Code/image skew (install.sh D3): updater checks out v1 code but pulls :latest images built from main #19

New Issue

2026-10-04T01:11:47-04:00

logan commented

2026-10-04 01:11:47 -04:00

install.sh's standing hazard D3, which the new host updater (node-26#16) now exercises on every update.

docker-compose.yml bind-mounts ./drb-edge-node/app and ./op25-container/app from the checkout. The checkout is at v1, but the images are edge-node:latest and op25-client:stable, which CI builds from main on every push. So after drb-update.sh (fetch v1, compose pull, up --force-recreate), a node runs v1 Python against main's dependencies. That is fine while they agree, and silently broken the day main adds a dependency that v1 code doesn't have, or the other way round.

Fix direction: tag images per release (:v1, or the v1 sha) and reference that tag from compose at the same ref. Alternatively, drop the source mounts from the prod compose path.

`install.sh`'s standing hazard D3, which the new host updater (node-26#16) now exercises on every update. `docker-compose.yml` bind-mounts `./drb-edge-node/app` and `./op25-container/app` from the checkout. The checkout is at `v1`, but the images are `edge-node:latest` and `op25-client:stable`, which CI builds from **main** on every push. So after `drb-update.sh` (fetch `v1`, `compose pull`, `up --force-recreate`), a node runs `v1` Python against main's dependencies. That is fine while they agree, and silently broken the day main adds a dependency that `v1` code doesn't have, or the other way round. Fix direction: tag images per release (`:v1`, or the `v1` sha) and reference that tag from compose at the same ref. Alternatively, drop the source mounts from the prod compose path.

logan referenced this issue

2026-10-04 01:12:07 -04:00

Node enrolled via install.sh never comes online if approved after install (Toughny) — no client-side key pickup, and re-run doesn't restart edge-node #14

logan referenced this issue from a commit

2026-10-04 18:09:37 -04:00

Pin node images to the checked-out source tree (node-26#19)

logan referenced a pull request that will close this issue

2026-10-04 18:10:07 -04:00

Pin node images to the checked-out source tree — fix v1 code / :latest image skew (#19) #31

logan commented

2026-10-04 18:10:37 -04:00

Fix is up in PR #31 (fix/19-image-tag-skew). Images are now tagged src-<git tree hash of their build dir>. CI and the node compute the same value, and compose reads it as DRB_TAG_* from .env. The updater pulls the target's pinned images before checkout, so a missing image changes nothing. A new Release images workflow backfills any src- tag a release ref is missing.

Owner rollout (the v1 tag is untouched):

Merge #31.
Run Release images on main.
Re-cut v1.

The first update after the re-cut still runs the old updater (pulls :latest). Pinning applies from the next update on. Pinning by digest or signature stays with #17.

Fix is up in **PR #31** (`fix/19-image-tag-skew`). Images are now tagged `src-<git tree hash of their build dir>`. CI and the node compute the same value, and compose reads it as `DRB_TAG_*` from `.env`. The updater pulls the target's pinned images **before** checkout, so a missing image changes nothing. A new **Release images** workflow backfills any `src-` tag a release ref is missing. **Owner rollout (the v1 tag is untouched):** 1. Merge #31. 2. Run Release images on `main`. 3. Re-cut `v1`. The first update after the re-cut still runs the old updater (pulls `:latest`). Pinning applies from the next update on. Pinning by digest or signature stays with #17.

logan referenced this issue

2026-10-04 18:17:54 -04:00

Pin node images to the checked-out source tree — fix v1 code / :latest image skew (#19) #31

logan closed this issue

2026-10-04 18:26:02 -04:00

logan referenced this issue from a commit

2026-10-04 18:26:02 -04:00

Merge pull request 'Pin node images to the checked-out source tree — fix v1 code / :latest image skew (#19)' (#31) from fix/19-image-tag-skew into main

logan added the area/infra-deploy area/node-ota

type

bug

labels 2026-10-05 02:05:10 -04:00