Integration for Node release 11.1 - #6604
Draft
f-f wants to merge 46 commits into
Draft
Conversation
johnalotoski
force-pushed
the
f-f/prepare-11.1
branch
3 times, most recently
from
August 5, 2026 19:45
9d4da9c to
2cfc906
Compare
carbolymer
force-pushed
the
f-f/prepare-11.1
branch
3 times, most recently
from
August 13, 2026 17:45
7af30e8 to
5e5812f
Compare
koslambrou
force-pushed
the
f-f/prepare-11.1
branch
8 times, most recently
from
August 14, 2026 19:34
59b93b0 to
b93644b
Compare
…86_64-linux release artifact
… cfg, group socket use
The cardano-node and cardano-tracer service modules unconditionally emitted `--machine-readable -tcardano-node.stats -pocardano-node` in the default `profilingArgs`, regardless of `cfg.profiling`. GHC's `-tFILE` always writes the stats file on shutdown, which broke startup on read-only filesystems even though no profiling was configured. Gate the three flags on `cfg.profiling != "none" || cfg.eventlog` so the default RTS command line is empty when nothing is requested. When profiling is enabled, the same flags now consult a new option, `services.cardano-node.profilingOutputDir` (and the tracer equivalent), to prefix the output file paths. The option defaults to null, preserving today's relative-path behavior on NixOS where systemd's `WorkingDirectory` equals `cfg.stateDir`. `scripts.nix` sets it to `/logs` for the OCI script wrappers, so profile output under the read-only OCI image lands on the writable `/logs` mount. In response to #6470.
`run-node` and `run-tracer` wrote a sourceable env file to `/usr/local/bin/env` at every startup, which fails under `--read-only` / `readOnlyRootFilesystem`. The file was introduced in d9c8317 (#2801) to feed the topologyUpdate script added the same day in c652f10. topologyUpdate was removed in 56266c0 and never reintroduced; the writer was preserved by accident when 34a4796 re-created the docker context, along with a stale `# Mapping for topologyUpdater` comment. Across all branches, there is noconsumer besides the deleted topologyUpdater. The `CARDANO_*` snapshot remains useful for operators that exec into the container and want the resolved (post-defaults) config in a shell, so the writer is kept but redirected to `/tmp/cardano-env` (writable when `/tmp` is mounted as tmpfs/emptyDir). A build-time symlink at `/usr/local/bin/env -> /tmp/cardano-env` keeps the legacy path resolving in case any out-of-tree consumer depends on it. The variables that existed only for topologyUpdater are dropped from the snapshot. The README's new "Read-Only Root Filesystem" section documents the required writable mounts, the new env-snapshot path, and how custom-mode operators should direct any profile output to a writable mount. In response to #6470.
The entrypoints wrote `{{,tracer-}config,topology}-merged.json` to
`/opt/cardano/config/$NETWORK/`, which is image content owned by root.
Non-root containers and read-only-root mounts both fail on this write.
Redirect the writes to `/tmp/cardano-{{,tracer-}config,topology}-merged.json`.
The upstream network config keeps relative refs to genesis /
peer-snapshot files, all resolved relative to the config file's own
directory. Naively moving the merged output to `/tmp` would break those
refs. The jq merge now rewrites them to absolute paths anchored at
`/opt/cardano/config/$NETWORK/`. The key match uses a regex
`(test("GenesisFile$|^CheckpointsFile$"))` so future protocol-era keys
pick up the rewrite without code changes.
Both entrypoints also bail out early with a clear error message if
`/tmp` is not writable, instead of letting the failure cascade into a
less-obvious jq write error.
In response to #6484.
The mount-point directories /data, /ipc, /logs were created owned by root. When a volume was first mounted there, Docker propagated the permissions from the image, so a container running as non-root could not write. Apply `chmod g+w` to open up the permissions enough for: - Kubernetes `runAsUser` (assigns primary group 0 by default) - Docker `--user <uid>` (assigns primary group 0 by default) - OpenShift's arbitrary-UID assignment (random UID, GID 0) For the tracer image, also add `mkdir -p data` and the matching symlink at `/opt/cardano/data` for parity with the node image's convention. `run-tracer` defaults `CARDANO_STATE_DIR` to `/data/tracer` and assumed that this symlink existed. This finally makes that true. The default state dir now works under non-root without an explicit `/data` mount. In response to #6484.
…tlog for node/tracer
Neither directory is referenced anywhere in the tree. configuration/mainnet-ci/ last had a content change in ee9ad13 (2020-04-06). Its consumers were both removed years ago: dbb7120 2020-10-05 Remove chairmans-cluster nixos test. 46b6d07 2021-03-25 nixos: remove unsused cardano-cluster-service and systemd template support It was also used by the earliest docker image work, 475049c (2020-02-24), which has long since moved to configuration/cardano. configuration/defaults/byron-testnet/ was last touched by f7902ed (2023-06-01), and that was a repo wide sweep removing ApplicationName and ApplicationVersion rather than a use of the directory.
johnalotoski
force-pushed
the
f-f/prepare-11.1
branch
3 times, most recently
from
August 15, 2026 06:32
118eaec to
799e3dc
Compare
Package version bumps: * cardano-api: ^>= 11.3 → ^>= 11.4 * cardano-cli: ^>= 11.1 → ^>= 11.2 * cardano-crypto-class: ^>= 2.3 → ^>= 2.5 * ouroboros-consensus: ^>= 3.0.1 → ^>= 4.1 * ouroboros-network: ^>= 1.1 → ^>= 1.2 * cardano-diffusion: ^>= 1.0 → ^>= 1.1.1 * cardano-protocol: (new, ^>= 0.1) Local package bumps: cardano-node 11.0 → 11.1, trace-forward 2.4.1 → 2.5.0 LedgerDB / storage: * Remove LMDB backend (V1LMDB); only V2LSM remains * Add LSMExportPath config option for standalone LSM exports * Rework snapshot config: NumOfDiskSnapshots/SnapshotInterval fields replaced by SnapshotPolicyArgs; validate non-positive SnapshotInterval Tracing: * Fix Peras tracing: add vote-db and cert-diffusion trace namespaces (TracePerasVoteDbEvent, TraceObjectDiffusionInbound/Outbound for Peras votes and certs) * Fix SanityCheckIssue namespace wildcard match and add documentation * Fix snapshot policy sanity-check tracing (SnapshotDelayRangeInverted, SnapshotRateLimitDisabled, SnapshotNumZero, etc.) * Add NodeToClient tracing coverage for missing namespaces * Fix KESAgentClientTrace severity dispatch * Remove embeddedInitialFunds double-counting (mirror ledger behaviour) * Fix Snapshot config option parsing cardano-submit-api: * TxSubmitWebApiError simplified to a newtype over TxSubmitFail; dead constructors (TxSubmitDecodeHex, TxSubmitEmpty, etc.) removed * Replace legacy iohk-monitoring example config with new-tracing config cardano-testnet: * Migrate ping to cardano-diffusion:ping (drop hand-rolled mux impl); pingNode now returns Either PingClientException () * Thread SomeHasFS IO through foldEpochState call sites via mkNodeConfigFs * Restore compact help layout Build / compat: * GHC 9.14 support (QuickCheck 2.18, crypton-x509-system, bytestring-trie, etc.) * Add cabal-allow-newer stanzas for GHC >= 9.14 * snap-server: disable openssl flag; cardano-diffusion: enable optparse-applicative-fork Haddock / CI: * Add haddock devShell (ghc9124) for the github-page workflow * Gate broken haddock only for GHC < 9.12.3 (type data panic) * Update golden test output for new GHC Workbench: * Add fschain-6912k profiles (6.75 MiB blocks, 3000 slots) * Fix blocksize768k overlay (missing epoch_params wrapper) * Fix git commit detection in worktree checkouts Co-authored-by: Fabrizio Ferrai <fabrizio.ferrai@iohk.io> Co-authored-by: Samuel Leathers <samuel.leathers@iohk.io> Co-authored-by: Javier Sagredo <javier.sagredo@iohk.io> Co-authored-by: Erik de Castro Lopo <erikd@mega-nerd.com> Co-authored-by: Pablo Lamela <pablo.lamela@iohk.io> Co-authored-by: Adithya Kumar <adithya.kumar@tweag.io> Co-authored-by: Russoul <ruslan.feizerakhmanov@iohk.io> Co-authored-by: Jordan Millar <jordan.millar@iohk.io> Co-authored-by: kolam <kolam@posteo.me>
Two flake relocks on this branch left several pins adrift. The mithril input commit dropped haskellNix to ef52c36b, which has no ghc9124, forcing the haddock devShell to ghc9122 and breaking the Haddock workflow. The dependency bump later moved cardano-automation's hackageNix off master, and mithril's own pins stayed on 2617.0's after the tag went to 2630.0. All now match master, or upstream's 2630.0 lock for mithril, and the haddock project variant is back on ghc9124.
johnalotoski
force-pushed
the
f-f/prepare-11.1
branch
from
August 16, 2026 07:08
799e3dc to
18ee6f7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
WIP
Checklist
See Running tests for more details
CHANGELOG.mdfor affected package.cabalfiles are updatedhlint. See.github/workflows/check-hlint.ymlto get thehlintversionstylish-haskell. See.github/workflows/stylish-haskell.ymlto get thestylish-haskellversionghc-9.6andghc-9.12