreams') or {}).items():
+            cur = spec.setdefault(k, {})
+            for kk, vv in (v or {}).items():
+                if isinstance(vv, list):
+                    cur[kk] = sorted(set((cur.get(kk) or []) + vv))
+                else:
+                    cur.setdefault(kk, vv)
+    if not spec:
+        return
+    total = 0
+    for path in glob.glob(os.path.join(CONFIG_DIR, '*.yaml')):
+        try:
+            doc = yaml.safe_load(open(path))
+        except yaml.YAMLError:
+            continue
+        if not isinstance(doc, dict) or 'upstreams' not in doc:
+            continue
+        changed = False
+        for up in doc['upstreams'] or []:
+            if not isinstance(up, dict):
+                continue
+            ov = spec.get(up.get('id')) or spec.get(f"chain:{up.get('chain')}")
+            if ov and apply(up, ov):
+                changed = True
+        if changed:
+            text = yaml.safe_dump(doc, default_flow_style=False, sort_keys=False)
+            # dshackle silently refuses to hot-reload configs containing TABS
+            # (operator gotcha 2026-07-10) - fail loudly, never write a tabbed file.
+            if '\t' in text:
+                print(f'dshackle-overrides: REFUSING to write {path} - tab in output')
+                continue
+            with open(path, 'w') as f:
+                f.write(text)
+            total += 1
+            print(f'dshackle-overrides: rewove {path}')
+    # tab audit on ALL configs (even unchanged): a tabbed file silently fails
+    # dshackle's hot-reload, so disk and running state diverge invisibly.
+    for path in glob.glob(os.path.join(CONFIG_DIR, '*.yaml')):
+        try:
+            if '\t' in open(path, errors='replace').read():
+                print(f'dshackle-overrides: WARNING {path} contains TABS - dshackle will SILENTLY skip reloading it')
+        except OSError:
+            pass
+    if total:
+        print(f'dshackle-overrides: {total} file(s) rewoven (dshackle hot-reloads on the HUP that follows)')
+
+
+if __name__ == '__main__':
+    main()

arb/nitro/connext-sepolia-nitro-archive-leveldb-hash.yml

@@ -116,7 +116,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: everclear-sepolia
+    chain:
     method-groups:
       enabled:
         - debug

arb/nitro/connext-sepolia-nitro-pruned-pebble-path.yml

@@ -117,7 +117,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: everclear-sepolia
+    chain:
     method-groups:
       enabled:
         - debug

arb/nitro/robinhood-mainnet-nitro-archive-pebble-hash.yml

@@ -0,0 +1,143 @@
+---
+x-logging-defaults: &logging-defaults
+  driver: json-file
+  options:
+    max-size: "512m"
+    max-file: "2"
+
+# Usage:
+#
+# mkdir rpc && cd rpc
+#
+# git init
+# git remote add origin https://github.com/StakeSquid/ethereum-rpc-docker.git
+# git fetch origin vibe
+# git checkout origin/vibe
+#
+# docker run --rm alpine sh -c "printf '0x'; head -c32 /dev/urandom | xxd -p -c 64" > .jwtsecret
+#
+# env
+# ...
+# IP=$(curl ipinfo.io/ip)
+# DOMAIN=${IP}.traefik.me
+# COMPOSE_FILE=base.yml:rpc.yml:arb/nitro/robinhood-mainnet-nitro-archive-pebble-hash.yml
+#
+# docker compose up -d
+#
+# curl -X POST https://${IP}.traefik.me/robinhood-mainnet-archive \
+#   -H "Content-Type: application/json" \
+#   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
+
+services:
+  robinhood-mainnet-archive:
+    image: ${ROBINHOOD_NITRO_IMAGE:-offchainlabs/nitro-node}:${ROBINHOOD_MAINNET_NITRO_VERSION:-v3.11.2-3599aca}
+    sysctls:
+      # TCP Performance
+      net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
+      net.ipv4.tcp_no_metrics_save: 1             # Disable metrics cache
+      net.ipv4.tcp_rmem: 4096 87380 16777216      # Increase TCP read buffers
+      net.ipv4.tcp_wmem: 4096 87380 16777216      # Increase TCP write buffers
+      net.core.somaxconn: 32768                   # Higher connection queue
+      # Memory/Connection Management
+      # net.core.netdev_max_backlog: 50000          # Increase network buffer
+      net.ipv4.tcp_max_syn_backlog: 30000         # More SYN requests
+      net.ipv4.tcp_max_tw_buckets: 2000000        # Allow more TIME_WAIT sockets
+    ulimits:
+      nofile: 1048576    # Max open files (for RPC/WS connections)
+    user: root
+    expose:
+      - 8545
+    command:
+      - --conf.file=/config/baseConfig.json
+      - --execution.caching.archive=true
+      - --execution.caching.database-cache=${ROBINHOOD_MAINNET_NITRO_ARCHIVE_PEBBLE_HASH_DATABASE_CACHE:-2048}
+      - --execution.caching.snapshot-cache=${ROBINHOOD_MAINNET_NITRO_ARCHIVE_PEBBLE_HASH_SNAPSHOT_CACHE:-400}
+      - --execution.caching.trie-clean-cache=${ROBINHOOD_MAINNET_NITRO_ARCHIVE_PEBBLE_HASH_TRIE_CLEAN_CACHE:-600}
+      - --execution.caching.trie-dirty-cache=${ROBINHOOD_MAINNET_NITRO_ARCHIVE_PEBBLE_HASH_TRIE_DIRTY_CACHE:-1024}
+      - --execution.forwarding-target=https://rpc.mainnet.chain.robinhood.com
+      - --execution.rpc.filter-log-cache-size=${ROBINHOOD_MAINNET_NITRO_ARCHIVE_PEBBLE_HASH_FILTER_LOG_CACHE:-32}
+      - --execution.rpc.gas-cap=5500000000
+      - --execution.rpc.log-history=0
+      - --execution.sequencer.enable=false
+      - --http.addr=0.0.0.0
+      - --http.api=eth,net,web3,arb,txpool,debug
+      - --http.corsdomain=*
+      - --http.port=8545
+      - --http.vhosts=*
+      - --metrics
+      - --metrics-server.addr=0.0.0.0
+      - --metrics-server.port=6070
+      - --node.batch-poster.enable=false
+      - --node.feed.input.url=wss://feed.mainnet.chain.robinhood.com
+      - --node.sequencer=false
+      - --node.staker.enable=false
+      - --parent-chain.blob-client.beacon-url=${ETHEREUM_MAINNET_BEACON_REST}
+      - --parent-chain.connection.url=${ETHEREUM_MAINNET_EXECUTION_RPC}
+      - --persistent.chain=/root/.arbitrum/robinhood-mainnet-archive
+      - --persistent.db-engine=pebble
+      - --ws.addr=0.0.0.0
+      - --ws.origins=*
+      - --ws.port=8545
+    restart: unless-stopped
+    stop_grace_period: 5m
+    networks:
+      - chains
+    volumes:
+      - ${ROBINHOOD_MAINNET_NITRO_ARCHIVE_PEBBLE_HASH_DATA:-robinhood-mainnet-nitro-archive-pebble-hash}:/root/.arbitrum
+      - ./arb/robinhood/mainnet:/config
+      - /slowdisk:/slowdisk
+    logging: *logging-defaults
+    labels:
+      - prometheus-scrape.enabled=true
+      - prometheus-scrape.port=6070
+      - prometheus-scrape.path=/debug/metrics/prometheus
+      - traefik.enable=true
+      - traefik.http.middlewares.robinhood-mainnet-nitro-archive-pebble-hash-stripprefix.stripprefix.prefixes=/robinhood-mainnet-archive
+      - traefik.http.services.robinhood-mainnet-nitro-archive-pebble-hash.loadbalancer.server.port=8545
+      - ${NO_SSL:-traefik.http.routers.robinhood-mainnet-nitro-archive-pebble-hash.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.robinhood-mainnet-nitro-archive-pebble-hash.tls.certresolver=myresolver}
+      - ${NO_SSL:-traefik.http.routers.robinhood-mainnet-nitro-archive-pebble-hash.rule=Host(`$DOMAIN`) && (Path(`/robinhood-mainnet-archive`) || Path(`/robinhood-mainnet-archive/`))}
+      - ${NO_SSL:+traefik.http.routers.robinhood-mainnet-nitro-archive-pebble-hash.rule=Path(`/robinhood-mainnet-archive`) || Path(`/robinhood-mainnet-archive/`)}
+      - traefik.http.routers.robinhood-mainnet-nitro-archive-pebble-hash.middlewares=robinhood-mainnet-nitro-archive-pebble-hash-stripprefix, ipallowlist
+
+volumes:
+  robinhood-mainnet-nitro-archive-pebble-hash:
+
+x-upstreams:
+  - id: $${ID}
+    labels:
+      provider: $${PROVIDER}
+    connection:
+      generic:
+        rpc:
+          url: $${RPC_URL}
+        ws:
+          frameSize: 20Mb
+          msgSize: 50Mb
+          url: $${WS_URL}
+    chain: robinhood
+    method-groups:
+      enabled:
+        - debug
+        - filter
+    methods:
+      disabled:
+      enabled:
+        - name: txpool_content # TODO: should be disabled for rollup nodes
+        # standard geth only
+        - name: debug_getRawBlock
+        - name: debug_getRawTransaction
+        - name: debug_getRawReceipts
+        - name: debug_getRawHeader
+        - name: debug_getBadBlocks
+        # non standard geth only slightly dangerous
+        - name: debug_intermediateRoots
+        - name: debug_dumpBlock
+        # standard geth and erigon
+        - name: debug_accountRange
+        - name: debug_getModifiedAccountsByNumber
+        - name: debug_getModifiedAccountsByHash
+        # non standard geth and erigon
+        - name: eth_getRawTransactionByHash
+        - name: eth_getRawTransactionByBlockHashAndIndex
+...

arb/nitro/robinhood-testnet-nitro-archive-pebble-hash.yml

@@ -0,0 +1,143 @@
+---
+x-logging-defaults: &logging-defaults
+  driver: json-file
+  options:
+    max-size: "512m"
+    max-file: "2"
+
+# Usage:
+#
+# mkdir rpc && cd rpc
+#
+# git init
+# git remote add origin https://github.com/StakeSquid/ethereum-rpc-docker.git
+# git fetch origin vibe
+# git checkout origin/vibe
+#
+# docker run --rm alpine sh -c "printf '0x'; head -c32 /dev/urandom | xxd -p -c 64" > .jwtsecret
+#
+# env
+# ...
+# IP=$(curl ipinfo.io/ip)
+# DOMAIN=${IP}.traefik.me
+# COMPOSE_FILE=base.yml:rpc.yml:arb/nitro/robinhood-testnet-nitro-archive-pebble-hash.yml
+#
+# docker compose up -d
+#
+# curl -X POST https://${IP}.traefik.me/robinhood-testnet-archive \
+#   -H "Content-Type: application/json" \
+#   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
+
+services:
+  robinhood-testnet-archive:
+    image: ${ROBINHOOD_NITRO_IMAGE:-offchainlabs/nitro-node}:${ROBINHOOD_TESTNET_NITRO_VERSION:-v3.11.2-3599aca}
+    sysctls:
+      # TCP Performance
+      net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
+      net.ipv4.tcp_no_metrics_save: 1             # Disable metrics cache
+      net.ipv4.tcp_rmem: 4096 87380 16777216      # Increase TCP read buffers
+      net.ipv4.tcp_wmem: 4096 87380 16777216      # Increase TCP write buffers
+      net.core.somaxconn: 32768                   # Higher connection queue
+      # Memory/Connection Management
+      # net.core.netdev_max_backlog: 50000          # Increase network buffer
+      net.ipv4.tcp_max_syn_backlog: 30000         # More SYN requests
+      net.ipv4.tcp_max_tw_buckets: 2000000        # Allow more TIME_WAIT sockets
+    ulimits:
+      nofile: 1048576    # Max open files (for RPC/WS connections)
+    user: root
+    expose:
+      - 8545
+    command:
+      - --conf.file=/config/baseConfig.json
+      - --execution.caching.archive=true
+      - --execution.caching.database-cache=${ROBINHOOD_TESTNET_NITRO_ARCHIVE_PEBBLE_HASH_DATABASE_CACHE:-2048}
+      - --execution.caching.snapshot-cache=${ROBINHOOD_TESTNET_NITRO_ARCHIVE_PEBBLE_HASH_SNAPSHOT_CACHE:-400}
+      - --execution.caching.trie-clean-cache=${ROBINHOOD_TESTNET_NITRO_ARCHIVE_PEBBLE_HASH_TRIE_CLEAN_CACHE:-600}
+      - --execution.caching.trie-dirty-cache=${ROBINHOOD_TESTNET_NITRO_ARCHIVE_PEBBLE_HASH_TRIE_DIRTY_CACHE:-1024}
+      - --execution.forwarding-target=https://rpc.testnet.chain.robinhood.com
+      - --execution.rpc.filter-log-cache-size=${ROBINHOOD_TESTNET_NITRO_ARCHIVE_PEBBLE_HASH_FILTER_LOG_CACHE:-32}
+      - --execution.rpc.gas-cap=5500000000
+      - --execution.rpc.log-history=0
+      - --execution.sequencer.enable=false
+      - --http.addr=0.0.0.0
+      - --http.api=eth,net,web3,arb,txpool,debug
+      - --http.corsdomain=*
+      - --http.port=8545
+      - --http.vhosts=*
+      - --metrics
+      - --metrics-server.addr=0.0.0.0
+      - --metrics-server.port=6070
+      - --node.batch-poster.enable=false
+      - --node.feed.input.url=wss://feed.testnet.chain.robinhood.com
+      - --node.sequencer=false
+      - --node.staker.enable=false
+      - --parent-chain.blob-client.beacon-url=${ETHEREUM_SEPOLIA_BEACON_REST}
+      - --parent-chain.connection.url=${ETHEREUM_SEPOLIA_EXECUTION_RPC}
+      - --persistent.chain=/root/.arbitrum/robinhood-testnet-archive
+      - --persistent.db-engine=pebble
+      - --ws.addr=0.0.0.0
+      - --ws.origins=*
+      - --ws.port=8545
+    restart: unless-stopped
+    stop_grace_period: 5m
+    networks:
+      - chains
+    volumes:
+      - ${ROBINHOOD_TESTNET_NITRO_ARCHIVE_PEBBLE_HASH_DATA:-robinhood-testnet-nitro-archive-pebble-hash}:/root/.arbitrum
+      - ./arb/robinhood/testnet:/config
+      - /slowdisk:/slowdisk
+    logging: *logging-defaults
+    labels:
+      - prometheus-scrape.enabled=true
+      - prometheus-scrape.port=6070
+      - prometheus-scrape.path=/debug/metrics/prometheus
+      - traefik.enable=true
+      - traefik.http.middlewares.robinhood-testnet-nitro-archive-pebble-hash-stripprefix.stripprefix.prefixes=/robinhood-testnet-archive
+      - traefik.http.services.robinhood-testnet-nitro-archive-pebble-hash.loadbalancer.server.port=8545
+      - ${NO_SSL:-traefik.http.routers.robinhood-testnet-nitro-archive-pebble-hash.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.robinhood-testnet-nitro-archive-pebble-hash.tls.certresolver=myresolver}
+      - ${NO_SSL:-traefik.http.routers.robinhood-testnet-nitro-archive-pebble-hash.rule=Host(`$DOMAIN`) && (Path(`/robinhood-testnet-archive`) || Path(`/robinhood-testnet-archive/`))}
+      - ${NO_SSL:+traefik.http.routers.robinhood-testnet-nitro-archive-pebble-hash.rule=Path(`/robinhood-testnet-archive`) || Path(`/robinhood-testnet-archive/`)}
+      - traefik.http.routers.robinhood-testnet-nitro-archive-pebble-hash.middlewares=robinhood-testnet-nitro-archive-pebble-hash-stripprefix, ipallowlist
+
+volumes:
+  robinhood-testnet-nitro-archive-pebble-hash:
+
+x-upstreams:
+  - id: $${ID}
+    labels:
+      provider: $${PROVIDER}
+    connection:
+      generic:
+        rpc:
+          url: $${RPC_URL}
+        ws:
+          frameSize: 20Mb
+          msgSize: 50Mb
+          url: $${WS_URL}
+    chain: robinhood-testnet
+    method-groups:
+      enabled:
+        - debug
+        - filter
+    methods:
+      disabled:
+      enabled:
+        - name: txpool_content # TODO: should be disabled for rollup nodes
+        # standard geth only
+        - name: debug_getRawBlock
+        - name: debug_getRawTransaction
+        - name: debug_getRawReceipts
+        - name: debug_getRawHeader
+        - name: debug_getBadBlocks
+        # non standard geth only slightly dangerous
+        - name: debug_intermediateRoots
+        - name: debug_dumpBlock
+        # standard geth and erigon
+        - name: debug_accountRange
+        - name: debug_getModifiedAccountsByNumber
+        - name: debug_getModifiedAccountsByHash
+        # non standard geth and erigon
+        - name: eth_getRawTransactionByHash
+        - name: eth_getRawTransactionByBlockHashAndIndex
+...

arc/reth/arc-mainnet-reth-archive-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   arc-mainnet-archive-consensus-init:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-v0.7.3}
     user: 0:0
     entrypoint: [/usr/local/bin/arc-node-consensus, init]
     command:
@@ -57,7 +57,7 @@ services:
     logging: *logging-defaults
 
   arc-mainnet-archive:
-    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_MAINNET_RETH_VERSION:-0.7.2}
+    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_MAINNET_RETH_VERSION:-v0.7.3}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -119,7 +119,7 @@ services:
     shm_size: 2gb
 
   arc-mainnet-archive-node:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-v0.7.3}
     user: 0:0
     expose:
       - 31000
@@ -160,6 +160,9 @@ volumes:
   arc-mainnet-reth-archive-trace-execution:
   arc-mainnet-reth-archive-trace-sockets:
 
+x-ephemeral-volumes:
+  - arc-mainnet-reth-archive-trace-sockets
+
 x-upstreams:
   - id: $${ID}
     labels:

arc/reth/arc-mainnet-reth-pruned-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   arc-mainnet-consensus-init:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-v0.7.3}
     user: 0:0
     entrypoint: [/usr/local/bin/arc-node-consensus, init]
     command:
@@ -57,7 +57,7 @@ services:
     logging: *logging-defaults
 
   arc-mainnet:
-    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_MAINNET_RETH_VERSION:-0.7.2}
+    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_MAINNET_RETH_VERSION:-v0.7.3}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -120,7 +120,7 @@ services:
     shm_size: 2gb
 
   arc-mainnet-node:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_MAINNET_CONSENSUS_VERSION:-v0.7.3}
     user: 0:0
     expose:
       - 31000
@@ -161,6 +161,9 @@ volumes:
   arc-mainnet-reth-pruned-trace-execution:
   arc-mainnet-reth-pruned-trace-sockets:
 
+x-ephemeral-volumes:
+  - arc-mainnet-reth-pruned-trace-sockets
+
 x-upstreams:
   - id: $${ID}
     labels:

arc/reth/arc-testnet-reth-archive-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   arc-testnet-archive-consensus-init:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-v0.7.3}
     user: 0:0
     entrypoint: [/usr/local/bin/arc-node-consensus, init]
     command:
@@ -57,7 +57,7 @@ services:
     logging: *logging-defaults
 
   arc-testnet-archive:
-    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_TESTNET_RETH_VERSION:-0.7.2}
+    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_TESTNET_RETH_VERSION:-v0.7.3}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -119,7 +119,7 @@ services:
     shm_size: 2gb
 
   arc-testnet-archive-node:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-v0.7.3}
     user: 0:0
     expose:
       - 31000
@@ -160,6 +160,9 @@ volumes:
   arc-testnet-reth-archive-trace-execution:
   arc-testnet-reth-archive-trace-sockets:
 
+x-ephemeral-volumes:
+  - arc-testnet-reth-archive-trace-sockets
+
 x-upstreams:
   - id: $${ID}
     labels:

arc/reth/arc-testnet-reth-pruned-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   arc-testnet-consensus-init:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-v0.7.3}
     user: 0:0
     entrypoint: [/usr/local/bin/arc-node-consensus, init]
     command:
@@ -57,7 +57,7 @@ services:
     logging: *logging-defaults
 
   arc-testnet:
-    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_TESTNET_RETH_VERSION:-0.7.2}
+    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_TESTNET_RETH_VERSION:-v0.7.3}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -120,7 +120,7 @@ services:
     shm_size: 2gb
 
   arc-testnet-node:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-v0.7.3}
     user: 0:0
     expose:
       - 31000
@@ -161,6 +161,9 @@ volumes:
   arc-testnet-reth-pruned-trace-execution:
   arc-testnet-reth-pruned-trace-sockets:
 
+x-ephemeral-volumes:
+  - arc-testnet-reth-pruned-trace-sockets
+
 x-upstreams:
   - id: $${ID}
     labels:

arc/reth/arc-testnet-reth-pruned.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   arc-testnet-consensus-init:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-v0.7.3}
     user: 0:0
     entrypoint: [/usr/local/bin/arc-node-consensus, init]
     command:
@@ -57,7 +57,7 @@ services:
     logging: *logging-defaults
 
   arc-testnet:
-    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_TESTNET_RETH_VERSION:-0.7.2}
+    image: ${ARC_RETH_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-execution}:${ARC_TESTNET_RETH_VERSION:-v0.7.3}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -120,7 +120,7 @@ services:
     shm_size: 2gb
 
   arc-testnet-node:
-    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-0.7.2}
+    image: ${ARC_CONSENSUS_IMAGE:-docker.cloudsmith.io/circle/arc-network/arc-consensus}:${ARC_TESTNET_CONSENSUS_VERSION:-v0.7.3}
     user: 0:0
     expose:
       - 31000
@@ -161,6 +161,9 @@ volumes:
   arc-testnet-reth-pruned-execution:
   arc-testnet-reth-pruned-sockets:
 
+x-ephemeral-volumes:
+  - arc-testnet-reth-pruned-sockets
+
 x-upstreams:
   - id: $${ID}
     labels:

avalanche/go/avalanche-fuji-go-archive-leveldb.yml

@@ -107,7 +107,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: avalanche
+    chain: avalanche-fuji
     method-groups:
       enabled:
         - debug

avalanche/go/avalanche-fuji-go-pruned-leveldb.prune.yml

@@ -107,7 +107,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: avalanche
+    chain: avalanche-fuji
     method-groups:
       enabled:
         - debug

avalanche/go/avalanche-fuji-go-pruned-leveldb.yml

@@ -107,7 +107,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: avalanche
+    chain: avalanche-fuji
     method-groups:
       enabled:
         - debug

avalanche/go/avalanche-fuji-go-pruned-pebbledb.prune.yml

@@ -107,7 +107,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: avalanche
+    chain: avalanche-fuji
     method-groups:
       enabled:
         - debug

avalanche/go/avalanche-fuji-go-pruned-pebbledb.yml

@@ -107,7 +107,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: avalanche
+    chain: avalanche-fuji
     method-groups:
       enabled:
         - debug

aztec/aztec/aztec-mainnet-aztec-pruned.yml

@@ -0,0 +1,112 @@
+---
+x-logging-defaults: &logging-defaults
+  driver: json-file
+  options:
+    max-size: "512m"
+    max-file: "2"
+# Aztec full node. See https://docs.aztec.network/network/setup/running_a_node
+# Admin port (8880) is not exposed; use docker exec for admin API.
+
+# Usage:
+#
+# mkdir rpc && cd rpc
+#
+# git init
+# git remote add origin https://github.com/StakeSquid/ethereum-rpc-docker.git
+# git fetch origin vibe
+# git checkout origin/vibe
+#
+# docker run --rm alpine sh -c "printf '0x'; head -c32 /dev/urandom | xxd -p -c 64" > .jwtsecret
+#
+# env
+# ...
+# IP=$(curl ipinfo.io/ip)
+# DOMAIN=${IP}.traefik.me
+# COMPOSE_FILE=base.yml:rpc.yml:aztec/aztec/aztec-mainnet-aztec-pruned.yml
+#
+# docker compose up -d
+#
+# curl -X POST https://${IP}.traefik.me/aztec-mainnet-pruned \
+#   -H "Content-Type: application/json" \
+#   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
+
+services:
+  aztec-mainnet-pruned:
+    image: ${AZTEC_AZTEC_IMAGE:-aztecprotocol/aztec}:${AZTEC_MAINNET_AZTEC_VERSION:-5.0.1}
+    sysctls:
+      # TCP Performance
+      net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
+      net.ipv4.tcp_no_metrics_save: 1             # Disable metrics cache
+      net.ipv4.tcp_rmem: 4096 87380 16777216      # Increase TCP read buffers
+      net.ipv4.tcp_wmem: 4096 87380 16777216      # Increase TCP write buffers
+      net.core.somaxconn: 32768                   # Higher connection queue
+      # Memory/Connection Management
+      # net.core.netdev_max_backlog: 50000          # Increase network buffer
+      net.ipv4.tcp_max_syn_backlog: 30000         # More SYN requests
+      net.ipv4.tcp_max_tw_buckets: 2000000        # Allow more TIME_WAIT sockets
+    ulimits:
+      nofile: 1048576    # Max open files (for RPC/WS connections)
+    user: root
+    ports:
+      - 13840:13840
+      - 13840:13840/udp
+    expose:
+      - 8545
+    environment:
+      AZTEC_ADMIN_PORT: '8880'
+      AZTEC_PORT: '8545'
+      DATA_DIRECTORY: /var/lib/data
+      ETHEREUM_DEBUG_HOSTS: ${ETHEREUM_MAINNET_DEBUG_HOSTS:-${ETHEREUM_MAINNET_EXECUTION_RPC}}
+      ETHEREUM_HOSTS: ${ETHEREUM_MAINNET_EXECUTION_RPC}
+      L1_CONSENSUS_HOST_URLS: ${ETHEREUM_MAINNET_BEACON_REST}
+      LOG_LEVEL: ${AZTEC_LOG_LEVEL:-info}
+      P2P_IP: ${IP}
+      P2P_PORT: '13840'
+    entrypoint: [node, --no-warnings, /usr/src/yarn-project/aztec/dest/bin/index.js, start]
+    command:
+      - --node
+      - --network=mainnet
+    restart: unless-stopped
+    stop_grace_period: 5m
+    networks:
+      - chains
+    volumes:
+      - ${AZTEC_MAINNET_AZTEC_PRUNED_DATA:-aztec-mainnet-aztec-pruned}:/var/lib/data
+      - /slowdisk:/slowdisk
+    logging: *logging-defaults
+    labels:
+      - prometheus-scrape.enabled=false
+      - traefik.enable=true
+      - traefik.http.middlewares.aztec-mainnet-aztec-pruned-stripprefix.stripprefix.prefixes=/aztec-mainnet-pruned
+      - traefik.http.services.aztec-mainnet-aztec-pruned.loadbalancer.server.port=8545
+      - ${NO_SSL:-traefik.http.routers.aztec-mainnet-aztec-pruned.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.aztec-mainnet-aztec-pruned.tls.certresolver=myresolver}
+      - ${NO_SSL:-traefik.http.routers.aztec-mainnet-aztec-pruned.rule=Host(`$DOMAIN`) && (Path(`/aztec-mainnet-pruned`) || Path(`/aztec-mainnet-pruned/`))}
+      - ${NO_SSL:+traefik.http.routers.aztec-mainnet-aztec-pruned.rule=Path(`/aztec-mainnet-pruned`) || Path(`/aztec-mainnet-pruned/`)}
+      - traefik.http.routers.aztec-mainnet-aztec-pruned.middlewares=aztec-mainnet-aztec-pruned-stripprefix, ipallowlist
+
+volumes:
+  aztec-mainnet-aztec-pruned:
+
+x-upstreams:
+  - id: $${ID}
+    labels:
+      provider: $${PROVIDER}
+    connection:
+      generic:
+        rpc:
+          url: $${RPC_URL}
+        ws:
+          frameSize: 20Mb
+          msgSize: 50Mb
+          url: $${WS_URL}
+    chain: aztec-mainnet
+    method-groups:
+      enabled:
+        - debug
+        - filter
+    methods:
+      disabled:
+      enabled:
+        - name: txpool_content # TODO: should be disabled for rollup nodes
+...

aztec/aztec/aztec-testnet-aztec-pruned.yml

@@ -32,7 +32,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   aztec-testnet-pruned:
-    image: ${AZTEC_AZTEC_IMAGE:-aztecprotocol/aztec}:${AZTEC_TESTNET_AZTEC_VERSION:-5.0.0-rc.1}
+    image: ${AZTEC_AZTEC_IMAGE:-aztecprotocol/aztec}:${AZTEC_TESTNET_AZTEC_VERSION:-5.0.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -56,6 +56,7 @@ services:
       AZTEC_ADMIN_PORT: '8880'
       AZTEC_PORT: '8545'
       DATA_DIRECTORY: /var/lib/data
+      ETHEREUM_DEBUG_HOSTS: ${ETHEREUM_SEPOLIA_DEBUG_HOSTS:-${ETHEREUM_SEPOLIA_EXECUTION_RPC}}
       ETHEREUM_HOSTS: ${ETHEREUM_SEPOLIA_EXECUTION_RPC}
       L1_CONSENSUS_HOST_URLS: ${ETHEREUM_SEPOLIA_BEACON_REST}
       LOG_LEVEL: ${AZTEC_LOG_LEVEL:-info}

backup-node.sh

@@ -157,8 +157,15 @@ for key in $keys; do
     folder_size_gb=$(printf "%.0f" "$folder_size")
 
     if (( folder_size_gb < 1 )) && [[ "$FORCE_SMALL" != true ]]; then
-	echo "FATAL: existing datadir too small for backup (${folder_size_gb}G at $source_folder); use --force if intentional" >&2
-	exit 1
+	# The torn-backup floor applies to the MAIN data volume only (key == compose
+	# basename). Sidecar volumes (eigenda-proxy, configs, ...) are legitimately
+	# tiny — a 0G sidecar aborting the whole backup left no manifest and blocked
+	# the refresh lane on every ronin bench-retire (4 cycles, 2026-07).
+	if [[ "$key" == "$(basename "$compose_name")" ]]; then
+	    echo "FATAL: existing datadir too small for backup (${folder_size_gb}G at $source_folder); use --force if intentional" >&2
+	    exit 1
+	fi
+	echo "NOTE: sidecar volume rpc_$key is ${folder_size_gb}G — allowing small backup (floor guards the main data volume only)"
     fi
     
     timestamp=$(date +'%Y-%m-%d-%H-%M-%S')

berachain/geth/berachain-mainnet-geth-pruned-pebble-path.yml

@@ -112,7 +112,7 @@ services:
       context: ./berachain
       dockerfile: beacon-kit.Dockerfile
       args:
-        BEACONKIT_VERSION: ${BERACHAIN_MAINNET_BEACON_KIT_VERSION:-v1.4.0-rc3}
+        BEACONKIT_VERSION: ${BERACHAIN_MAINNET_BEACON_KIT_VERSION:-v1.4.1}
         BEACONKIT_IMAGE: ${BERACHAIN_MAINNET_BEACON_KIT_IMAGE:-ghcr.io/berachain/beacon-kit}
     ports:
       - 16562:16562

berachain/reth/berachain-bartio-reth-archive-trace.yml

@@ -61,7 +61,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   berachain-bartio-reth:
-    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BARTIO_RETH_VERSION:-v1.4.0}
+    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BARTIO_RETH_VERSION:-v1.4.4}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

berachain/reth/berachain-bartio-reth-pruned-trace.yml

@@ -61,7 +61,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   berachain-bartio-reth-pruned:
-    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BARTIO_RETH_VERSION:-v1.4.0}
+    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BARTIO_RETH_VERSION:-v1.4.4}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

berachain/reth/berachain-bepolia-reth-archive-trace.yml

@@ -61,7 +61,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   berachain-bepolia-reth:
-    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BEPOLIA_RETH_VERSION:-v1.4.2}
+    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BEPOLIA_RETH_VERSION:-v1.4.4}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

berachain/reth/berachain-bepolia-reth-pruned-trace.yml

@@ -61,7 +61,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   berachain-bepolia-reth-pruned:
-    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BEPOLIA_RETH_VERSION:-v1.4.2}
+    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_BEPOLIA_RETH_VERSION:-v1.4.4}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

berachain/reth/berachain-mainnet-reth-archive-trace.yml

@@ -61,7 +61,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   berachain-mainnet-reth:
-    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_MAINNET_RETH_VERSION:-v1.4.0}
+    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_MAINNET_RETH_VERSION:-v1.4.4}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -89,10 +89,10 @@ services:
       - CHAINID=80094
       - CHAINNAME=mainnet
       - CHAIN_SPEC=mainnet
-    entrypoint: [/bin/bash, -c, "trap 'exit 0' SIGTERM; while [ ! -f /config/eth-genesis.json ] && [ ! -f /tmp/stop ]; do sleep 1 & wait $!; done; exec bera-reth node \"$@\"", --]
+    entrypoint: [bera-reth, node]
     command:
       - --bootnodes=enode://0c5a4a3c0e81fce2974e4d317d88df783731183d534325e32e0fdf8f4b119d7889fa254d3a38890606ec300d744e2aa9c87099a4a032f5c94efe53f3fcdfecfe@34.64.176.79:30303,enode://b6a3137d3a36ef37c4d31843775a9dc293f41bcbde33b6309c80b1771b6634827cd188285136a57474427bd8845adc2f6fe2e0b106bd58d14795b08910b9c326@34.64.181.70:30303,enode://0b6633300614bc2b9749aee0cace7a091ec5348762aee7b1d195f7616d03a9409019d9bef336624bab72e0d069cd4cf0b0de6fbbf53f04f6b6e4c5b39c6bdca6@34.64.39.31:30303,enode://552b001abebb5805fcd734ad367cd05d9078d18f23ec598d7165460fadcfc51116ad95c418f7ea9a141aa8cbc496c8bea3322b67a5de0d3380f11aab1a797513@34.64.183.158:30303,enode://5b037f66099d5ded86eb7e1619f6d06ceb15609e8cc345ced22a4772b06178004e1490a3cd32fd1222789de4c6e4021c2d648a3d750f6d5323e64b771bbd8de7@34.87.142.180:30303,enode://846db253c53753d3ea1197aec296306dc84c25f3afdf142b65cb0fe0f984de55072daa3bbf05a9aea046a38a2292403137b6eafefd5646fcf62120b74e3b898d@34.142.170.110:30303,enode://64b7f6ee9bcd942ad4949c70f2077627f078a057dfd930e6e904e12643d8952f5ae87c91e24559765393f244a72c9d5c011d7d5176e59191d38f315db85a20f5@34.126.161.16:30303,enode://cf4d19bfb8ec507427ec882bac0bac85a0c8c9ddaa0ec91b773bb614e5e09d107cd9fbe323b96f62f31c493f8f42cc5495c18b87c08560c5dea1dfd25256dcf6@35.247.162.2:30303,enode://bb7e44178543431feac8f0ee3827056b7b84d8235b802a8bdbbcd4939dab7f7dd2579ff577a38b002bb0139792af67abd2dd5c9f4f85b8da6e914fa76dca82bc@35.198.150.35:30303,enode://8fef1f5df45e7b31be00a21e1da5665d5a5f5bf4c379086b843f03eade941bdd157f08c95b31880c492577edb9a9b185df7191eaebf54ab06d5bd683b289f3af@34.107.7.241:30303,enode://ce9c87cfe089f6811d26c96913fa3ec10b938d9017fc6246684c74a33679ee34ceca9447180fb509e37bf2b706c2877a82085d34bfd83b5b520ee1288b0fc32f@35.198.109.49:30303,enode://713657eb6a53feadcbc47e634ad557326a51eb6818a3e19a00a8111492f50a666ccbf2f5d334d247ecf941e68d242ef5c3b812b63c44d381ef11f79c2cdb45c7@34.141.15.100:30303,enode://d071fa740e063ce1bb9cdc2b7937baeff6dc4000f91588d730a731c38a6ff0d4015814812c160fab8695e46f74b9b618735368ea2f16db4d785f16d29b3fb7b0@35.203.2.210:30303,enode://ffc452fe451a2e5f89fe634744aea334d92dcd30d881b76209d2db7dbf4b7ee047e7c69a5bb1633764d987a7441d9c4bc57ccdbfd6442a2f860bf953bc89a9b9@34.152.50.224:30303,enode://da94328302a1d1422209d1916744e90b6095a48b2340dcec39b22002c098bb4d58a880dab98eb26edf03fa4705d1b62f99a8c5c14e6666e4726b6d3066d8a4d7@34.95.61.106:30303,enode://19c7671a4844699b481e81a5bcfe7bafc7fefa953c16ebbe1951b1046371e73839e9058de6b7d3c934318fe7e7233dde3621c1c1018eb8b294ea3d4516147150@35.203.82.137:30303
-      - --chain=/config/eth-genesis.json
+      - --chain=mainnet
       - --datadir=/root/.local/share/reth
       - --discovery.port=12881
       - --engine.always-process-payload-attributes-on-canonical-head
@@ -131,7 +131,6 @@ services:
       - ${BERACHAIN_MAINNET_RETH_ARCHIVE_TRACE_DATA:-berachain-mainnet-reth-archive-trace}:/root/.local/share/reth
       - .jwtsecret:/jwtsecret:ro
       - /slowdisk:/slowdisk
-      - berachain-mainnet-reth-archive-trace_config:/config
     logging: *logging-defaults
     labels:
       - prometheus-scrape.enabled=true
@@ -152,7 +151,7 @@ services:
       context: ./berachain
       dockerfile: beacon-kit.Dockerfile
       args:
-        BEACONKIT_VERSION: ${BERACHAIN_MAINNET_BEACON_KIT_VERSION:-v1.4.0-rc3}
+        BEACONKIT_VERSION: ${BERACHAIN_MAINNET_BEACON_KIT_VERSION:-v1.4.1}
         BEACONKIT_IMAGE: ${BERACHAIN_MAINNET_BEACON_KIT_IMAGE:-ghcr.io/berachain/beacon-kit}
     ports:
       - 17881:17881

berachain/reth/berachain-mainnet-reth-pruned-trace.yml

@@ -61,7 +61,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   berachain-mainnet-reth-pruned:
-    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_MAINNET_RETH_VERSION:-v1.4.0}
+    image: ${BERACHAIN_RETH_IMAGE:-ghcr.io/berachain/bera-reth}:${BERACHAIN_MAINNET_RETH_VERSION:-v1.4.4}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -153,7 +153,7 @@ services:
       context: ./berachain
       dockerfile: beacon-kit.Dockerfile
       args:
-        BEACONKIT_VERSION: ${BERACHAIN_MAINNET_BEACON_KIT_VERSION:-v1.4.0-rc3}
+        BEACONKIT_VERSION: ${BERACHAIN_MAINNET_BEACON_KIT_VERSION:-v1.4.1}
         BEACONKIT_IMAGE: ${BERACHAIN_MAINNET_BEACON_KIT_IMAGE:-ghcr.io/berachain/beacon-kit}
     ports:
       - 15900:15900

bitcoin-cash/bitcoind/bitcoin-cash-mainnet-bitcoind-full.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   bitcoin-cash-mainnet:
-    image: ${BITCOIN_CASH_BITCOIND_IMAGE:-bitcoinabc/bitcoin-abc}:${BITCOIN_CASH_MAINNET_BITCOIND_VERSION:-0.33.7}
+    image: ${BITCOIN_CASH_BITCOIND_IMAGE:-bitcoinabc/bitcoin-abc}:${BITCOIN_CASH_MAINNET_BITCOIND_VERSION:-0.33.8}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

bitcoin-cash/bitcoind/bitcoin-cash-testnet-bitcoind-full.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   bitcoin-cash-testnet:
-    image: ${BITCOIN_CASH_BITCOIND_IMAGE:-bitcoinabc/bitcoin-abc}:${BITCOIN_CASH_TESTNET_BITCOIND_VERSION:-0.33.7}
+    image: ${BITCOIN_CASH_BITCOIND_IMAGE:-bitcoinabc/bitcoin-abc}:${BITCOIN_CASH_TESTNET_BITCOIND_VERSION:-0.33.8}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

bootstrap-peers.sh

@@ -0,0 +1,102 @@
+#!/bin/bash
+# bootstrap-peers.sh — fetch curated third-party bootstrap enodes for a network.
+#
+# Secondary seed source for peer-reinject / restore flows. Primary source remains
+# the node's own peer-capture state. Same public JSON customers curl:
+#   https://stakesquid.eu/bootstrap/<network>.json
+#
+# Usage:
+#   bootstrap-peers.sh <network>              # print enodes (one per line)
+#   bootstrap-peers.sh <network> --json       # print full JSON
+#   bootstrap-peers.sh --from-compose <path>  # derive network from compose path
+#   bootstrap-peers.sh ... --dry-run          # show URL + count, no failure on empty
+#
+# Env:
+#   BOOTSTRAP_BASE_URL  default https://stakesquid.eu/bootstrap
+#   BOOTSTRAP_MAX       max enodes to emit (default 25)
+set -euo pipefail
+
+BASE_URL="${BOOTSTRAP_BASE_URL:-https://stakesquid.eu/bootstrap}"
+MAX="${BOOTSTRAP_MAX:-25}"
+DRY_RUN=false
+JSON_OUT=false
+NETWORK=""
+COMPOSE=""
+
+usage() {
+    echo "Usage: $0 <network> [--json] [--dry-run]" >&2
+    echo "       $0 --from-compose <compose-path> [--json] [--dry-run]" >&2
+    exit 1
+}
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --from-compose)
+            COMPOSE="${2:-}"; shift 2 || usage
+            ;;
+        --json) JSON_OUT=true; shift ;;
+        --dry-run) DRY_RUN=true; shift ;;
+        -h|--help) usage ;;
+        -*)
+            echo "Unknown option: $1" >&2
+            usage
+            ;;
+        *)
+            NETWORK="$1"; shift
+            ;;
+    esac
+done
+
+network_from_compose() {
+    local path="$1"
+    local base
+    base="$(basename "$path" | sed 's/--.*//')"
+    # strip client/variant suffixes (same idea as fleet-peers network_from_path)
+    for sep in -op-reth -op-geth -op-erigon -op-nethermind \
+               -reth -geth -erigon -erigon3 -besu -nethermind \
+               -bsc -nitro -l2geth -bor -external-node -gaiad \
+               -juno -rskj -avalanche -maru; do
+        case "$base" in
+            *"$sep"*) base="${base%%$sep*}"; break ;;
+        esac
+    done
+    # common leftover: -pruned / -archive / -pebble / -path / -trace / -bonsai
+    base="$(echo "$base" | sed -E 's/-(pruned|archive|full|pebble|path|trace|bonsai|snap|hash).*//')"
+    echo "$base"
+}
+
+if [[ -n "$COMPOSE" ]]; then
+    NETWORK="$(network_from_compose "$COMPOSE")"
+fi
+if [[ -z "$NETWORK" ]]; then
+    usage
+fi
+
+URL="${BASE_URL%/}/${NETWORK}.json"
+TMP="$(mktemp)"
+trap 'rm -f "$TMP"' EXIT
+
+if ! curl -fsS --max-time 15 "$URL" -o "$TMP" 2>/dev/null; then
+    if [[ "$DRY_RUN" == true ]]; then
+        echo "bootstrap-peers: dry-run fetch failed for $URL" >&2
+        exit 0
+    fi
+    echo "bootstrap-peers: fetch failed: $URL" >&2
+    exit 1
+fi
+
+COUNT="$(jq -r '.peers | length // 0' "$TMP" 2>/dev/null || echo 0)"
+UPDATED="$(jq -r '.updated // empty' "$TMP" 2>/dev/null || true)"
+
+if [[ "$DRY_RUN" == true ]]; then
+    echo "bootstrap-peers: network=$NETWORK url=$URL peers=$COUNT updated=$UPDATED"
+    jq -r '.peers[:3][]? | "  \(.stability.tier // "?") score=\(.stability.score // "?") n_vantage=\(.stability.n_vantage_nodes // "?") \(.enode[0:60])…"' "$TMP" 2>/dev/null || true
+    exit 0
+fi
+
+if [[ "$JSON_OUT" == true ]]; then
+    cat "$TMP"
+    exit 0
+fi
+
+jq -r --argjson m "$MAX" '.peers[:$m][]?.enode // empty' "$TMP" 2>/dev/null | grep -E '^enode://' || true

bsc/bsc/bsc-chapel-bsc-pruned-pebble-path.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   bsc-chapel:
-    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_CHAPEL_BSC_VERSION:-1.7.3}
+    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_CHAPEL_BSC_VERSION:-1.7.6}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

bsc/bsc/bsc-mainnet-bsc-minimal-pebble-hash.yml

@@ -32,7 +32,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   bsc-mainnet-minimal:
-    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_MAINNET_BSC_VERSION:-1.7.3}
+    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_MAINNET_BSC_VERSION:-1.7.6}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

bsc/bsc/bsc-mainnet-bsc-minimal-pebble-path.yml

@@ -32,7 +32,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   bsc-mainnet-minimal:
-    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_MAINNET_BSC_VERSION:-1.7.3}
+    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_MAINNET_BSC_VERSION:-1.7.6}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

bsc/bsc/bsc-mainnet-bsc-pruned-pebble-path.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   bsc-mainnet:
-    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_MAINNET_BSC_VERSION:-1.7.3}
+    image: ${BSC_BSC_IMAGE:-ghcr.io/bnb-chain/bsc}:${BSC_MAINNET_BSC_VERSION:-1.7.6}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

bsc/reth/bsc-chapel-reth-archive-trace-triedb.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_CHAPEL_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}
@@ -102,7 +102,6 @@ services:
       - --rpc.max-connections=50000
       - --rpc.max-logs-per-response=0
       - --rpc.max-trace-filter-blocks=10000
-      - --statedb.triedb
       - --ws
       - --ws.addr=0.0.0.0
       - --ws.api=admin,debug,eth,net,trace,txpool,web3,rpc,reth,ots,flashbots,mev

bsc/reth/bsc-chapel-reth-archive-trace.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_CHAPEL_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}

bsc/reth/bsc-chapel-reth-pruned-trace-triedb.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_CHAPEL_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}
@@ -103,7 +103,6 @@ services:
       - --rpc.max-connections=50000
       - --rpc.max-logs-per-response=0
       - --rpc.max-trace-filter-blocks=10000
-      - --statedb.triedb
       - --ws
       - --ws.addr=0.0.0.0
       - --ws.api=admin,debug,eth,net,trace,txpool,web3,rpc,reth,ots,flashbots,mev

bsc/reth/bsc-chapel-reth-pruned-trace.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_CHAPEL_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_CHAPEL_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}

bsc/reth/bsc-mainnet-reth-archive-trace-triedb.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_MAINNET_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}
@@ -103,7 +103,6 @@ services:
       - --rpc.max-connections=50000
       - --rpc.max-logs-per-response=0
       - --rpc.max-trace-filter-blocks=10000
-      - --statedb.triedb
       - --ws
       - --ws.addr=0.0.0.0
       - --ws.api=admin,debug,eth,net,trace,txpool,web3,rpc,reth,ots,flashbots,mev

bsc/reth/bsc-mainnet-reth-archive-trace.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_MAINNET_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}

bsc/reth/bsc-mainnet-reth-pruned-trace-triedb.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_MAINNET_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}
@@ -103,7 +103,6 @@ services:
       - --rpc.max-connections=50000
       - --rpc.max-logs-per-response=0
       - --rpc.max-trace-filter-blocks=10000
-      - --statedb.triedb
       - --ws
       - --ws.addr=0.0.0.0
       - --ws.api=admin,debug,eth,net,trace,txpool,web3,rpc,reth,ots,flashbots,mev

bsc/reth/bsc-mainnet-reth-pruned-trace.yml

@@ -49,7 +49,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.0.6.3}
+        RETH_VERSION: ${BSC_MAINNET_RETH_VERSION:-v0.1.1}
         RETH_REPO: ${BSC_MAINNET_RETH_REPO:-https://github.com/bnb-chain/reth-bsc.git}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}

clone-backup.sh

@@ -224,6 +224,7 @@ setup_slowdisk_structure() {
         return 1
     fi
     
+    SLOWDISK_TRANSFORMS=""
     echo "Setting up SLOWDISK structure for $key"
     echo "  Static size: $((static_size_kb / 1024))MB"
     echo "  Static paths: ${#static_paths[@]}"
@@ -253,6 +254,11 @@ setup_slowdisk_structure() {
         local slowdisk_path="${slowdisk_base}/rpc_${key}__data_${path//\//__}"
         local target_path="${volume_path}/${path}"
         local target_dir=$(dirname "$target_path")
+        # tar cannot extract THROUGH a symlink to another device (EXDEV
+        # "Invalid cross-device link", reproduced GNU tar 1.34+1.35 2026-07-11 -
+        # killed the katana->uk-4 provision). Collect --transform rewrites so tar
+        # writes directly into /slowdisk; the symlink remains for runtime.
+        SLOWDISK_TRANSFORMS+=" --transform='s|^\\(\\./\\)\\?var/lib/docker/volumes/rpc_${key}/_data/${path}|slowdisk/rpc_${key}__data_${path//\//__}|'"
         
         # Create parent directories in volume
         $SSH_CMD "$DEST_HOST" "mkdir -p '$target_dir'"
@@ -292,6 +298,7 @@ cleanup_all_ports() {
 # Transfer backup file using screen method with better error handling
 transfer_backup() {
     local key=$1
+    local compose_file=$2
     local volume_name="rpc_$key"
     
     # Find the newest restorable backup file (skip near-empty artifacts)
@@ -299,6 +306,17 @@ transfer_backup() {
     backup_file=$(select_newest_local_backup "$backup_dir" "$volume_name")
     
     if [[ -z "$backup_file" ]] || [[ ! -f "$backup_file" ]]; then
+        if [[ "$volume_name" == *-secrets || "$volume_name" == *-jwt ]]; then
+            echo "Note: no backup for secrets/jwt volume $volume_name (regenerated at create-node), skipping"
+            return 2
+        fi
+        # Check if this volume is optional or ephemeral - if so, skip gracefully
+        if [[ -n "$compose_file" && -f "$compose_file" ]]; then
+            if is_ephemeral_volume_key "$key" "$compose_file" || is_optional_volume_key "$key" "$compose_file"; then
+                echo "Note: no backup for optional/ephemeral volume $volume_name (will be created empty at destination), skipping"
+                return 2
+            fi
+        fi
         echo "Warning: No restorable backup file found for $volume_name, skipping"
         return 1
     fi
@@ -327,7 +345,7 @@ transfer_backup() {
                     # Use --skip-old-files to avoid overwriting existing symlinks/directories
                     # and --keep-directory-symlink so tar extracts THROUGH the pre-created dir symlinks
                     # instead of trying to mkdir over them (which fails with 'Cannot mkdir: File exists')
-                    tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink"
+                    tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink${SLOWDISK_TRANSFORMS}"
                     echo "SLOWDISK structure ready, will extract respecting symlinks"
                 else
                     echo "Warning: Failed to setup SLOWDISK structure, falling back to normal extraction"
@@ -344,6 +362,17 @@ transfer_backup() {
         echo "No metadata file found, using normal extraction"
     fi
     
+
+    # AFTER SLOWDISK_TRANSFORMS: rewrite remaining var/lib/docker/ members onto
+    # the target's real docker root when it is a cross-device symlink (see
+    # docker_root_transform in volume-utils.sh).
+    local _drt
+    _drt=$(docker_root_transform)
+    if [[ -n "$_drt" ]]; then
+        echo "Target /var/lib/docker is a symlink; appending docker-root --transform (after slowdisk)"
+        tar_extract_opts="${tar_extract_opts}${_drt}"
+    fi
+
     local file_size=$(stat -f%z "$backup_file" 2>/dev/null || stat -c%s "$backup_file" 2>/dev/null)
     
     # Find an available port
@@ -367,15 +396,17 @@ transfer_backup() {
     if $SSH_CMD "$DEST_HOST" "which screen" >/dev/null 2>&1; then
         echo "Starting screen listener on port $port..."
         
-        # Start listener in screen session with proper escaping
-        # The backup file is already zstd compressed, so we just decompress and extract
-        # Use tar_extract_opts which may include --skip-old-files for SLOWDISK mode
-        $SSH_CMD "$DEST_HOST" "
-            screen -dmS transfer_${key} bash -c '
-                nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
-                echo \$? > /tmp/transfer_${key}.done
-            '
-        "
+        # Ship the listener as a SCRIPT FILE. tar_extract_opts can contain quoted
+        # --transform expressions with '|' which inline bash -c quoting cannot
+        # survive across the ssh+screen layers (broke the katana retry,
+        # 2026-07-11). The heredoc expands locally; the target parses the script
+        # exactly once.
+        $SSH_CMD "$DEST_HOST" "cat > /tmp/transfer_${key}.sh && chmod +x /tmp/transfer_${key}.sh" <<LISTENER
+#!/bin/bash
+nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
+echo \$? > /tmp/transfer_${key}.done
+LISTENER
+        $SSH_CMD "$DEST_HOST" "screen -dmS transfer_${key} /tmp/transfer_${key}.sh"
         
         # Give it time to start
         sleep 2
@@ -389,15 +420,13 @@ transfer_backup() {
     else
         echo "Screen not available, using nohup method..."
         
-        # Use nohup with proper backgrounding
-        # Use tar_extract_opts which may include --skip-old-files for SLOWDISK mode
-        $SSH_CMD "$DEST_HOST" "
-            nohup bash -c '
-                nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
-                echo \$? > /tmp/transfer_${key}.done
-            ' > /tmp/transfer_${key}.log 2>&1 < /dev/null &
-            echo \$! > /tmp/transfer_${key}.pid
-        "
+        # Script-file listener for the same quoting reason as the screen branch.
+        $SSH_CMD "$DEST_HOST" "cat > /tmp/transfer_${key}.sh && chmod +x /tmp/transfer_${key}.sh" <<LISTENER
+#!/bin/bash
+nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
+echo \$? > /tmp/transfer_${key}.done
+LISTENER
+        $SSH_CMD "$DEST_HOST" "nohup /tmp/transfer_${key}.sh > /tmp/transfer_${key}.log 2>&1 < /dev/null & echo \$! > /tmp/transfer_${key}.pid"
         
         sleep 2
         
@@ -481,6 +510,7 @@ transfer_backup() {
 # Fallback: Direct SSH pipe
 transfer_backup_ssh() {
     local key=$1
+    local compose_file=$2
     local volume_name="rpc_$key"
     
     # Find the newest restorable backup file (skip near-empty artifacts)
@@ -488,6 +518,17 @@ transfer_backup_ssh() {
     backup_file=$(select_newest_local_backup "$backup_dir" "$volume_name")
     
     if [[ -z "$backup_file" ]] || [[ ! -f "$backup_file" ]]; then
+        if [[ "$volume_name" == *-secrets || "$volume_name" == *-jwt ]]; then
+            echo "Note: no backup for secrets/jwt volume $volume_name (regenerated at create-node), skipping"
+            return 2
+        fi
+        # Check if this volume is optional or ephemeral - if so, skip gracefully
+        if [[ -n "$compose_file" && -f "$compose_file" ]]; then
+            if is_ephemeral_volume_key "$key" "$compose_file" || is_optional_volume_key "$key" "$compose_file"; then
+                echo "Note: no backup for optional/ephemeral volume $volume_name (will be created empty at destination), skipping"
+                return 2
+            fi
+        fi
         echo "Warning: No restorable backup file found for $volume_name, skipping"
         return 1
     fi
@@ -513,7 +554,7 @@ transfer_backup_ssh() {
             if setup_slowdisk_structure "$key" "$static_size_kb" "${static_paths[@]}"; then
                 # and --keep-directory-symlink so tar extracts THROUGH the pre-created dir symlinks
                 # instead of trying to mkdir over them (which fails with 'Cannot mkdir: File exists')
-                tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink"
+                tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink${SLOWDISK_TRANSFORMS}"
                 echo "SLOWDISK structure ready, will extract respecting symlinks"
             else
                 echo "Warning: Failed to setup SLOWDISK structure, falling back to normal extraction"
@@ -523,6 +564,17 @@ transfer_backup_ssh() {
         fi
     fi
     
+
+    # AFTER SLOWDISK_TRANSFORMS: rewrite remaining var/lib/docker/ members onto
+    # the target's real docker root when it is a cross-device symlink (see
+    # docker_root_transform in volume-utils.sh).
+    local _drt
+    _drt=$(docker_root_transform)
+    if [[ -n "$_drt" ]]; then
+        echo "Target /var/lib/docker is a symlink; appending docker-root --transform (after slowdisk)"
+        tar_extract_opts="${tar_extract_opts}${_drt}"
+    fi
+
     echo "Using direct SSH transfer for $key (file: $(basename "$backup_file"), size: $((file_size / 1048576))MB)"
     
     pv -pterb -s "$file_size" -N "$key" < "$backup_file" | \
@@ -601,18 +653,26 @@ main() {
     echo "----------------------------------------"
     
     success_count=0
+    skipped_volumes=""
     failed_volumes=""
-    
+
     for key in $keys; do
         # Try nc method first
-        transfer_backup "$key"
-        
-        if [[ $? -ne 0 ]]; then
+        transfer_backup "$key" "$dir/$1.yml"
+        rc=$?
+
+        if [[ $rc -eq 2 ]]; then
+            # secrets volume with no backup — regenerated at create-node, not a failure
+            skipped_volumes="$skipped_volumes $key"
+        elif [[ $rc -ne 0 ]]; then
             echo "NC transfer failed, trying direct SSH..."
-            transfer_backup_ssh "$key"
-            
-            if [[ $? -eq 0 ]]; then
+            transfer_backup_ssh "$key" "$dir/$1.yml"
+            rc=$?
+
+            if [[ $rc -eq 0 ]]; then
                 success_count=$((success_count + 1))
+            elif [[ $rc -eq 2 ]]; then
+                skipped_volumes="$skipped_volumes $key"
             else
                 failed_volumes="$failed_volumes $key"
             fi
@@ -626,6 +686,7 @@ main() {
     echo ""
     echo "Transfer Summary:"
     echo "  Successful: $success_count/$volume_count"
+    [[ -n "$skipped_volumes" ]] && echo "  Skipped (no backup by design):$skipped_volumes"
     [[ -n "$failed_volumes" ]] && echo "  Failed:$failed_volumes"
     
     # Restore Network buffer and congestion control settings.
@@ -655,7 +716,7 @@ main() {
     $SSH_CMD -O exit "$DEST_HOST" 2>/dev/null
     
     # Exit with appropriate status (cleanup will be handled by trap)
-    [[ $success_count -eq $volume_count ]] && exit 0 || exit 1
+    [[ -z "$failed_volumes" ]] && exit 0 || exit 1
 }
 
 main "$@"

clone-node.sh

@@ -200,6 +200,7 @@ setup_slowdisk_structure() {
         return 1
     fi
     
+    SLOWDISK_TRANSFORMS=""
     echo "Setting up SLOWDISK structure for $key"
     echo "  Static size: $((static_size_kb / 1024))MB"
     echo "  Static paths: ${#static_paths[@]}"
@@ -229,6 +230,9 @@ setup_slowdisk_structure() {
         local slowdisk_path="${slowdisk_base}/rpc_${key}__data_${path//\//__}"
         local target_path="${volume_path}/${path}"
         local target_dir=$(dirname "$target_path")
+        # tar cannot extract through a cross-device dir symlink (EXDEV) - rewrite
+        # member paths to land directly on /slowdisk (same fix as clone-backup).
+        SLOWDISK_TRANSFORMS+=" --transform='s|^\\(\\./\\)\\?var/lib/docker/volumes/rpc_${key}/_data/${path}|slowdisk/rpc_${key}__data_${path//\//__}|'"
         
         # Create parent directories in volume
         $SSH_CMD "$DEST_HOST" "mkdir -p '$target_dir'"
@@ -299,7 +303,7 @@ transfer_volume() {
                         # Use --skip-old-files to avoid overwriting existing symlinks/directories
                         # and --keep-directory-symlink so tar extracts THROUGH the pre-created dir symlinks
                         # instead of trying to mkdir over them (which fails with 'Cannot mkdir: File exists')
-                        tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink"
+                        tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink${SLOWDISK_TRANSFORMS}"
                         echo "SLOWDISK structure ready, will extract respecting symlinks"
                     else
                         echo "Warning: Failed to setup SLOWDISK structure, falling back to normal extraction"
@@ -315,6 +319,17 @@ transfer_volume() {
         fi
     fi
     
+
+    # AFTER SLOWDISK_TRANSFORMS: rewrite remaining var/lib/docker/ members onto
+    # the target's real docker root when it is a cross-device symlink (see
+    # docker_root_transform in volume-utils.sh).
+    local _drt
+    _drt=$(docker_root_transform)
+    if [[ -n "$_drt" ]]; then
+        echo "Target /var/lib/docker is a symlink; appending docker-root --transform (after slowdisk)"
+        tar_extract_opts="${tar_extract_opts}${_drt}"
+    fi
+
     # Find an available port
     local port=$(find_available_port)
     if [[ $? -ne 0 ]]; then
@@ -338,12 +353,14 @@ transfer_volume() {
         
         # Start listener in screen session with proper escaping
         # Use tar_extract_opts which may include --skip-old-files for SLOWDISK mode
-        $SSH_CMD "$DEST_HOST" "
-            screen -dmS transfer_${key} bash -c '
-                nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
-                echo \$? > /tmp/transfer_${key}.done
-            '
-        "
+        # Script-file listener: tar_extract_opts may carry quoted --transform args
+        # that no inline bash -c quoting survives (same fix as clone-backup).
+        $SSH_CMD "$DEST_HOST" "cat > /tmp/transfer_${key}.sh && chmod +x /tmp/transfer_${key}.sh" <<LISTENER
+#!/bin/bash
+nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
+echo \$? > /tmp/transfer_${key}.done
+LISTENER
+        $SSH_CMD "$DEST_HOST" "screen -dmS transfer_${key} /tmp/transfer_${key}.sh"
         
         # Give it time to start
         sleep 2
@@ -359,13 +376,12 @@ transfer_volume() {
         
         # Use nohup with proper backgrounding
         # Use tar_extract_opts which may include --skip-old-files for SLOWDISK mode
-        $SSH_CMD "$DEST_HOST" "
-            nohup bash -c '
-                nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
-                echo \$? > /tmp/transfer_${key}.done
-            ' > /tmp/transfer_${key}.log 2>&1 < /dev/null &
-            echo \$! > /tmp/transfer_${key}.pid
-        "
+        $SSH_CMD "$DEST_HOST" "cat > /tmp/transfer_${key}.sh && chmod +x /tmp/transfer_${key}.sh" <<LISTENER
+#!/bin/bash
+nc -l -p $port | zstd -d | tar $tar_extract_opts 2>/tmp/transfer_${key}.err
+echo \$? > /tmp/transfer_${key}.done
+LISTENER
+        $SSH_CMD "$DEST_HOST" "nohup /tmp/transfer_${key}.sh > /tmp/transfer_${key}.log 2>&1 < /dev/null & echo \$! > /tmp/transfer_${key}.pid"
         
         sleep 2
         
@@ -479,7 +495,7 @@ transfer_volume_ssh() {
                     if setup_slowdisk_structure "$key" "$static_size_kb" "${static_paths[@]}"; then
                         # and --keep-directory-symlink so tar extracts THROUGH the pre-created dir symlinks
                         # instead of trying to mkdir over them (which fails with 'Cannot mkdir: File exists')
-                        tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink"
+                        tar_extract_opts="-xf - -C / --skip-old-files --keep-directory-symlink${SLOWDISK_TRANSFORMS}"
                         echo "SLOWDISK structure ready, will extract respecting symlinks"
                     else
                         echo "Warning: Failed to setup SLOWDISK structure, falling back to normal extraction"
@@ -495,6 +511,17 @@ transfer_volume_ssh() {
         fi
     fi
     
+
+    # AFTER SLOWDISK_TRANSFORMS: rewrite remaining var/lib/docker/ members onto
+    # the target's real docker root when it is a cross-device symlink (see
+    # docker_root_transform in volume-utils.sh).
+    local _drt
+    _drt=$(docker_root_transform)
+    if [[ -n "$_drt" ]]; then
+        echo "Target /var/lib/docker is a symlink; appending docker-root --transform (after slowdisk)"
+        tar_extract_opts="${tar_extract_opts}${_drt}"
+    fi
+
     echo "Using direct SSH transfer for $key (size: $((folder_size / 1048576))MB)"
     
     tar -cf - --dereference "$source_folder" 2>/dev/null | \

connect-peers.sh

@@ -9,6 +9,11 @@
 #   target-compose-file: Optional. If provided, use this compose file for target node
 #                        If not provided, use the same compose file for both source and target
 #
+# Secondary seed (optional): --seed-bootstrap pulls third-party enodes from the
+# public bootstrap API (https://stakesquid.eu/bootstrap/<network>.json) into the
+# source node after the pairwise connect — same JSON customers use; own peerset
+# remains primary via peer-reinject.sh / peer-capture.
+#
 # Exit codes:
 #   0 - At least one node connected successfully (bidirectional or one-way)
 #   1 - Failed to connect to both nodes (see output for details)
@@ -65,6 +70,7 @@ fi
 
 TIMEOUT=5
 DRY_RUN=false
+SEED_BOOTSTRAP=false
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
@@ -76,6 +82,10 @@ while [[ $# -gt 0 ]]; do
             DRY_RUN=true
             shift
             ;;
+        --seed-bootstrap)
+            SEED_BOOTSTRAP=true
+            shift
+            ;;
         *)
             echo "Unknown option: $1"
             usage
@@ -313,7 +323,9 @@ detect_client_type() {
     local node_name="$1"
     local name_lower=$(echo "$node_name" | tr '[:upper:]' '[:lower:]')
     
-    if [[ "$name_lower" == *"geth"* ]]; then
+    if [[ "$name_lower" == *"op-geth"* ]]; then
+        echo "op-geth"
+    elif [[ "$name_lower" == *"geth"* ]]; then
         echo "geth"
     elif [[ "$name_lower" == *"reth"* ]]; then
         echo "reth"
@@ -341,7 +353,7 @@ add_static_peer() {
         # Geth supports admin_addStaticPeer
         method="admin_addStaticPeer"
     else
-        # Reth and most other clients use admin_addPeer
+        # Reth, op-geth, and most other clients use admin_addPeer
         method="admin_addPeer"
     fi
     
@@ -600,6 +612,30 @@ fi
 echo -e "${CYAN}--- Summary ---${NC}"
 echo ""
 
+# Optional secondary seed from public bootstrap list (after pairwise connect).
+if [[ "$SEED_BOOTSTRAP" == true ]]; then
+    echo -e "${CYAN}--- Bootstrap secondary seed ---${NC}"
+    if [[ -x "$BASEPATH/bootstrap-peers.sh" ]]; then
+        if [[ "$DRY_RUN" == true ]]; then
+            "$BASEPATH/bootstrap-peers.sh" --from-compose "$COMPOSE_FILE" --dry-run || true
+        else
+            mapfile -t BOOT_ENODES < <("$BASEPATH/bootstrap-peers.sh" --from-compose "$COMPOSE_FILE" 2>/dev/null | grep -E '^enode://' | head -n 25 || true)
+            BOOT_OK=0
+            for be in "${BOOT_ENODES[@]:-}"; do
+                [[ -z "$be" ]] && continue
+                RESULT=$(add_static_peer "$SOURCE_URL" "$be" "$SOURCE_CLIENT")
+                if check_rpc_success "$RESULT"; then
+                    BOOT_OK=$((BOOT_OK + 1))
+                fi
+            done
+            echo -e "  Added ${GREEN}${BOOT_OK}${NC}/${#BOOT_ENODES[@]} bootstrap enodes to source"
+        fi
+    else
+        echo -e "${YELLOW}bootstrap-peers.sh not found — skip${NC}"
+    fi
+    echo ""
+fi
+
 if [[ "$DRY_RUN" == true ]]; then
     echo -e "${GREEN}Dry run completed - no changes made${NC}"
     echo ""

core/core/core-buffalo-core-pruned-pebble-path.yml

@@ -115,7 +115,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: core-testnet
+    chain:
     method-groups:
       enabled:
         - debug

core/core/core-pigeon-core-pruned-pebble-path.yml

@@ -115,7 +115,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: core-pigeon
+    chain: core-testnet
     method-groups:
       enabled:
         - debug

cosmos/gaiad/cosmos-mainnet-gaiad-pruned.yml

@@ -35,7 +35,7 @@ services:
       dockerfile: cometbft.Dockerfile
       args:
         CL_IMAGE: ${COSMOS_GAIAD_IMAGE:-ghcr.io/cosmos/gaia}
-        CL_VERSION: ${COSMOS_MAINNET_GAIAD_VERSION:-v27.4.0}
+        CL_VERSION: ${COSMOS_MAINNET_GAIAD_VERSION:-v27.5.0}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

cronos-zkevm/external-node/cronos-zkevm-mainnet-external-node-archive.yml

@@ -33,7 +33,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   cronos-zkevm-mainnet-archive:
-    image: ${CRONOS_ZKEVM_EXTERNAL_NODE_IMAGE:-ghcr.io/cronos-labs/external-node}:${CRONOS_ZKEVM_MAINNET_EXTERNAL_NODE_VERSION:-v31.0.0}
+    image: ${CRONOS_ZKEVM_EXTERNAL_NODE_IMAGE:-ghcr.io/cronos-labs/external-node}:${CRONOS_ZKEVM_MAINNET_EXTERNAL_NODE_VERSION:-v31.3.0}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

cronos-zkevm/external-node/cronos-zkevm-mainnet-external-node-pruned.yml

@@ -33,7 +33,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   cronos-zkevm-mainnet:
-    image: ${CRONOS_ZKEVM_EXTERNAL_NODE_IMAGE:-ghcr.io/cronos-labs/external-node}:${CRONOS_ZKEVM_MAINNET_EXTERNAL_NODE_VERSION:-v31.0.0}
+    image: ${CRONOS_ZKEVM_EXTERNAL_NODE_IMAGE:-ghcr.io/cronos-labs/external-node}:${CRONOS_ZKEVM_MAINNET_EXTERNAL_NODE_VERSION:-v31.3.0}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

cronos-zkevm/external-node/cronos-zkevm-testnet-external-node-archive.yml

@@ -33,7 +33,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   cronos-zkevm-testnet-archive:
-    image: ${CRONOS_ZKEVM_EXTERNAL_NODE_IMAGE:-ghcr.io/cronos-labs/external-node}:${CRONOS_ZKEVM_TESTNET_EXTERNAL_NODE_VERSION:-v31.0.0}
+    image: ${CRONOS_ZKEVM_EXTERNAL_NODE_IMAGE:-ghcr.io/cronos-labs/external-node}:${CRONOS_ZKEVM_TESTNET_EXTERNAL_NODE_VERSION:-v31.3.0}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

cronos-zkevm/external-node/cronos-zkevm-testnet-external-node-pruned.yml

@@ -33,7 +33,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   cronos-zkevm-testnet:
-    image: ${CRONOS_ZKEVM_EXTERNAL_NODE_IMAGE:-ghcr.io/cronos-labs/external-node}:${CRONOS_ZKEVM_TESTNET_EXTERNAL_NODE_VERSION:-v31.0.0}
+    image: ${CRONOS_ZKEVM_EXTERNAL_NODE_IMAGE:-ghcr.io/cronos-labs/external-node}:${CRONOS_ZKEVM_TESTNET_EXTERNAL_NODE_VERSION:-v31.3.0}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

cronos/cometbft.Dockerfile

@@ -7,8 +7,12 @@ FROM alpine:3.21
 RUN apk add --no-cache ca-certificates curl jq
 
 ARG CRONOS_CRONOS_VERSION
+# Version may carry a "-testnet" suffix (e.g. v1.7.8-testnet): the release TAG is the
+# base version, the ASSET keeps the suffix (testnet builds use tcrc bech32 prefixes -
+# a mainnet binary cannot parse testnet validator addresses).
 RUN _ver="${CRONOS_CRONOS_VERSION#v}" && \
-    curl -fsSL "https://github.com/crypto-org-chain/cronos/releases/download/${CRONOS_CRONOS_VERSION}/cronos_${_ver}_Linux_x86_64.tar.gz" \
+    _tag="v${_ver%-testnet}" && \
+    curl -fsSL "https://github.com/crypto-org-chain/cronos/releases/download/${_tag}/cronos_${_ver}_Linux_x86_64.tar.gz" \
       -o /tmp/cronos.tar.gz && \
     tar -xzf /tmp/cronos.tar.gz -C /tmp && \
     install -m 755 /tmp/bin/cronosd /usr/local/bin/cronosd && \

cronos/cronos/cronos-testnet-cronos-pruned.yml

@@ -0,0 +1,138 @@
+---
+x-logging-defaults: &logging-defaults
+  driver: json-file
+  options:
+    max-size: "512m"
+    max-file: "2"
+
+# Usage:
+#
+# mkdir rpc && cd rpc
+#
+# git init
+# git remote add origin https://github.com/StakeSquid/ethereum-rpc-docker.git
+# git fetch origin vibe
+# git checkout origin/vibe
+#
+# docker run --rm alpine sh -c "printf '0x'; head -c32 /dev/urandom | xxd -p -c 64" > .jwtsecret
+#
+# env
+# ...
+# IP=$(curl ipinfo.io/ip)
+# DOMAIN=${IP}.traefik.me
+# COMPOSE_FILE=base.yml:rpc.yml:cronos/cronos/cronos-testnet-cronos-pruned.yml
+#
+# docker compose up -d
+#
+# curl -X POST https://${IP}.traefik.me/cronos-testnet \
+#   -H "Content-Type: application/json" \
+#   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
+
+services:
+  cronos-testnet:
+    build:
+      context: ./cronos
+      dockerfile: cometbft.Dockerfile
+      args:
+        CRONOS_CRONOS_VERSION: ${CRONOS_TESTNET_CRONOS_VERSION:-v1.7.8-testnet}
+    sysctls:
+      # TCP Performance
+      net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
+      net.ipv4.tcp_no_metrics_save: 1             # Disable metrics cache
+      net.ipv4.tcp_rmem: 4096 87380 16777216      # Increase TCP read buffers
+      net.ipv4.tcp_wmem: 4096 87380 16777216      # Increase TCP write buffers
+      net.core.somaxconn: 32768                   # Higher connection queue
+      # Memory/Connection Management
+      # net.core.netdev_max_backlog: 50000          # Increase network buffer
+      net.ipv4.tcp_max_syn_backlog: 30000         # More SYN requests
+      net.ipv4.tcp_max_tw_buckets: 2000000        # Allow more TIME_WAIT sockets
+    ulimits:
+      nofile: 1048576    # Max open files (for RPC/WS connections)
+    user: root
+    ports:
+      - 10521:10521
+      - 10521:10521/udp
+    expose:
+      - 8545
+      - 8546
+      - 6066
+      - 26657
+    environment:
+      - API=eth,txpool,net,debug,web3
+      - CHAINID=cronostestnet_338-3
+      - EVM_MAX_TX_GAS_WANTED=500000
+      - GENESIS_URL=https://raw.githubusercontent.com/crypto-org-chain/cronos-testnets/main/cronostestnet_338-3/genesis.json
+      - IP=${IP}
+      - JSON_RPC_BLOCK_RANGE_CAP=10000
+      - JSON_RPC_ENABLE=true
+      - JSON_RPC_ENABLE_INDEXER=true
+      - JSON_RPC_FEEHISTORY_CAP=100
+      - JSON_RPC_HTTP_TIMEOUT=30s
+      - JSON_RPC_LOGS_CAP=10000
+      - MIN_GAS=5000000000000basetcro
+      - MONIKER=d${DOMAIN:-local}
+      - P2P_PORT=10521
+      - PRUNING=custom
+      - PRUNING_INTERVAL=19
+      - PRUNING_KEEP_RECENT=100
+      - SEEDS=8fcba3485c67a2a00a383b6f45660a4ac529c6ca@52.77.30.18:26656,e65199bc579ffd89d7c021c5611f9f1c97f7ff13@54.251.209.254:26656,b8e6d6e16d236fa6a7101316d96de718200c500c@bd-cronos-testnet-seed-node-01.bdnodes.net:26656
+      - STATESYNC_RPC=https://rpc-t3.cronos.org:443
+    restart: unless-stopped
+    stop_grace_period: 5m
+    networks:
+      - chains
+    volumes:
+      - ${CRONOS_TESTNET_CRONOS_PRUNED_DATA:-cronos-testnet-cronos-pruned}:/root/.cronos/data
+      - /slowdisk:/slowdisk
+      - cronos-testnet-cronos-pruned_config:/root/.cronos/config
+    logging: *logging-defaults
+    labels:
+      - prometheus-scrape.enabled=true
+      - prometheus-scrape.port=6066
+      - prometheus-scrape.path=/metrics
+      - traefik.enable=true
+      - traefik.http.middlewares.cronos-testnet-cronos-pruned-stripprefix.stripprefix.prefixes=/cronos-testnet
+      - traefik.http.services.cronos-testnet-cronos-pruned.loadbalancer.server.port=8545
+      - ${NO_SSL:-traefik.http.routers.cronos-testnet-cronos-pruned.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.cronos-testnet-cronos-pruned.tls.certresolver=myresolver}
+      - ${NO_SSL:-traefik.http.routers.cronos-testnet-cronos-pruned.rule=Host(`$DOMAIN`) && (Path(`/cronos-testnet`) || Path(`/cronos-testnet/`))}
+      - ${NO_SSL:+traefik.http.routers.cronos-testnet-cronos-pruned.rule=Path(`/cronos-testnet`) || Path(`/cronos-testnet/`)}
+      - traefik.http.routers.cronos-testnet-cronos-pruned.middlewares=cronos-testnet-cronos-pruned-stripprefix, ipallowlist
+      - traefik.http.routers.cronos-testnet-cronos-pruned.priority=50   # gets any request that is not GET with UPGRADE header
+      - traefik.http.routers.cronos-testnet-cronos-pruned-ws.priority=100   # answers GET requests first
+      - traefik.http.services.cronos-testnet-cronos-pruned-ws.loadbalancer.server.port=8546
+      - traefik.http.routers.cronos-testnet-cronos-pruned-ws.service=cronos-testnet-cronos-pruned-ws
+      - traefik.http.routers.cronos-testnet-cronos-pruned.service=cronos-testnet-cronos-pruned
+      - ${NO_SSL:-traefik.http.routers.cronos-testnet-cronos-pruned-ws.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.cronos-testnet-cronos-pruned-ws.tls.certresolver=myresolver}
+      # case-insensitive Upgrade: python websocket-client sends "WebSocket" (capital W)
+      - ${NO_SSL:-traefik.http.routers.cronos-testnet-cronos-pruned-ws.rule=Host(`$DOMAIN`) && (Path(`/cronos-testnet`) || Path(`/cronos-testnet/`)) && HeadersRegexp(`Upgrade`, `(?i)websocket`)}
+      - ${NO_SSL:+traefik.http.routers.cronos-testnet-cronos-pruned-ws.rule=(Path(`/cronos-testnet`) || Path(`/cronos-testnet/`)) && HeadersRegexp(`Upgrade`, `(?i)websocket`)}
+      - traefik.http.routers.cronos-testnet-cronos-pruned-ws.middlewares=cronos-testnet-cronos-pruned-stripprefix, ipallowlist
+
+volumes:
+  cronos-testnet-cronos-pruned:
+  cronos-testnet-cronos-pruned_config:
+
+x-upstreams:
+  - id: $${ID}
+    labels:
+      provider: $${PROVIDER}
+    connection:
+      generic:
+        rpc:
+          url: $${RPC_URL}
+        ws:
+          frameSize: 20Mb
+          msgSize: 50Mb
+          url: $${WS_URL}
+    chain: cronos-testnet
+    method-groups:
+      enabled:
+        - debug
+        - filter
+    methods:
+      disabled:
+      enabled:
+        - name: txpool_content # TODO: should be disabled for rollup nodes
+...

cronos/scripts/init.sh

@@ -22,6 +22,7 @@ JSON_RPC_FEEHISTORY_CAP="${JSON_RPC_FEEHISTORY_CAP:-100}"
 JSON_RPC_LOGS_CAP="${JSON_RPC_LOGS_CAP:-10000}"
 JSON_RPC_BLOCK_RANGE_CAP="${JSON_RPC_BLOCK_RANGE_CAP:-10000}"
 JSON_RPC_HTTP_TIMEOUT="${JSON_RPC_HTTP_TIMEOUT:-30s}"
+JSON_RPC_WS_ORIGINS="${JSON_RPC_WS_ORIGINS:-*}"
 EVM_MAX_TX_GAS_WANTED="${EVM_MAX_TX_GAS_WANTED:-500000}"
 
 ct_apk curl jq
@@ -42,6 +43,7 @@ sed -i -e "s/^indexer *=.*/indexer = \"null\"/" "$CONFIG_DIR/config.toml"
 
 sed -i "/^\[json-rpc\]/,/^\[/{s|^address = .*|address = \"0.0.0.0:8545\"|}" "$CONFIG_DIR/app.toml"
 sed -i "/^\[json-rpc\]/,/^\[/{s|^ws-address = .*|ws-address = \"0.0.0.0:8546\"|}" "$CONFIG_DIR/app.toml"
+sed -i "/^\[json-rpc\]/,/^\[/{s|^ws-origins = .*|ws-origins = \"$JSON_RPC_WS_ORIGINS\"|}" "$CONFIG_DIR/app.toml"
 sed -i "/^\[json-rpc\]/,/^\[/{s|^api = .*|api = \"$API\"|}" "$CONFIG_DIR/app.toml"
 sed -i "/^\[json-rpc\]/,/^\[/{s|^enable = .*|enable = $JSON_RPC_ENABLE|}" "$CONFIG_DIR/app.toml"
 sed -i "/^\[json-rpc\]/,/^\[/{s|^enable-indexer = .*|enable-indexer = $JSON_RPC_ENABLE_INDEXER|}" "$CONFIG_DIR/app.toml"

digibyte/digibyted.Dockerfile

@@ -1,10 +1,10 @@
 # digibyted — official release tarball (no Docker image upstream).
-ARG VERSION=9.26.4
+ARG VERSION=9.26.5
 
 FROM debian:stable-slim
 
 ARG VERSION
-ARG SHA256=523da7ac9ee0f1bcb38ff75da6f01997b9491a9eee1e2b0ce3c90f60b2aaa9b3
+ARG SHA256=37f6bf6a682f99b5966c2bd3f0cfe3013b60b7b55268958663231ebbf9e56773
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \

digibyte/digibyted/digibyte-mainnet-digibyted-full.yml

@@ -34,7 +34,7 @@ services:
       context: ./digibyte
       dockerfile: digibyted.Dockerfile
       args:
-        VERSION: ${DIGIBYTE_MAINNET_DIGIBYTED_VERSION:-9.26.4}
+        VERSION: ${DIGIBYTE_MAINNET_DIGIBYTED_VERSION:-9.26.5}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

drpc-free.yml

@@ -1,6 +1,6 @@
 services:
   dshackle-free:
-    image: drpcorg/dshackle:0.79.10
+    image: ${DSHACKLE_IMAGE:-stakesquid/dshackle:0.79.11-ss2@sha256:624866381b672e051042f4f383fb19af1d9d4e508929ac92b2d70db3212ead92}
     restart: unless-stopped
     volumes:
       - ./free_configs:/etc/dshackle
@@ -30,7 +30,7 @@ services:
     restart: unless-stopped
     command:
       - "redis-server"
-      - "--maxmemory ${GW_FREE_REDIS_RAM}"
+      - "--maxmemory ${GW_FREE_REDIS_RAM:-512MB}"
       - "--maxmemory-policy allkeys-lru"
       - '--save ""'
     networks:

drpc.yml

@@ -1,12 +1,35 @@
 services:
+  # Streams the dshackle access log (NDJSON, one line per response) to the splits
+  # listener on the insights host. Deliberately decoupled from dshackle via the
+  # file: a dead listener or slow link only ever stalls this sidecar, never the
+  # gateway. tail -F follows logrotate copytruncate; on disconnect the retry
+  # loop resumes at the file END (bounded loss, no duplication floods) — the
+  # per-gateway prometheus-vs-lines reconciliation on the listener side makes
+  # any gap visible within the hour.
+  accesslog-shipper:
+    image: busybox:1.36
+    restart: unless-stopped
+    volumes:
+      - ./dshackle_logs:/logs:ro
+      # sent-line counter: injects __shipstat__ checkpoints into the stream so
+      # the listener cruncher can reconcile shipped-vs-ingested per gateway/hour
+      # (fixes the time-based completeness floor being blind to event-loss-by-
+      # rotation, 2026-07-10). Cruncher MUST filter __shipstat__ from events.
+      - ./accesslog-shipper.awk:/shipper.awk:ro
+    command: >-
+      sh -c 'while true; do
+      tail -F /logs/access_log.jsonl 2>/dev/null | awk -f /shipper.awk | nc ${SPLITS_LISTENER_HOST:-78.47.193.225} ${SPLITS_LISTENER_PORT:-9102};
+      echo shipper lost listener connection, retrying in 10s;
+      sleep 10; done'
+
   dshackle:
-    image: drpcorg/dshackle:0.79.10
+    image: ${DSHACKLE_IMAGE:-stakesquid/dshackle:0.79.11-ss2@sha256:624866381b672e051042f4f383fb19af1d9d4e508929ac92b2d70db3212ead92}
     restart: unless-stopped
     volumes:
       - ./main_configs:/etc/dshackle
       # dshackle accessLog target (main_configs/dshackle.yaml accessLog.filename=/logs/...).
-      # Host-side dir so the splits tailer can aggregate gateway->region request shares
-      # (earnings misattribution fix, operator + claude-machine design 2026-07-09).
+      # Host-side dir so the shipper sidecar above can stream gateway->region request
+      # shares (earnings misattribution fix, operator + claude-machine design 2026-07-09).
       - ./dshackle_logs:/logs
     expose:
       - 8080
@@ -16,6 +39,8 @@ services:
     #  - "2449:2449"
     environment:
       DSHACKLE_LOG_LEVEL: ${DSHACKLE_LOG_LEVEL:-info}
+      # Cap JVM heap (image default is -Xms1024M with no -Xmx).
+      JAVA_OPTS: "-Xms1g -Xmx4g"
     labels:
       - "prometheus-scrape.enabled=true"
       - "prometheus-scrape.port=8081"

erigon3.Dockerfile

@@ -1,6 +1,6 @@
 # syntax = docker/dockerfile:1.2
 ARG REPO=https://github.com/erigontech/erigon.git
-ARG VERSION=v3.4.4
+ARG VERSION=v3.5.3
 ARG COMMIT=${COMMIT:-${VERSION}}
 
 FROM docker.io/library/golang:1.24.1-alpine3.20 AS builder

ethereum/besu/ethereum-mainnet-besu-pruned-bonsai--nimbus.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-mainnet-besu:
-    image: ${ETHEREUM_BESU_IMAGE:-hyperledger/besu}:${ETHEREUM_MAINNET_BESU_VERSION:-26.6.1}
+    image: ${ETHEREUM_BESU_IMAGE:-hyperledger/besu}:${ETHEREUM_MAINNET_BESU_VERSION:-26.7.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -115,7 +115,7 @@ services:
       - traefik.http.routers.ethereum-mainnet-besu-pruned-bonsai-ws.middlewares=ethereum-mainnet-besu-pruned-bonsai-stripprefix, ipallowlist
 
   ethereum-mainnet-besu-node:
-    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.6.2}
+    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.7.0}
     user: root
     ports:
       - 18205:18205
@@ -189,8 +189,15 @@ x-upstreams:
     chain: eth-beacon-chain
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-mainnet-besu-pruned-bonsai_nimbus]
 ...

ethereum/erigon3/ethereum-hoodi-erigon3-archive-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-hoodi-erigon3-archive:
-    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_HOODI_ERIGON3_VERSION:-v3.5.0}
+    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_HOODI_ERIGON3_VERSION:-v3.5.3}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

ethereum/erigon3/ethereum-hoodi-erigon3-minimal-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-hoodi-erigon3-minimal:
-    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_HOODI_ERIGON3_VERSION:-v3.5.0}
+    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_HOODI_ERIGON3_VERSION:-v3.5.3}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

ethereum/erigon3/ethereum-hoodi-erigon3-pruned-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-hoodi-erigon3:
-    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_HOODI_ERIGON3_VERSION:-v3.5.0}
+    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_HOODI_ERIGON3_VERSION:-v3.5.3}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

ethereum/erigon3/ethereum-mainnet-erigon3-archive-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-mainnet-erigon3-archive:
-    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_MAINNET_ERIGON3_VERSION:-v3.5.0}
+    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_MAINNET_ERIGON3_VERSION:-v3.5.3}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

ethereum/erigon3/ethereum-mainnet-erigon3-minimal-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-mainnet-erigon3-minimal:
-    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_MAINNET_ERIGON3_VERSION:-v3.5.0}
+    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_MAINNET_ERIGON3_VERSION:-v3.5.3}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

ethereum/erigon3/ethereum-mainnet-erigon3-pruned-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-mainnet-erigon3:
-    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_MAINNET_ERIGON3_VERSION:-v3.5.0}
+    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_MAINNET_ERIGON3_VERSION:-v3.5.3}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

ethereum/erigon3/ethereum-sepolia-erigon3-archive-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-sepolia-erigon3-archive:
-    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_SEPOLIA_ERIGON3_VERSION:-v3.5.0}
+    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_SEPOLIA_ERIGON3_VERSION:-v3.5.3}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

ethereum/erigon3/ethereum-sepolia-erigon3-minimal-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-sepolia-erigon3-minimal:
-    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_SEPOLIA_ERIGON3_VERSION:-v3.5.0}
+    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_SEPOLIA_ERIGON3_VERSION:-v3.5.3}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

ethereum/erigon3/ethereum-sepolia-erigon3-pruned-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-sepolia-erigon3:
-    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_SEPOLIA_ERIGON3_VERSION:-v3.5.0}
+    image: ${ETHEREUM_ERIGON3_IMAGE:-erigontech/erigon}:${ETHEREUM_SEPOLIA_ERIGON3_VERSION:-v3.5.3}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle

ethereum/geth/ethereum-hoodi-geth-pruned-pebble-path--nimbus.yml

@@ -103,7 +103,7 @@ services:
       - traefik.http.routers.ethereum-hoodi-geth-pruned-pebble-path.middlewares=ethereum-hoodi-geth-pruned-pebble-path-stripprefix, ipallowlist
 
   ethereum-hoodi-geth-node:
-    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_HOODI_NIMBUS_VERSION:-multiarch-v26.6.2}
+    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_HOODI_NIMBUS_VERSION:-multiarch-v26.7.0}
     user: root
     ports:
       - 16917:16917
@@ -195,8 +195,15 @@ x-upstreams:
     chain: eth-beacon-chain-hoodi
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-hoodi-geth-pruned-pebble-path_nimbus]
 ...

ethereum/geth/ethereum-hoodi-geth-pruned-pebble-path.yml

@@ -103,7 +103,7 @@ services:
       - traefik.http.routers.ethereum-hoodi-geth-pruned-pebble-path.middlewares=ethereum-hoodi-geth-pruned-pebble-path-stripprefix, ipallowlist
 
   ethereum-hoodi-geth-node:
-    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_HOODI_PRYSM_VERSION:-v7.1.4}
+    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_HOODI_PRYSM_VERSION:-v7.1.7}
     ports:
       - 16917:16917
       - 16917:16917/udp
@@ -196,8 +196,15 @@ x-upstreams:
     chain: eth-beacon-chain-hoodi
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-hoodi-geth-pruned-pebble-path_prysm]
 ...

ethereum/geth/ethereum-mainnet-geth-minimal-pebble-path.yml

@@ -107,7 +107,7 @@ services:
       - traefik.http.routers.ethereum-mainnet-geth-minimal-pebble-path.middlewares=ethereum-mainnet-geth-minimal-pebble-path-stripprefix, ipallowlist
 
   ethereum-mainnet-geth-minimal-node:
-    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_MAINNET_PRYSM_VERSION:-v7.1.6}
+    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_MAINNET_PRYSM_VERSION:-v7.1.7}
     ports:
       - 19551:19551
       - 19551:19551/udp
@@ -200,8 +200,15 @@ x-upstreams:
     chain: eth-beacon-chain
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-mainnet-geth-minimal-pebble-path_prysm]
 ...

ethereum/geth/ethereum-mainnet-geth-pruned-leveldb-hash--nimbus--fireeth.yml

@@ -168,7 +168,7 @@ services:
       - traefik.http.routers.ethereum-mainnet-geth-pruned-leveldb-hash-events.middlewares=ipallowlist
 
   ethereum-mainnet-geth-node:
-    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.6.2}
+    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.7.0}
     user: root
     ports:
       - 15455:15455
@@ -259,8 +259,15 @@ x-upstreams:
     chain: eth-beacon-chain
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-mainnet-geth-pruned-leveldb-hash_nimbus]
 ...

ethereum/geth/ethereum-mainnet-geth-pruned-pebble-path--nimbus--fireeth.yml

@@ -168,7 +168,7 @@ services:
       - traefik.http.routers.ethereum-mainnet-geth-pruned-pebble-path-events.middlewares=ipallowlist
 
   ethereum-mainnet-geth-node:
-    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.6.2}
+    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.7.0}
     user: root
     ports:
       - 17023:17023
@@ -261,8 +261,15 @@ x-upstreams:
     chain: eth-beacon-chain
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-mainnet-geth-pruned-pebble-path_nimbus]
 ...

ethereum/geth/ethereum-mainnet-geth-pruned-pebble-path--nimbus.yml

@@ -103,7 +103,7 @@ services:
       - traefik.http.routers.ethereum-mainnet-geth-pruned-pebble-path.middlewares=ethereum-mainnet-geth-pruned-pebble-path-stripprefix, ipallowlist
 
   ethereum-mainnet-geth-node:
-    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.6.2}
+    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.7.0}
     user: root
     ports:
       - 17023:17023
@@ -195,8 +195,15 @@ x-upstreams:
     chain: eth-beacon-chain
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-mainnet-geth-pruned-pebble-path_nimbus]
 ...

ethereum/geth/ethereum-mainnet-geth-pruned-pebble-path.yml

@@ -103,7 +103,7 @@ services:
       - traefik.http.routers.ethereum-mainnet-geth-pruned-pebble-path.middlewares=ethereum-mainnet-geth-pruned-pebble-path-stripprefix, ipallowlist
 
   ethereum-mainnet-geth-node:
-    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_MAINNET_PRYSM_VERSION:-v7.1.6}
+    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_MAINNET_PRYSM_VERSION:-v7.1.7}
     ports:
       - 17023:17023
       - 17023:17023/udp
@@ -196,8 +196,15 @@ x-upstreams:
     chain: eth-beacon-chain
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-mainnet-geth-pruned-pebble-path_prysm]
 ...

ethereum/geth/ethereum-sepolia-geth-pruned-pebble-path--nimbus.yml

@@ -103,7 +103,7 @@ services:
       - traefik.http.routers.ethereum-sepolia-geth-pruned-pebble-path.middlewares=ethereum-sepolia-geth-pruned-pebble-path-stripprefix, ipallowlist
 
   ethereum-sepolia-geth-node:
-    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_SEPOLIA_NIMBUS_VERSION:-multiarch-v26.6.2}
+    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_SEPOLIA_NIMBUS_VERSION:-multiarch-v26.7.0}
     user: root
     ports:
       - 19710:19710
@@ -195,8 +195,15 @@ x-upstreams:
     chain: eth-beacon-chain-sepolia
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-sepolia-geth-pruned-pebble-path_nimbus]
 ...

ethereum/geth/ethereum-sepolia-geth-pruned-pebble-path.yml

@@ -103,7 +103,7 @@ services:
       - traefik.http.routers.ethereum-sepolia-geth-pruned-pebble-path.middlewares=ethereum-sepolia-geth-pruned-pebble-path-stripprefix, ipallowlist
 
   ethereum-sepolia-geth-node:
-    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_SEPOLIA_PRYSM_VERSION:-v7.1.4}
+    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_SEPOLIA_PRYSM_VERSION:-v7.1.7}
     ports:
       - 19710:19710
       - 19710:19710/udp
@@ -196,8 +196,15 @@ x-upstreams:
     chain: eth-beacon-chain-sepolia
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-sepolia-geth-pruned-pebble-path_prysm]
 ...

ethereum/nethermind/ethereum-hoodi-nethermind-pruned-rocksdb-trace--nimbus.yml

@@ -20,17 +20,17 @@ x-logging-defaults: &logging-defaults
 # ...
 # IP=$(curl ipinfo.io/ip)
 # DOMAIN=${IP}.traefik.me
-# COMPOSE_FILE=base.yml:rpc.yml:ethereum/nethermind/ethereum-hoodie-nethermind-pruned-rocksdb-trace--nimbus.yml
+# COMPOSE_FILE=base.yml:rpc.yml:ethereum/nethermind/ethereum-hoodi-nethermind-pruned-rocksdb-trace--nimbus.yml
 #
 # docker compose up -d
 #
-# curl -X POST https://${IP}.traefik.me/ethereum-hoodie-nethermind \
+# curl -X POST https://${IP}.traefik.me/ethereum-hoodi-nethermind \
 #   -H "Content-Type: application/json" \
 #   --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}'
 
 services:
-  ethereum-hoodie-nethermind:
-    image: ${ETHEREUM_NETHERMIND_IMAGE:-nethermind/nethermind}:${ETHEREUM_HOODIE_NETHERMIND_VERSION:-1.37.2}
+  ethereum-hoodi-nethermind:
+    image: ${ETHEREUM_NETHERMIND_IMAGE:-nethermind/nethermind}:${ETHEREUM_HOODI_NETHERMIND_VERSION:-1.39.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -46,13 +46,13 @@ services:
       nofile: 1048576    # Max open files (for RPC/WS connections)
     user: root
     ports:
-      - 11214:11214
-      - 11214:11214/udp
+      - 10786:10786
+      - 10786:10786/udp
     expose:
       - 8545
       - 9091
     environment:
-      - NETHERMIND_CONFIG=hoodie
+      - NETHERMIND_CONFIG=hoodi
       - NETHERMIND_INITCONFIG_BASEDBPATH=/data/db
       - NETHERMIND_INITCONFIG_LOGDIRECTORY=/data/logs
       - NETHERMIND_INITCONFIG_WEBSOCKETSENABLED=true
@@ -65,10 +65,10 @@ services:
       - NETHERMIND_JSONRPCCONFIG_PORT=8545
       - NETHERMIND_JSONRPCCONFIG_WEBSOCKETSPORT=8545
       - NETHERMIND_METRICSCONFIG_EXPOSEPORT=9091
-      - NETHERMIND_NETWORKCONFIG_DISCOVERYPORT=11214
+      - NETHERMIND_NETWORKCONFIG_DISCOVERYPORT=10786
       - NETHERMIND_NETWORKCONFIG_EXTERNALIP=${IP}
       - NETHERMIND_NETWORKCONFIG_MAXACTIVEPEERS=250
-      - NETHERMIND_NETWORKCONFIG_P2PPORT=11214
+      - NETHERMIND_NETWORKCONFIG_P2PPORT=10786
       - NETHERMIND_TRACESTORECONFIG_ENABLED=true
       - NETHERMIND_TRACESTORECONFIG_TRACETYPES=Trace,Rewards
     restart: unless-stopped
@@ -76,7 +76,7 @@ services:
     networks:
       - chains
     volumes:
-      - ${ETHEREUM_HOODIE_NETHERMIND_PRUNED_ROCKSDB_TRACE_DATA:-ethereum-hoodie-nethermind-pruned-rocksdb-trace}:/data
+      - ${ETHEREUM_HOODI_NETHERMIND_PRUNED_ROCKSDB_TRACE_DATA:-ethereum-hoodi-nethermind-pruned-rocksdb-trace}:/data
       - .jwtsecret:/jwtsecret:ro
       - /slowdisk:/slowdisk
     logging: *logging-defaults
@@ -85,45 +85,45 @@ services:
       - prometheus-scrape.port=9091
       - prometheus-scrape.path=/metrics
       - traefik.enable=true
-      - traefik.http.middlewares.ethereum-hoodie-nethermind-pruned-rocksdb-trace-stripprefix.stripprefix.prefixes=/ethereum-hoodie-nethermind
-      - traefik.http.services.ethereum-hoodie-nethermind-pruned-rocksdb-trace.loadbalancer.server.port=8545
-      - ${NO_SSL:-traefik.http.routers.ethereum-hoodie-nethermind-pruned-rocksdb-trace.entrypoints=websecure}
-      - ${NO_SSL:-traefik.http.routers.ethereum-hoodie-nethermind-pruned-rocksdb-trace.tls.certresolver=myresolver}
-      - ${NO_SSL:-traefik.http.routers.ethereum-hoodie-nethermind-pruned-rocksdb-trace.rule=Host(`$DOMAIN`) && (Path(`/ethereum-hoodie-nethermind`) || Path(`/ethereum-hoodie-nethermind/`))}
-      - ${NO_SSL:+traefik.http.routers.ethereum-hoodie-nethermind-pruned-rocksdb-trace.rule=Path(`/ethereum-hoodie-nethermind`) || Path(`/ethereum-hoodie-nethermind/`)}
-      - traefik.http.routers.ethereum-hoodie-nethermind-pruned-rocksdb-trace.middlewares=ethereum-hoodie-nethermind-pruned-rocksdb-trace-stripprefix, ipallowlist
+      - traefik.http.middlewares.ethereum-hoodi-nethermind-pruned-rocksdb-trace-stripprefix.stripprefix.prefixes=/ethereum-hoodi-nethermind
+      - traefik.http.services.ethereum-hoodi-nethermind-pruned-rocksdb-trace.loadbalancer.server.port=8545
+      - ${NO_SSL:-traefik.http.routers.ethereum-hoodi-nethermind-pruned-rocksdb-trace.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.ethereum-hoodi-nethermind-pruned-rocksdb-trace.tls.certresolver=myresolver}
+      - ${NO_SSL:-traefik.http.routers.ethereum-hoodi-nethermind-pruned-rocksdb-trace.rule=Host(`$DOMAIN`) && (Path(`/ethereum-hoodi-nethermind`) || Path(`/ethereum-hoodi-nethermind/`))}
+      - ${NO_SSL:+traefik.http.routers.ethereum-hoodi-nethermind-pruned-rocksdb-trace.rule=Path(`/ethereum-hoodi-nethermind`) || Path(`/ethereum-hoodi-nethermind/`)}
+      - traefik.http.routers.ethereum-hoodi-nethermind-pruned-rocksdb-trace.middlewares=ethereum-hoodi-nethermind-pruned-rocksdb-trace-stripprefix, ipallowlist
 
-  ethereum-hoodie-nethermind-node:
-    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_HOODIE_NIMBUS_VERSION:-multiarch-v26.6.2}
+  ethereum-hoodi-nethermind-node:
+    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_HOODI_NIMBUS_VERSION:-multiarch-v26.7.0}
     user: root
     ports:
-      - 16214:16214
-      - 16214:16214/udp
+      - 15786:15786
+      - 15786:15786/udp
     expose:
       - 3500
-    entrypoint: /bin/sh -c '/home/user/nimbus-eth2/build/nimbus_beacon_node trustedNodeSync --network=hoodie --trusted-node-url= --backfill=false; exec /home/user/nimbus-eth2/build/nimbus_beacon_node "$@"' --
+    entrypoint: /bin/sh -c '/home/user/nimbus-eth2/build/nimbus_beacon_node trustedNodeSync --network=hoodi --trusted-node-url=https://beaconstate-hoodi.chainsafe.io --backfill=false; exec /home/user/nimbus-eth2/build/nimbus_beacon_node "$@"' --
     command:
       - --history=prune
       - --jwt-secret=/jwtsecret
       - --metrics-address=0.0.0.0
       - --metrics-port=8008
       - --nat=extip:${IP}
-      - --network=hoodie
+      - --network=hoodi
       - --rest
       - --rest-address=0.0.0.0
       - --rest-port=3500
-      - --tcp-port=16214
-      - --udp-port=16214
-      - --web3-url=http://ethereum-hoodie-nethermind:8551
+      - --tcp-port=15786
+      - --udp-port=15786
+      - --web3-url=http://ethereum-hoodi-nethermind:8551
     restart: unless-stopped
     depends_on:
-      ethereum-hoodie-nethermind:
+      ethereum-hoodi-nethermind:
         condition: service_started
         restart: true
     networks:
       - chains
     volumes:
-      - ${ETHEREUM_HOODIE_NETHERMIND_PRUNED_ROCKSDB_TRACE__NIMBUS_DATA:-ethereum-hoodie-nethermind-pruned-rocksdb-trace_nimbus}:/root/.cache/nimbus/BeaconNode
+      - ${ETHEREUM_HOODI_NETHERMIND_PRUNED_ROCKSDB_TRACE__NIMBUS_DATA:-ethereum-hoodi-nethermind-pruned-rocksdb-trace_nimbus}:/root/.cache/nimbus/BeaconNode
       - .jwtsecret:/jwtsecret:ro
     logging: *logging-defaults
     labels:
@@ -131,17 +131,17 @@ services:
       - prometheus-scrape.port=8008
       - prometheus-scrape.path=/metrics
       - traefik.enable=true
-      - traefik.http.middlewares.ethereum-hoodie-nethermind-pruned-rocksdb-trace-node-stripprefix.stripprefix.prefixes=/ethereum-hoodie-nethermind
-      - traefik.http.services.ethereum-hoodie-nethermind-pruned-rocksdb-trace-node.loadbalancer.server.port=3500
-      - ${NO_SSL:-traefik.http.routers.ethereum-hoodie-nethermind-pruned-rocksdb-trace-node.entrypoints=websecure}
-      - ${NO_SSL:-traefik.http.routers.ethereum-hoodie-nethermind-pruned-rocksdb-trace-node.tls.certresolver=myresolver}
-      - ${NO_SSL:-traefik.http.routers.ethereum-hoodie-nethermind-pruned-rocksdb-trace-node.rule=Host(`$DOMAIN`) && PathPrefix(`/ethereum-hoodie-nethermind/eth`)}
-      - ${NO_SSL:+traefik.http.routers.ethereum-hoodie-nethermind-pruned-rocksdb-trace-node.rule=PathPrefix(`/ethereum-hoodie-nethermind/eth`)}
-      - traefik.http.routers.ethereum-hoodie-nethermind-pruned-rocksdb-trace-node.middlewares=ethereum-hoodie-nethermind-pruned-rocksdb-trace-node-stripprefix, ipallowlist
+      - traefik.http.middlewares.ethereum-hoodi-nethermind-pruned-rocksdb-trace-node-stripprefix.stripprefix.prefixes=/ethereum-hoodi-nethermind
+      - traefik.http.services.ethereum-hoodi-nethermind-pruned-rocksdb-trace-node.loadbalancer.server.port=3500
+      - ${NO_SSL:-traefik.http.routers.ethereum-hoodi-nethermind-pruned-rocksdb-trace-node.entrypoints=websecure}
+      - ${NO_SSL:-traefik.http.routers.ethereum-hoodi-nethermind-pruned-rocksdb-trace-node.tls.certresolver=myresolver}
+      - ${NO_SSL:-traefik.http.routers.ethereum-hoodi-nethermind-pruned-rocksdb-trace-node.rule=Host(`$DOMAIN`) && PathPrefix(`/ethereum-hoodi-nethermind/eth`)}
+      - ${NO_SSL:+traefik.http.routers.ethereum-hoodi-nethermind-pruned-rocksdb-trace-node.rule=PathPrefix(`/ethereum-hoodi-nethermind/eth`)}
+      - traefik.http.routers.ethereum-hoodi-nethermind-pruned-rocksdb-trace-node.middlewares=ethereum-hoodi-nethermind-pruned-rocksdb-trace-node-stripprefix, ipallowlist
 
 volumes:
-  ethereum-hoodie-nethermind-pruned-rocksdb-trace:
-  ethereum-hoodie-nethermind-pruned-rocksdb-trace_nimbus:
+  ethereum-hoodi-nethermind-pruned-rocksdb-trace:
+  ethereum-hoodi-nethermind-pruned-rocksdb-trace_nimbus:
 
 x-upstreams:
   - id: $${ID}
@@ -155,7 +155,7 @@ x-upstreams:
           frameSize: 20Mb
           msgSize: 50Mb
           url: $${WS_URL}
-    chain: ethereum
+    chain: hoodi
     method-groups:
       enabled:
         - debug
@@ -166,11 +166,18 @@ x-upstreams:
       enabled:
         - name: txpool_content # TODO: should be disabled for rollup nodes
   - id: $${ID}-beacon-chain
-    chain: eth-beacon-chain-hoodie
+    chain: eth-beacon-chain-hoodi
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-hoodi-nethermind-pruned-rocksdb-trace_nimbus]
 ...

ethereum/nethermind/ethereum-mainnet-nethermind-pruned-rocksdb-trace--nimbus.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-mainnet-nethermind:
-    image: ${ETHEREUM_NETHERMIND_IMAGE:-nethermind/nethermind}:${ETHEREUM_MAINNET_NETHERMIND_VERSION:-1.37.2}
+    image: ${ETHEREUM_NETHERMIND_IMAGE:-nethermind/nethermind}:${ETHEREUM_MAINNET_NETHERMIND_VERSION:-1.39.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -94,7 +94,7 @@ services:
       - traefik.http.routers.ethereum-mainnet-nethermind-pruned-rocksdb-trace.middlewares=ethereum-mainnet-nethermind-pruned-rocksdb-trace-stripprefix, ipallowlist
 
   ethereum-mainnet-nethermind-node:
-    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.6.2}
+    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.7.0}
     user: root
     ports:
       - 17065:17065
@@ -169,8 +169,15 @@ x-upstreams:
     chain: eth-beacon-chain
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-mainnet-nethermind-pruned-rocksdb-trace_nimbus]
 ...

ethereum/nethermind/ethereum-sepolia-nethermind-pruned-rocksdb-trace--nimbus.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-sepolia-nethermind:
-    image: ${ETHEREUM_NETHERMIND_IMAGE:-nethermind/nethermind}:${ETHEREUM_SEPOLIA_NETHERMIND_VERSION:-1.37.2}
+    image: ${ETHEREUM_NETHERMIND_IMAGE:-nethermind/nethermind}:${ETHEREUM_SEPOLIA_NETHERMIND_VERSION:-1.39.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -94,7 +94,7 @@ services:
       - traefik.http.routers.ethereum-sepolia-nethermind-pruned-rocksdb-trace.middlewares=ethereum-sepolia-nethermind-pruned-rocksdb-trace-stripprefix, ipallowlist
 
   ethereum-sepolia-nethermind-node:
-    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_SEPOLIA_NIMBUS_VERSION:-multiarch-v26.6.2}
+    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_SEPOLIA_NIMBUS_VERSION:-multiarch-v26.7.0}
     user: root
     ports:
       - 15835:15835
@@ -169,8 +169,15 @@ x-upstreams:
     chain: eth-beacon-chain-sepolia
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-sepolia-nethermind-pruned-rocksdb-trace_nimbus]
 ...

ethereum/reth/ethereum-hoodi-reth-archive-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-hoodi-reth:
-    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_HOODI_RETH_VERSION:-v2.1.0}
+    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_HOODI_RETH_VERSION:-v2.4.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -108,7 +108,7 @@ services:
     shm_size: 2gb
 
   ethereum-hoodi-reth-node:
-    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_HOODI_PRYSM_VERSION:-v7.1.4}
+    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_HOODI_PRYSM_VERSION:-v7.1.7}
     ports:
       - 15606:15606
       - 15606:15606/udp
@@ -184,8 +184,15 @@ x-upstreams:
     chain: eth-beacon-chain-hoodi
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-hoodi-reth-archive-trace_prysm]
 ...

ethereum/reth/ethereum-hoodi-reth-pruned-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-hoodi-reth-pruned:
-    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_HOODI_RETH_VERSION:-v2.1.0}
+    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_HOODI_RETH_VERSION:-v2.4.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -109,7 +109,7 @@ services:
     shm_size: 2gb
 
   ethereum-hoodi-reth-pruned-node:
-    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_HOODI_PRYSM_VERSION:-v7.1.4}
+    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_HOODI_PRYSM_VERSION:-v7.1.7}
     ports:
       - 17435:17435
       - 17435:17435/udp
@@ -185,8 +185,15 @@ x-upstreams:
     chain: eth-beacon-chain-hoodi
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-hoodi-reth-pruned-trace_prysm]
 ...

ethereum/reth/ethereum-mainnet-reth-archive-trace--lighthouse-pruned-blobs.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-mainnet-reth:
-    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_MAINNET_RETH_VERSION:-v2.1.0}
+    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_MAINNET_RETH_VERSION:-v2.4.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -108,7 +108,7 @@ services:
     shm_size: 2gb
 
   ethereum-mainnet-reth-node:
-    image: ${ETHEREUM_LIGHTHOUSE_IMAGE:-sigp/lighthouse}:${ETHEREUM_MAINNET_LIGHTHOUSE_VERSION:-v8.2.0}
+    image: ${ETHEREUM_LIGHTHOUSE_IMAGE:-sigp/lighthouse}:${ETHEREUM_MAINNET_LIGHTHOUSE_VERSION:-v8.2.1}
     ports:
       - 19563:19563
       - 19563:19563/udp
@@ -191,8 +191,15 @@ x-upstreams:
     chain: eth-beacon-chain
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-mainnet-reth-archive-trace_lighthouse-pruned-blobs]
 ...

ethereum/reth/ethereum-mainnet-reth-archive-trace--nimbus.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-mainnet-reth:
-    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_MAINNET_RETH_VERSION:-v2.1.0}
+    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_MAINNET_RETH_VERSION:-v2.4.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -108,7 +108,7 @@ services:
     shm_size: 2gb
 
   ethereum-mainnet-reth-node:
-    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.6.2}
+    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.7.0}
     user: root
     ports:
       - 19563:19563
@@ -183,8 +183,15 @@ x-upstreams:
     chain: eth-beacon-chain
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-mainnet-reth-archive-trace_nimbus]
 ...

ethereum/reth/ethereum-mainnet-reth-archive-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-mainnet-reth:
-    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_MAINNET_RETH_VERSION:-v2.1.0}
+    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_MAINNET_RETH_VERSION:-v2.4.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -108,7 +108,7 @@ services:
     shm_size: 2gb
 
   ethereum-mainnet-reth-node:
-    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_MAINNET_PRYSM_VERSION:-v7.1.6}
+    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_MAINNET_PRYSM_VERSION:-v7.1.7}
     ports:
       - 19563:19563
       - 19563:19563/udp
@@ -184,8 +184,15 @@ x-upstreams:
     chain: eth-beacon-chain
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-mainnet-reth-archive-trace_prysm]
 ...

ethereum/reth/ethereum-mainnet-reth-minimal-trace--blsync.yml

@@ -33,7 +33,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-mainnet-reth-minimal:
-    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_MAINNET_RETH_VERSION:-v2.1.0}
+    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_MAINNET_RETH_VERSION:-v2.4.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -123,7 +123,7 @@ services:
       - pruning
 
   ethereum-mainnet-reth-minimal-node:
-    image: ${ETHEREUM_BLSYNC_IMAGE:-ethereum/client-go}:${ETHEREUM_MAINNET_BLSYNC_VERSION:-alltools-v1.17.4}
+    image: ${ETHEREUM_BLSYNC_IMAGE:-ethereum/client-go}:${ETHEREUM_MAINNET_BLSYNC_VERSION:-alltools-v1.17.5}
     ports:
       - 19286:19286
       - 19286:19286/udp

ethereum/reth/ethereum-mainnet-reth-minimal-trace--nimbus.yml

@@ -52,7 +52,7 @@ services:
       args:
         LLVM_IMAGE: ${LLVM_IMAGE:-snowstep/llvm}
         LLVM_VERSION: ${LLVM_VERSION:-20250912105042}
-        RETH_VERSION: ${ETHEREUM_MAINNET_RETH_VERSION:-v2.1.0}
+        RETH_VERSION: ${ETHEREUM_MAINNET_RETH_VERSION:-v2.4.1}
         RETH_REPO: ${ETHEREUM_MAINNET_RETH_REPO:-https://github.com/paradigmxyz/reth}
         ARCH_TARGET: ${ARCH_TARGET:-native}
         PROFILE: ${RETH_BUILD_PROFILE:-maxperf}
@@ -145,7 +145,7 @@ services:
       - pruning
 
   ethereum-mainnet-reth-minimal-node:
-    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.6.2}
+    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.7.0}
     user: root
     ports:
       - 19286:19286
@@ -242,8 +242,15 @@ x-upstreams:
     chain: eth-beacon-chain
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-mainnet-reth-minimal-trace_nimbus]
 ...

ethereum/reth/ethereum-mainnet-reth-pruned-trace--lighthouse.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-mainnet-reth-pruned:
-    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_MAINNET_RETH_VERSION:-v2.1.0}
+    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_MAINNET_RETH_VERSION:-v2.4.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -109,7 +109,7 @@ services:
     shm_size: 2gb
 
   ethereum-mainnet-reth-pruned-node:
-    image: ${ETHEREUM_LIGHTHOUSE_IMAGE:-sigp/lighthouse}:${ETHEREUM_MAINNET_LIGHTHOUSE_VERSION:-v8.2.0}
+    image: ${ETHEREUM_LIGHTHOUSE_IMAGE:-sigp/lighthouse}:${ETHEREUM_MAINNET_LIGHTHOUSE_VERSION:-v8.2.1}
     ports:
       - 15150:15150
       - 15150:15150/udp
@@ -190,8 +190,15 @@ x-upstreams:
     chain: eth-beacon-chain
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-mainnet-reth-pruned-trace_lighthouse]
 ...

ethereum/reth/ethereum-mainnet-reth-pruned-trace--nimbus.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-mainnet-reth-pruned:
-    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_MAINNET_RETH_VERSION:-v2.1.0}
+    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_MAINNET_RETH_VERSION:-v2.4.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -109,7 +109,7 @@ services:
     shm_size: 2gb
 
   ethereum-mainnet-reth-pruned-node:
-    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.6.2}
+    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_MAINNET_NIMBUS_VERSION:-multiarch-v26.7.0}
     user: root
     ports:
       - 15150:15150
@@ -184,8 +184,15 @@ x-upstreams:
     chain: eth-beacon-chain
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-mainnet-reth-pruned-trace_nimbus]
 ...

ethereum/reth/ethereum-mainnet-reth-pruned-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-mainnet-reth-pruned:
-    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_MAINNET_RETH_VERSION:-v2.1.0}
+    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_MAINNET_RETH_VERSION:-v2.4.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -109,7 +109,7 @@ services:
     shm_size: 2gb
 
   ethereum-mainnet-reth-pruned-node:
-    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_MAINNET_PRYSM_VERSION:-v7.1.6}
+    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_MAINNET_PRYSM_VERSION:-v7.1.7}
     ports:
       - 15150:15150
       - 15150:15150/udp
@@ -185,8 +185,15 @@ x-upstreams:
     chain: eth-beacon-chain
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-mainnet-reth-pruned-trace_prysm]
 ...

ethereum/reth/ethereum-sepolia-reth-archive-trace--nimbus.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-sepolia-reth:
-    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_SEPOLIA_RETH_VERSION:-v2.1.0}
+    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_SEPOLIA_RETH_VERSION:-v2.4.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -108,7 +108,7 @@ services:
     shm_size: 2gb
 
   ethereum-sepolia-reth-node:
-    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_SEPOLIA_NIMBUS_VERSION:-multiarch-v26.6.2}
+    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_SEPOLIA_NIMBUS_VERSION:-multiarch-v26.7.0}
     user: root
     ports:
       - 19330:19330
@@ -183,8 +183,15 @@ x-upstreams:
     chain: eth-beacon-chain-sepolia
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-sepolia-reth-archive-trace_nimbus]
 ...

ethereum/reth/ethereum-sepolia-reth-archive-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-sepolia-reth:
-    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_SEPOLIA_RETH_VERSION:-v2.1.0}
+    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_SEPOLIA_RETH_VERSION:-v2.4.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -108,7 +108,7 @@ services:
     shm_size: 2gb
 
   ethereum-sepolia-reth-node:
-    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_SEPOLIA_PRYSM_VERSION:-v7.1.4}
+    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_SEPOLIA_PRYSM_VERSION:-v7.1.7}
     ports:
       - 19330:19330
       - 19330:19330/udp
@@ -184,8 +184,15 @@ x-upstreams:
     chain: eth-beacon-chain-sepolia
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-sepolia-reth-archive-trace_prysm]
 ...

ethereum/reth/ethereum-sepolia-reth-pruned-trace--nimbus.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-sepolia-reth-pruned:
-    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_SEPOLIA_RETH_VERSION:-v2.1.0}
+    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_SEPOLIA_RETH_VERSION:-v2.4.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -109,7 +109,7 @@ services:
     shm_size: 2gb
 
   ethereum-sepolia-reth-pruned-node:
-    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_SEPOLIA_NIMBUS_VERSION:-multiarch-v26.6.2}
+    image: ${ETHEREUM_NIMBUS_IMAGE:-statusim/nimbus-eth2}:${ETHEREUM_SEPOLIA_NIMBUS_VERSION:-multiarch-v26.7.0}
     user: root
     ports:
       - 17150:17150
@@ -184,8 +184,15 @@ x-upstreams:
     chain: eth-beacon-chain-sepolia
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-sepolia-reth-pruned-trace_nimbus]
 ...

ethereum/reth/ethereum-sepolia-reth-pruned-trace.yml

@@ -30,7 +30,7 @@ x-logging-defaults: &logging-defaults
 
 services:
   ethereum-sepolia-reth-pruned:
-    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_SEPOLIA_RETH_VERSION:-v2.1.0}
+    image: ${ETHEREUM_RETH_IMAGE:-ghcr.io/paradigmxyz/reth}:${ETHEREUM_SEPOLIA_RETH_VERSION:-v2.4.1}
     sysctls:
       # TCP Performance
       net.ipv4.tcp_slow_start_after_idle: 0       # Disable slow start after idle
@@ -109,7 +109,7 @@ services:
     shm_size: 2gb
 
   ethereum-sepolia-reth-pruned-node:
-    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_SEPOLIA_PRYSM_VERSION:-v7.1.4}
+    image: ${ETHEREUM_PRYSM_IMAGE:-prysmaticlabs/prysm-beacon-chain}:${ETHEREUM_SEPOLIA_PRYSM_VERSION:-v7.1.7}
     ports:
       - 17150:17150
       - 17150:17150/udp
@@ -185,8 +185,15 @@ x-upstreams:
     chain: eth-beacon-chain-sepolia
     labels:
       provider: $${PROVIDER}-beacon-chain
+    options:
+      # dshackle 0.79.10's beacon health validator times out on the spec-compliant
+      # empty-body 200 from /eth/v1/node/health (nimbus), flapping the upstream
+      # UNAVAILABLE and failing live requests ("Source was empty"). Head tracking
+      # still governs health with validation off. 2026-07-10, dRPC incident.
+      disable-validation: true
     connection:
       generic:
         rpc:
           url: $${RPC_URL}
+x-optional-volumes: [ethereum-sepolia-reth-pruned-trace_prysm]
 ...

force-recreate.sh

@@ -1,8 +1,31 @@
 #!/bin/bash
+# force-recreate.sh — recreate one node's compose services (keeps volumes).
+# Runs peer-capture (.before-stop) before and peer-reinject (.after-start) after
+# so EL peer sets survive the restart (lisk-class --disable-discovery fix).
 
 if [ -z "$1" ] || [ ! -f "/root/rpc/$1.yml" ]; then
     echo "Error: Either no argument provided or /root/rpc/$1.yml does not exist."
     exit 1
 fi
 
-docker compose up -d --force-recreate $(cat /root/rpc/$1.yml | yaml2json - | jq '.services' | jq -r 'keys[]' | tr '\n' ' ')
+COMPOSE_PATH="$1"
+BASEPATH="/root/rpc"
+cd "$BASEPATH" || exit 1
+
+run_hook() {
+    local kind="$1"   # before-stop | after-start
+    local generic="$2"
+    if [ -f "${BASEPATH}/${COMPOSE_PATH}.${kind}" ]; then
+        /bin/bash "${BASEPATH}/${COMPOSE_PATH}.${kind}" || \
+            echo "WARN: ${COMPOSE_PATH}.${kind} exited $?" >&2
+    elif [ -x "${BASEPATH}/${generic}" ]; then
+        "${BASEPATH}/${generic}" "$COMPOSE_PATH" || \
+            echo "WARN: ${generic} exited $?" >&2
+    fi
+}
+
+run_hook before-stop peer-capture.sh
+
+docker compose up -d --force-recreate $(cat "/root/rpc/${COMPOSE_PATH}.yml" | yaml2json - | jq '.services' | jq -r 'keys[]' | tr '\n' ' ')
+
+run_hook after-start peer-reinject.sh

fuse/nethermind/fuse-spark-nethermind-archive-rocksdb-trace.yml

@@ -96,26 +96,8 @@ services:
 volumes:
   fuse-spark-nethermind-archive-rocksdb-trace:
 
-x-upstreams:
-  - id: $${ID}
-    labels:
-      provider: $${PROVIDER}
-    connection:
-      generic:
-        rpc:
-          url: $${RPC_URL}
-        ws:
-          frameSize: 20Mb
-          msgSize: 50Mb
-          url: $${WS_URL}
-    chain: fuse
-    method-groups:
-      enabled:
-        - debug
-        - filter
-        - trace
-    methods:
-      disabled:
-      enabled:
-        - name: txpool_content # TODO: should be disabled for rollup nodes
-...
+# fuse-spark (Sparknet, chainid 123) is ABSENT from dRPC chains.yaml - not a
+# servable dRPC chain. x-upstreams removed 2026-08-05 (it declared the MAINNET
+# slug "fuse", which would have advertised testnet data as mainnet). This file is
+# hand-written (fuse has chains: null in context.yml); onboarding it to generation
+# is the clean long-term fix. See chain-aliases.yaml fuse/spark: null.

fuse/nethermind/fuse-spark-nethermind-minimal-rocksdb-trace.yml

@@ -99,26 +99,8 @@ services:
 volumes:
   fuse-spark-nethermind-minimal-rocksdb-trace:
 
-x-upstreams:
-  - id: $${ID}
-    labels:
-      provider: $${PROVIDER}
-    connection:
-      generic:
-        rpc:
-          url: $${RPC_URL}
-        ws:
-          frameSize: 20Mb
-          msgSize: 50Mb
-          url: $${WS_URL}
-    chain: fuse
-    method-groups:
-      enabled:
-        - debug
-        - filter
-        - trace
-    methods:
-      disabled:
-      enabled:
-        - name: txpool_content # TODO: should be disabled for rollup nodes
-...
+# fuse-spark (Sparknet, chainid 123) is ABSENT from dRPC chains.yaml - not a
+# servable dRPC chain. x-upstreams removed 2026-08-05 (it declared the MAINNET
+# slug "fuse", which would have advertised testnet data as mainnet). This file is
+# hand-written (fuse has chains: null in context.yml); onboarding it to generation
+# is the clean long-term fix. See chain-aliases.yaml fuse/spark: null.