build: switch MPC node image push to skopeo with --preserve-digests by barakeinav1 · Pull Request #2780 · near/mpc

barakeinav1 · 2026-04-09T13:34:19Z

Summary

Switch MPC node and node-gcp image push from docker push to skopeo copy --preserve-digests, matching the pattern already used for launcher images
Add skopeo to required commands when --push is used
Output manifest digest after push for both node images

Test plan

CI passes
./deployment/build-images.sh --node --push uses skopeo and outputs manifest digest
check https://github.com/near/mpc/actions/workflows/docker_build_node_gcp.yml and https://github.com/near/mpc/actions/workflows/docker_build_node.yml work

Use skopeo copy --preserve-digests for MPC node and node-gcp images, matching the pattern already used for launcher images. This ensures manifest digests are preserved when pushing to Docker Hub. Also adds skopeo to required commands when --push is used and outputs the manifest digest after push. Closes #2778 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

claude · 2026-04-09T13:35:22Z

Reviewed the diff. No critical issues found. The changes correctly mirror the existing skopeo pattern used for launcher images, adding proper temp dir cleanup and manifest digest output.

✅ Approved

Copilot

Pull request overview

Updates the image build/push helper script to push MPC node images via skopeo copy --preserve-digests, aligning the node push flow with the launcher images so manifest digests are deterministic and can be reported.

Changes:

Replace docker tag && docker push for mpc-node and mpc-node-gcp with skopeo copy --preserve-digests via a temporary dir: transport.
Require skopeo when --push is used.
Compute and print manifest digests for node images after a push.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-09T13:44:11Z

deployment/build-images.sh

+        temp_dir=$(mktemp -d)
+        skopeo copy --all --dest-compress docker-daemon:$NODE_IMAGE_NAME:latest dir:$temp_dir
+        skopeo copy --preserve-digests dir:$temp_dir docker://docker.io/nearone/$NODE_IMAGE_NAME:$image_tag


temp_dir is unquoted in the skopeo copy ... dir:$temp_dir arguments. If $TMPDIR contains spaces, mktemp -d can produce a path with spaces and these commands will break. Quote the whole transport argument (e.g., dir:"$temp_dir") to make this robust.

Copilot · 2026-04-09T13:44:11Z

deployment/build-images.sh

+        temp_dir=$(mktemp -d)
+        skopeo copy --all --dest-compress docker-daemon:$NODE_IMAGE_NAME:latest dir:$temp_dir
+        skopeo copy --preserve-digests dir:$temp_dir docker://docker.io/nearone/$NODE_IMAGE_NAME:$image_tag
+        node_manifest_digest="sha256:$(sha256sum $temp_dir/manifest.json | cut -d' ' -f1)"
+        rm -rf "$temp_dir"


Temp dir cleanup only happens on the success path. With set -e, if a skopeo copy fails the script exits and leaves the mktemp -d directory behind. Consider registering a trap (or similar) to ensure $temp_dir is removed on errors as well.

Copilot · 2026-04-09T13:44:12Z

deployment/build-images.sh

+        node_manifest_digest="sha256:$(sha256sum $temp_dir/manifest.json | cut -d' ' -f1)"
+        rm -rf "$temp_dir"


For safer deletion, prefer rm -rf -- "$temp_dir". Even when quoted, if a path starts with - it can be interpreted as an option by rm without the -- terminator.

Copilot · 2026-04-09T13:44:12Z

deployment/build-images.sh

+        temp_dir=$(mktemp -d)
+        skopeo copy --all --dest-compress docker-daemon:$NODE_GCP_IMAGE_NAME:latest dir:$temp_dir
+        skopeo copy --preserve-digests dir:$temp_dir docker://docker.io/nearone/$NODE_GCP_IMAGE_NAME:$image_tag


Same quoting issue here: dir:$temp_dir is unquoted. If the temporary directory path contains spaces (e.g., from $TMPDIR), skopeo copy will fail. Quote the full transport argument.

Copilot · 2026-04-09T13:44:12Z

deployment/build-images.sh

+        node_gcp_manifest_digest="sha256:$(sha256sum $temp_dir/manifest.json | cut -d' ' -f1)"
+        rm -rf "$temp_dir"


Same as above: use rm -rf -- "$temp_dir" to avoid rm treating a path starting with - as an option.

The build script now requires skopeo for --push. Add the install step to docker_build_node.yml and docker_build_node_gcp.yml, matching the pattern already used in other workflows.

- Quote all $temp_dir usages to handle paths with spaces - Use 'rm -rf --' to guard against paths starting with '-' - Add EXIT trap to clean up temp dir on failure (set -e exits)

barakeinav1 · 2026-04-09T14:09:12Z

All Copilot feedback addressed in 7db9d79: quoted all $temp_dir paths, added rm -rf -- for safety, and added trap EXIT to clean up temp dir on failure.

claude · 2026-04-09T14:12:09Z

PR title type suggestion: This PR primarily modifies GitHub Actions workflows, which are CI/CD pipeline changes. The type prefix should probably be ci: instead of build:.

Suggested title: ci: switch MPC node image push to skopeo with --preserve-digests

claude · 2026-04-09T14:12:53Z

PR title type suggestion: This PR modifies CI workflow files to change how Docker images are pushed. The type prefix should probably be ci: instead of build:.

Suggested title: ci: switch MPC node image push to skopeo with --preserve-digests

claude · 2026-04-09T14:13:21Z

PR title type suggestion: This PR primarily modifies GitHub Actions workflows (CI/CD configuration), so the prefix should probably be ci: instead of build:.

Suggested title: ci: switch MPC node image push to skopeo with --preserve-digests

gilcu3

Thank you!

gilcu3 · 2026-04-09T14:34:12Z

deployment/build-images.sh

+        rm -rf -- "$temp_dir"
+        trap - EXIT


why are these two needed? the first no needed because this will only run in CI

gilcu3 · 2026-04-09T14:34:32Z

deployment/build-images.sh

+        temp_dir=$(mktemp -d)
+        trap 'rm -rf -- "$temp_dir"' EXIT
+        skopeo copy --all --dest-compress "docker-daemon:$NODE_GCP_IMAGE_NAME:latest" "dir:$temp_dir"
+        skopeo copy --preserve-digests "dir:$temp_dir" "docker://docker.io/nearone/$NODE_GCP_IMAGE_NAME:$image_tag"
+        node_gcp_manifest_digest="sha256:$(sha256sum "$temp_dir/manifest.json" | cut -d' ' -f1)"


nit: we could put this in a function

barakeinav1 requested a review from Copilot April 9, 2026 13:40

Copilot started reviewing on behalf of barakeinav1 April 9, 2026 13:41 View session

Copilot AI reviewed Apr 9, 2026

View reviewed changes

barakeinav1 added 2 commits April 9, 2026 13:47

ci: install skopeo in node image build workflows

c841dfa

The build script now requires skopeo for --push. Add the install step to docker_build_node.yml and docker_build_node_gcp.yml, matching the pattern already used in other workflows.

fix: quote temp dir paths and add cleanup trap in build script

7db9d79

- Quote all $temp_dir usages to handle paths with spaces - Use 'rm -rf --' to guard against paths starting with '-' - Add EXIT trap to clean up temp dir on failure (set -e exits)

gilcu3 approved these changes Apr 9, 2026

View reviewed changes

		node_manifest_digest="sha256:$(sha256sum $temp_dir/manifest.json \| cut -d' ' -f1)"
		rm -rf "$temp_dir"

		node_gcp_manifest_digest="sha256:$(sha256sum $temp_dir/manifest.json \| cut -d' ' -f1)"
		rm -rf "$temp_dir"

Conversation

barakeinav1 commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

claude bot commented Apr 9, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

barakeinav1 commented Apr 9, 2026

Uh oh!

claude bot commented Apr 9, 2026

Uh oh!

claude bot commented Apr 9, 2026

Uh oh!

claude bot commented Apr 9, 2026

Uh oh!

gilcu3 left a comment

Choose a reason for hiding this comment

Uh oh!

gilcu3 Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

gilcu3 Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

barakeinav1 commented Apr 9, 2026 •

edited

Loading