Desktop app releases publish a gateway image that crashes on the edge #185

Activity

1. ecv commented on Sep 11, 2026

   

   ecv

   on Sep 11, 2026

   ContributorAuthor

   More actions

   Evidence, read-only, collected 2026-09-11.

   The crashing container prints only a parse error and exits with code 2:

   error: unexpected argument '--port' found
   
   Usage: datum-connect [OPTIONS] <COMMAND>
   

   The edge DaemonSet starts the gateway with --port 10000 --metrics-port 9090 --uds /var/run/datum-connect/iroh-gateway.sock --discovery hybrid --dns-origin datumconnect.net., the argument shape of the standalone binary. Infra dropped the gateway subcommand in April, when the gateway moved to its own repository (datum-cloud/infra@a73ac985c).

   Two workflows push to ghcr.io/datum-cloud/iroh-gateway:

   • publish-docker.yml in datum-cloud/iroh-gateway builds the standalone iroh-gateway binary. The edge runs its v0.1.0.
   • manual-release.yml here, with publish_docker set, builds this repository's Dockerfile, which packages datum-connect with CMD ["gateway"], and tags it with the app version.

   The v0.1.4 tag was pushed twice, at 20:29Z on 10 September and 03:48Z on 11 September, and the edge pulled both builds (digests afeb8d29 and 45a375a5). Both crash the same way. Every healthy gateway runs the v0.1.0 digest 4ae79bf3.

   Infra rollback: https://github.com/datum-cloud/infra/pull/5149
2. ecv

   self-assigned this

   on Sep 11, 2026
3. ecv

   closed this as completedin #186on Sep 11, 2026
4. ecv commented on Sep 11, 2026

   

   ecv

   on Sep 11, 2026

   ContributorAuthor

   More actions

   Follow-up on 2026-09-11.

   • fix: Stop the manual release from publishing a gateway image #186 merged. The manual release no longer builds or publishes an image, so datum-cloud/iroh-gateway is the only publisher of ghcr.io/datum-cloud/iroh-gateway.
   • The app-built v0.1.4 tag (sha256:45a375a5) was deleted from GHCR. v0.1.4 now returns 404, and v0.1.0 and v0.1 still resolve to the gateway's own build, sha256:4ae79bf3.
   • The edge and edge-beta overlays stay pinned to v0.1.0 (datum-cloud/infra#5149). With v0.1.4 gone, the semver image policy resolves to v0.1.0 again, so image automation could be turned back on safely.

   Still open:

   • The first v0.1.4 push, sha256:afeb8d29, may still be in the package as an untagged version. Nobody has confirmed it was deleted.
   • The package was first created from this repository, so it likely still grants datum-cloud/app write access under Manage Actions access. Removing that role is what stops an app workflow from pushing to the gateway's image again. A tag-based image policy can't tell the two publishers apart, because both use vX.Y.Z tags.
   • Tags v0.0.1 through v0.0.35 are app-era builds from before the gateway moved out in April. They were valid gateway images at the time and are left in place.