Bake the p2p discovery sidecar into the image at build time - #37
Merged
Conversation
mStream 6.21+ fetches its p2p discovery sidecar binary on first use, sha256-verified against a manifest committed in the app tree. Baking it at image build (the app ships a script for exactly this) means discovery works in containers with no runtime egress to github.com and with no first-enable download; the fetch is pinned+verified either way, and images inherit new pins on their normal rebuilds. Runtime fetch remains as the fallback for anything else, so nothing breaks for older images. Verified: built the x86_64 image, then in a --network none container the baked binary executes (--print-id returns a valid node id) as user abc. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
IrosTheBeggar
marked this pull request as ready for review
August 20, 2026 02:18
This was referenced Aug 25, 2026
Merged
aptalca
reviewed
Aug 30, 2026
| npm link && \ | ||
| chmod +x /app/mstream/bin/rust-parser/* && \ | ||
| echo "**** bake the p2p discovery sidecar (manifest-pinned, sha256-verified) ****" && \ | ||
| su -s /bin/sh abc -c 'HOME=/tmp node scripts/fetch-p2p-sidecar.mjs' && \ |
Member
There was a problem hiding this comment.
Running this as abc is not necessary as abc at this point has a placeholder uid of 911 assigned, which will change runtime.
Our init script has a recursive chown for the /app/mstream/bin, which should take care of the perms runtime.
aptalca
approved these changes
Aug 31, 2026
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
mStream 6.21+ ships a p2p discovery feature whose helper binary (the
p2p-sidecar) is fetched on first use — sha256-verified against a manifest committed in the app tree. This PR runs the app's own pre-fetch script (scripts/fetch-p2p-sidecar.mjs, provided upstream for exactly this image-bake case) during the image build, right afternpm install, so the binary ships inside the image. Applied identically toDockerfileandDockerfile.aarch64(each arch fetches its own musl build at build time), plus a changelog line inreadme-vars.yml.Benefits of this PR and context:
/configcontinues to work as today.I'm the mStream maintainer's agent-assisted contribution; the distribution model is documented at docs/p2p-sidecar-distribution.md and bin/p2p-sidecar/README.md.
How Has This Been Tested?
Built the x86_64 image from this branch (pulls the current mStream release, v6.21.2). Then in a
--network nonecontainer:/app/mstream/bin/p2p-sidecar/p2p-sidecar-linux-x64-muslis present, owned byabc, executable (8.6 MB);abcwith--print-idreturns a valid node id — the discovery helper works with zero network access.Source / References: