How to deploy a Nitro rollup with Docker, Popsigner, and Popkins

Setting up keys on Popsigner

First, you’ll set up the keys for the batch poster, staker, and Celestia. This will allow us to deploy the rollup through Popkins and then start it locally, posting blobs to Celestia.

1. Go to https://popsigner.com/  and make an account by clicking “Deploy”:

   

2. Once you’re logged in, click “CREATE_KEY” in the top right:

   

3. Make 3 keys, all universal for simplicity:

   1. deployer-1
   2. batcher-1
   3. validator-1

   

Funding keys

Now that you’ve set the keys up, you need to fund them accordingly.

1. Find the addresses in your dashboard, for Ethereum Sepolia keys, copy the 0x address:

   

   and click “VIEW” to see the Celestia address:

   

2. Deployer key: deployer-1

   1. Fund the deployer-1 with at least 0.5 sepoliaETH

3. Batcher key: batcher-1

   1. Fund with at least 0.5 sepoliaETH

4. Validator key: validator-1

   1. Fund with at least 0.2 sepoliaETH if you plan to run the validator/staker.
   BOLD requires WETH (not native ETH) for staking. The sequencer will automatically call WETH.deposit() with 0.1 ETH — if your staker only has exactly 0.1 ETH, there won’t be enough left for gas and it will fail with insufficient funds for transfer.

5. Celestia key:

   1. Here’s an example address: celestia1su2l6v5a0cj6yg05gp9cuvfen74t8u8rvck836
   2. Fund the celestia-1 address with 10 Mocha TIA from the faucet 

Setting up deployment on Popkins

Next, you’re ready to sign in to Popkins  and begin your first rollup deployment with a Nitro chain.

1. Click ”+ NEW CHAIN” button in the top right corner and select Arbitrum Nitro as the stack.

2. Set up your config for the new chain! Pick a rollup name and ID that you want to use. This is where you’ll also put in the Ethereum Sepolia RPC URL from the environment setup.

3. Click “CONTINUE”, then assign keys accordingly:
   1. Deployer key: deployer-1
   2. Batch poster key: batcher-1
   3. Validator key: validator-1
   4. You’ll set the Celestia key up later in the .env and celestia-config.toml

Then click “CONTINUE” again.

4. Once you’ve set up the config, double-check the values before proceeding! Make sure you have sepoliaETH in the batcher key and 10 mochaTIA in your Celestia account.
   1. Click ”🚀 DEPLOY CHAIN”

5. Keep an eye out on the process as it completes. Once it’s finished, you will be able to download the config to run your rollup with Docker compose.

6. Download the bundle by clicking “DOWNLOAD BUNDLE”:

   Then extract:

   unzip YOUR-NITRO-BUNDLE-NAME.zip

Running locally with Docker

Now that you’ve set the rollup up by deploying contracts and downloading the artifacts, you’re ready to run it on your own and start producing blocks! Let’s start by understanding the bundle and making some config changes.

What’s in the bundle

my-nitro-rollup-v7-nitro-bundle/
├── config/
│   ├── chain-info.json          # Chain configuration (from SDK)
│   ├── core-contracts.json      # Deployed contract addresses (rollup, bridge, inbox, etc.)
│   ├── node-config.json         # Original node config (reference only)
│   └── celestia-config.toml     # Celestia DAS server config
├── certs/                       # PopSigner mTLS certificates (auto-generated during deployment)
│   ├── client.crt
│   ├── client.key
│   └── ca.crt
├── docker-compose.yaml          # Main Docker Compose configuration
├── .env.example                 # Environment template
└── README.md

Architecture

The bundle uses a ClientTX architecture — no local Celestia node required. The two Docker services connect directly to remote Celestia infrastructure:

┌──────────────────────────────────────────────────────────────────┐
│                         Docker Compose                           │
│                                                                  │
│  ┌─────────────────┐              ┌─────────────────────┐        │
│  │  Nitro Sequencer │  ─────────► │  Celestia DAS Server │       │
│  │  (nitro-node)    │  daprovider │  (nitro-das-celestia)│       │
│  │                  │  RPC        │  ClientTX            │       │
│  └────────┬─────────┘              └──────────┬──────────┘       │
│           │                                   │                  │
└───────────┼───────────────────────────────────┼──────────────────┘
            │                                   │
            │ L1 RPC                            │ gRPC (write) + JSON-RPC (read)
            ▼                                   ▼
    ┌───────────────┐               ┌──────────────────────────┐
    │   Sepolia     │               │   Celestia Mocha Testnet │
    │   (L1)        │◄───────────── │  - Consensus (gRPC)      │
    │               │  Blobstream   │   - DA Bridge (RPC)      │
    │  Blobstream X │               └──────────────────────────┘
    │  Contract     │
    └───────────────┘

• Writes (blob submission): The Celestia DAS server sends blobs via direct gRPC to Celestia consensus nodes, signed remotely by PopSigner.
• Reads (blob retrieval): The Celestia DAS server reads blobs via JSON-RPC from Celestia DA Bridge nodes.
• L1 transactions: The Nitro sequencer posts batch commitments and staker assertions to Sepolia, signed remotely by PopSigner via mTLS.
• Startup order: The Nitro sequencer waits for the Celestia DAS server’s healthcheck to pass before starting.

Two PopSigner keys explained

This setup uses two separate PopSigner keys with different authentication methods:

The mTLS certificates in ./certs/ are auto-generated during deployment by Popkins — you don’t need to create them manually.

Services and ports

Set up Popsigner API key

Set up an API key on Popsigner.com . This is different than creating a key for a blockchain account. Save this for the next step in your clipboard. You’ll only be able to see it once, for safe security practice.

Configure .env

1. Copy .env.example into .env:

   cd my-nitro-rollup-v7-nitro-bundle && cp .env.example .env

2. Fill in the L1 (Sepolia) RPC URL. WSS is recommended for sequencers (real-time updates, lower latency):

   L1_RPC_URL=wss://sepolia.infura.io/ws/v3/YOUR_KEY

3. Verify the batch poster and staker addresses match your PopSigner keys. These were populated during deployment:

   BATCH_POSTER_ADDRESS=0xYOUR_BATCH_POSTER_ADDRESS
   STAKER_ADDRESS=0xYOUR_STAKER_ADDRESS

4. Fill in the Celestia Popsigner credentials:

   1. For POPSIGNER_CELESTIA_API_KEY, use the API key you created in Step 1:

      POPSIGNER_CELESTIA_API_KEY=bbr_live_YOUR_API_KEY

   2. For POPSIGNER_CELESTIA_KEY_ID, go to the Celestia key in Popsigner, click “View”, and copy the “KEY_ID”:

      POPSIGNER_CELESTIA_KEY_ID=YOUR_KEY_ID

5. Verify the Docker images are set. The defaults should work out of the box:

   NITRO_IMAGE=rg.nl-ams.scw.cloud/banhbao/nitro-node-dev:v3.10.0
   NITRO_DAS_IMAGE=rg.nl-ams.scw.cloud/banhbao/nitro-das-server:v0.8.2

   If you’ve built Nitro locally from source (make docker in the nitro repo), you can swap NITRO_IMAGE to your local tag instead (e.g. nitro-node-dev:latest).

Configure config/celestia-config.toml

This is the configuration for the Celestia DAS server — the sidecar that translates between Nitro’s DA provider protocol and Celestia. You need to fill in the Celestia endpoints and namespace.

1. Set the namespace. Celestia namespaces are hex strings. Generate a unique one:

   export NAMESPACE=$(openssl rand -hex 10) && echo $NAMESPACE

   Then update the config:

   [celestia]
   namespace_id = "YOUR_GENERATED_NAMESPACE_HEX"

2. Set the reader endpoint (for reading blobs via JSON-RPC). Use your Quicknode Celestia Mocha endpoint:

   [celestia.reader]
   rpc = "https://delicate-sleek-lambo.celestia-mocha.quiknode.pro/8d7f3e5a9b2c4f1e6d8c9a5b7e4f2c1a6d3b9e5f/"
   auth_token = ""
   enable_tls = true

3. Set the writer endpoint (for submitting blobs via gRPC). Use the same Quicknode endpoint, but as gRPC — no https://, add port 9090:

   [celestia.writer]
   core_grpc = "delicate-sleek-lambo.celestia-mocha.quiknode.pro:9090"
   core_token = "8d7f3e5a9b2c4f1e6d8c9a5b7e4f2c1a6d3b9e5f"
   enable_tls = true

4. Set the PopSigner signer credentials. Open the [celestia.signer.remote] section and replace api_key and key_id with your actual values. Use the API key from Step 1 and the Key ID from your Popsigner dashboard (click “View” on your Celestia key):

   [celestia.signer.remote]
   api_key = "bbr_live_YOUR_ACTUAL_API_KEY"
   key_id = "your-actual-key-id-uuid"

5. Set the validator RPC endpoint. In the [celestia.validator] section, replace eth_rpc with your Sepolia RPC URL (the same one from your .env):

   [celestia.validator]
   eth_rpc = "wss://sepolia.infura.io/ws/v3/YOUR_KEY"

   This is used by Blobstream to query data root attestations for fraud proofs.

Run with Docker

Now you’re ready to run this with Docker!

docker compose up -d

On Linux, use docker compose --env-file .env up -d to load the .env.

Check the logs to verify everything is running:

docker compose logs -f

You should see the Celestia DAS server start first (it has a healthcheck), followed by the Nitro sequencer connecting to it via the DA provider RPC and beginning to produce blocks.

Verify it’s running

Test the Celestia DAS server:

curl -X POST http://localhost:9876 \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"daprovider_getSupportedHeaderBytes","params":[],"id":1}'

Check the chain ID on the sequencer:

cast chain-id --rpc-url http://localhost:8547