From 8c49d691bfe0694dc151168fe858d580598fa0a0 Mon Sep 17 00:00:00 2001 From: IrosTheBeggar Date: Wed, 19 Aug 2026 21:50:31 -0400 Subject: [PATCH 1/2] Bake the p2p discovery sidecar into the image at build time mStream 6.21+ fetches its p2p discovery sidecar binary on first use, sha256-verified against a manifest committed in the app tree. Baking it at image build (the app ships a script for exactly this) means discovery works in containers with no runtime egress to github.com and with no first-enable download; the fetch is pinned+verified either way, and images inherit new pins on their normal rebuilds. Runtime fetch remains as the fallback for anything else, so nothing breaks for older images. Verified: built the x86_64 image, then in a --network none container the baked binary executes (--print-id returns a valid node id) as user abc. Co-Authored-By: Claude Fable 5 --- Dockerfile | 2 ++ Dockerfile.aarch64 | 2 ++ readme-vars.yml | 1 + 3 files changed, 5 insertions(+) diff --git a/Dockerfile b/Dockerfile index 989c57c..c0bb099 100644 --- a/Dockerfile +++ b/Dockerfile @@ -50,6 +50,8 @@ RUN \ fi && \ npm link && \ chmod +x /app/mstream/bin/rust-parser/* && \ + echo "**** bake the p2p discovery sidecar (manifest-pinned, sha256-verified) ****" && \ + su -s /bin/sh abc -c 'HOME=/tmp node scripts/fetch-p2p-sidecar.mjs' && \ printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version && \ echo "**** cleanup ****" && \ rm -rf \ diff --git a/Dockerfile.aarch64 b/Dockerfile.aarch64 index 30b280f..1e2e0d4 100644 --- a/Dockerfile.aarch64 +++ b/Dockerfile.aarch64 @@ -50,6 +50,8 @@ RUN \ fi && \ npm link && \ chmod +x /app/mstream/bin/rust-parser/* && \ + echo "**** bake the p2p discovery sidecar (manifest-pinned, sha256-verified) ****" && \ + su -s /bin/sh abc -c 'HOME=/tmp node scripts/fetch-p2p-sidecar.mjs' && \ printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version && \ echo "**** cleanup ****" && \ rm -rf \ diff --git a/readme-vars.yml b/readme-vars.yml index 37885c1..4495c1d 100644 --- a/readme-vars.yml +++ b/readme-vars.yml @@ -81,6 +81,7 @@ changelogs: - {date: "12.12.23:", desc: "Rebase to Alpine 3.19, move binaries to /app."} - {date: "05.07.23:", desc: "Deprecate armhf. As announced [here](https://www.linuxserver.io/blog/a-farewell-to-arm-hf)"} - {date: "13.02.23:", desc: "Rebase to Alpine 3.17, migrate to s6v3."} + - {date: "20.08.26:", desc: "Bake the p2p discovery sidecar into the image at build time (manifest-pinned, sha256-verified) so discovery works without runtime egress to GitHub."} - {date: "05.04.22:", desc: "Move `sync` folder to `/config`."} - {date: "02.04.22:", desc: "Rebase to alpine 3.15. Fix ffmpeg download."} - {date: "17.05.21:", desc: "Deprecating the env vars `USER`, `PASSWORD` and `USE_JSON` as mStream v5 requires the use of `config.json`."} From 84ecc882d5aee819a8fbe273cd66dec4f4b076c0 Mon Sep 17 00:00:00 2001 From: aptalca <541623+aptalca@users.noreply.github.com> Date: Mon, 31 Aug 2026 14:17:09 -0400 Subject: [PATCH 2/2] fix changelog, install as root --- Dockerfile | 5 ++--- Dockerfile.aarch64 | 5 ++--- README.md | 1 + readme-vars.yml | 2 +- 4 files changed, 6 insertions(+), 7 deletions(-) diff --git a/Dockerfile b/Dockerfile index c0bb099..3bb88be 100644 --- a/Dockerfile +++ b/Dockerfile @@ -36,8 +36,7 @@ RUN \ /tmp/mstream.tar.gz -C \ /app/mstream/ --strip-components=1 && \ cd /app/mstream && \ - chown -R abc:abc ./ && \ - su -s /bin/sh abc -c 'HOME=/tmp npm install --omit=dev' && \ + HOME=/tmp npm install --omit=dev && \ echo "**** use distro onnxruntime for the discovery embedding runtime ****" && \ if [ -d /app/mstream/node_modules/onnxruntime-node/bin/napi-v6/linux/x64 ]; then \ rm -f \ @@ -51,7 +50,7 @@ RUN \ npm link && \ chmod +x /app/mstream/bin/rust-parser/* && \ echo "**** bake the p2p discovery sidecar (manifest-pinned, sha256-verified) ****" && \ - su -s /bin/sh abc -c 'HOME=/tmp node scripts/fetch-p2p-sidecar.mjs' && \ + HOME=/tmp node scripts/fetch-p2p-sidecar.mjs && \ printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version && \ echo "**** cleanup ****" && \ rm -rf \ diff --git a/Dockerfile.aarch64 b/Dockerfile.aarch64 index 1e2e0d4..ab87ef9 100644 --- a/Dockerfile.aarch64 +++ b/Dockerfile.aarch64 @@ -36,8 +36,7 @@ RUN \ /tmp/mstream.tar.gz -C \ /app/mstream/ --strip-components=1 && \ cd /app/mstream && \ - chown -R abc:abc ./ && \ - su -s /bin/sh abc -c 'HOME=/tmp npm install --omit=dev' && \ + HOME=/tmp npm install --omit=dev && \ echo "**** use distro onnxruntime for the discovery embedding runtime ****" && \ if [ -d /app/mstream/node_modules/onnxruntime-node/bin/napi-v6/linux/arm64 ]; then \ rm -f \ @@ -51,7 +50,7 @@ RUN \ npm link && \ chmod +x /app/mstream/bin/rust-parser/* && \ echo "**** bake the p2p discovery sidecar (manifest-pinned, sha256-verified) ****" && \ - su -s /bin/sh abc -c 'HOME=/tmp node scripts/fetch-p2p-sidecar.mjs' && \ + HOME=/tmp node scripts/fetch-p2p-sidecar.mjs && \ printf "Linuxserver.io version: ${VERSION}\nBuild-date: ${BUILD_DATE}" > /build_version && \ echo "**** cleanup ****" && \ rm -rf \ diff --git a/README.md b/README.md index 9746f8b..c75484c 100644 --- a/README.md +++ b/README.md @@ -282,6 +282,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64 ## Versions +* **31.08.26:** - Bake the p2p discovery sidecar into the image at build time (manifest-pinned, sha256-verified) so discovery works without runtime egress to GitHub. * **08.07.26:** - Rebase to Alpine 3.24. Use the distro onnxruntime so the discovery/recommendation features work on musl. * **24.04.26:** - Make waveform data persistent. * **20.04.26:** - Fix perms on rust binaries. diff --git a/readme-vars.yml b/readme-vars.yml index 4495c1d..84612b8 100644 --- a/readme-vars.yml +++ b/readme-vars.yml @@ -72,6 +72,7 @@ init_diagram: | "mstream:latest" <- Base Images # changelog changelogs: + - {date: "31.08.26:", desc: "Bake the p2p discovery sidecar into the image at build time (manifest-pinned, sha256-verified) so discovery works without runtime egress to GitHub."} - {date: "08.07.26:", desc: "Rebase to Alpine 3.24. Use the distro onnxruntime so the discovery/recommendation features work on musl."} - {date: "24.04.26:", desc: "Make waveform data persistent."} - {date: "20.04.26:", desc: "Fix perms on rust binaries."} @@ -81,7 +82,6 @@ changelogs: - {date: "12.12.23:", desc: "Rebase to Alpine 3.19, move binaries to /app."} - {date: "05.07.23:", desc: "Deprecate armhf. As announced [here](https://www.linuxserver.io/blog/a-farewell-to-arm-hf)"} - {date: "13.02.23:", desc: "Rebase to Alpine 3.17, migrate to s6v3."} - - {date: "20.08.26:", desc: "Bake the p2p discovery sidecar into the image at build time (manifest-pinned, sha256-verified) so discovery works without runtime egress to GitHub."} - {date: "05.04.22:", desc: "Move `sync` folder to `/config`."} - {date: "02.04.22:", desc: "Rebase to alpine 3.15. Fix ffmpeg download."} - {date: "17.05.21:", desc: "Deprecating the env vars `USER`, `PASSWORD` and `USE_JSON` as mStream v5 requires the use of `config.json`."}