From 9f555821655fa9476269906305580ef85fe96585 Mon Sep 17 00:00:00 2001 From: DC Date: Wed, 17 Jun 2026 12:08:20 -0600 Subject: [PATCH 1/2] chore: track latest Zebra release instead of pinning a version Change the default Zebra image from zfnd/zebra:5.0.0 to zfnd/zebra:latest so the stack picks up new Zebra releases without a manual pin bump. Updates the compose default (docker-compose.yml), the mirrored default in docs/docker-architecture.md, and the override examples in .env.example and README.md. Operators can still pin a specific version via Z3_ZEBRA_IMAGE. The source-build git tag in scripts/vendor.sh is left unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) --- .env.example | 2 +- README.md | 2 +- docker-compose.yml | 2 +- docs/docker-architecture.md | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.env.example b/.env.example index f2aed88..b16be76 100644 --- a/.env.example +++ b/.env.example @@ -20,7 +20,7 @@ # Image pins. Defaults live in docker-compose.yml as ${VAR:-tag} fallbacks; # override per pin here to test a pre-release or pin a digest. -# Z3_ZEBRA_IMAGE=zfnd/zebra:5.0.0 +# Z3_ZEBRA_IMAGE=zfnd/zebra:latest # Z3_ZAINO_IMAGE=zingodevops/zainod:0.4.0-rc.2 # Z3_ZALLET_IMAGE=electriccoinco/zallet:v0.1.0-alpha.3 # Z3_ZEBRA_BUILD_FEATURES=default-release-binaries diff --git a/README.md b/README.md index c26bd4e..a7a464b 100644 --- a/README.md +++ b/README.md @@ -309,7 +309,7 @@ Z3_ZEBRA_RUST_LOG=debug Z3_ZAINO_RUST_LOG=debug # Pin a different image version -Z3_ZEBRA_IMAGE=zfnd/zebra:5.0.0 +Z3_ZEBRA_IMAGE=zfnd/zebra:latest # Move chain state to an external SSD Z3_CHAIN_DATA_PATH=/mnt/ssd/zebra-state diff --git a/docker-compose.yml b/docker-compose.yml index 1d842ea..9ecba14 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -30,7 +30,7 @@ x-common: &common services: zebra: - image: ${Z3_ZEBRA_IMAGE:-zfnd/zebra:5.0.0} + image: ${Z3_ZEBRA_IMAGE:-zfnd/zebra:latest} # Zebra is multi-arch; Docker selects the host's native variant. # DOCKER_PLATFORM forces a specific arch for cross-architecture testing. platform: ${DOCKER_PLATFORM:-} diff --git a/docs/docker-architecture.md b/docs/docker-architecture.md index eb0c982..3b2389d 100644 --- a/docs/docker-architecture.md +++ b/docs/docker-architecture.md @@ -28,7 +28,7 @@ The core principle: **`docker-compose.yml` is self-sufficient for mainnet**. Eve Every variable reference in `docker-compose.yml` includes a default value: ```yaml -image: ${Z3_ZEBRA_IMAGE:-zfnd/zebra:5.0.0} +image: ${Z3_ZEBRA_IMAGE:-zfnd/zebra:latest} environment: ZEBRA_NETWORK__NETWORK: ${Z3_NETWORK:-Mainnet} volumes: From 1a1245ec23eba30b8cc8caf23afa5abd503a7dec Mon Sep 17 00:00:00 2001 From: DC Date: Wed, 17 Jun 2026 12:10:36 -0600 Subject: [PATCH 2/2] docs: correct README upgrade wording for latest Zebra tag The "Running in production" section claimed pinned image versions with no surprise upgrades. Zebra now tracks the latest tag, so note that a pull can bring a new Zebra release and that operators wanting reproducibility should pin via Z3_ZEBRA_IMAGE. Zaino and Zallet remain pinned by default. Co-Authored-By: Claude Opus 4.8 (1M context) --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index a7a464b..03098ce 100644 --- a/README.md +++ b/README.md @@ -95,7 +95,7 @@ Z3 ships production-shaped defaults, but a few choices are yours to make before - **Tune the host network (Linux).** On a busy mainnet node, default kernel TCP buffer and connection-backlog limits can cap Zebra's peer throughput. See [Zebra's TCP tuning notes](https://github.com/ZcashFoundation/zebra/pull/10513) for the `sysctl` values worth raising. - **Bound resources on a shared host.** No CPU or memory limits are set by default: right for a dedicated node, easy to get wrong on a shared box. Add `deploy.resources.limits` in an override file if you need them. -Z3 ships safe defaults: pinned image versions (no surprise upgrades), non-root containers with Linux capabilities dropped, health checks that hold the wallet back until the node is synced, and automatic restart. Upgrades stay deliberate: bump the version pin in a reviewed change, or set `Z3__IMAGE`. +Z3 ships safe defaults: non-root containers with Linux capabilities dropped, health checks that hold the wallet back until the node is synced, and automatic restart. Zebra tracks the `latest` published image, so a `docker compose pull` can bring in a new Zebra release; for fully reproducible upgrades, pin a specific version with `Z3_ZEBRA_IMAGE`. Zaino and Zallet are pinned by default — bump them in a reviewed change or override with `Z3_ZAINO_IMAGE` / `Z3_ZALLET_IMAGE`. ### Monitoring