Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -174,6 +174,7 @@ To start all available features, or you want more customized operations, navigat
- **Gradle Docker**: Automate Docker image builds and testing. Check the [gradle docker](./tools/docker/README.md) documentation.
- **Toolkit**: Perform a set of database related operations. Follow the [Toolkit guidance](./tools/toolkit/README.md).
- **Stress Test**: Execute the stress test. Follow the [stress test guidance](./tools/stress_test/README.md).
- **Slack SR Monitor**: Monitor Super Representatives and notify a Slack channel after every maintenance period. Follow the [Slack SR Monitor guidance](./tools/slack_sr_monitor/README.md).

## Troubleshooting
If you encounter any difficulties, please refer to the [Issue Work Flow](https://tronprotocol.github.io/documentation-en/developers/issue-workflow/#issue-work-flow), then raise an issue on [GitHub](https://github.com/tronprotocol/tron-docker/issues). For general questions, please use [Discord](https://discord.gg/cGKSsRVCGm) or [Telegram](https://t.me/TronOfficialDevelopersGroupEn).
Expand Down
8 changes: 8 additions & 0 deletions tools/slack_sr_monitor/.env.example
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# Slack SR Monitor Configuration

# The Slack Webhook URL for sending notifications
SLACK_WEBHOOK=your_slack_webhook_url_here

# The Tron node API endpoint
# Default: https://api.trongrid.io
TRON_NODE=https://api.trongrid.io
3 changes: 3 additions & 0 deletions tools/slack_sr_monitor/.gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
slack_sr_monitor
logs/
.env
33 changes: 33 additions & 0 deletions tools/slack_sr_monitor/Dockerfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
# Build stage
FROM golang:1.25-alpine@sha256:8d22e29d960bc50cd025d93d5b7c7d220b1ee9aa7a239b3c8f55a57e987e8d45 AS builder

WORKDIR /app

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[MUST] Builder base image missing digest pinning

Problem:

FROM golang:1.25-alpine AS builder lacks @sha256 digest.

Why this is P0 (Critical):

  1. Non-reproducible builds — Docker Hub may update golang:1.25-alpine tag without notice. Building today vs tomorrow produces different binaries.
  2. Supply chain traceability lost — Cannot audit which exact version was used in each build. Critical for security compliance.
  3. Security vulnerability — New golang versions may have breaking changes or removed dependencies. Without pinned digest, application may fail to start in production.
  4. No rollback capability — If an image breaks production, cannot roll back to previous version because the tag floats.
  5. Historical precedent — tron-docker has SA-002 (base image not pinned), this is a known vulnerability in the project.

Fix:

docker pull golang:1.25-alpine
docker inspect golang:1.25-alpine --format='{{index .RepoDigests 0}}'
# Replace: FROM golang:1.25-alpine@sha256:abc123...

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in f330c1a. Pinned to golang:1.25-alpine@sha256:8d22e29d960bc50cd025d93d5b7c7d220b1ee9aa7a239b3c8f55a57e987e8d45. Thanks for the catch.

# Install dependencies
COPY go.mod go.sum ./
RUN go mod download

# Copy source code
COPY . .

# Build the application
RUN CGO_ENABLED=0 GOOS=linux go build -o slack_sr_monitor main.go

# Final stage
FROM alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc

RUN apk --no-cache add ca-certificates tzdata \
&& addgroup -S monitor && adduser -S -G monitor monitor

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[MUST] Runtime base image using :latest tag (no digest)

Problem:

FROM alpine:latest is a floating tag with no @sha256 digest.

Why this is P0 (Critical):

  1. Worst-case version management — :latest is the most unstable tag. Rebuild tomorrow and get completely different image.
  2. Zero image consistency guarantee — Same Dockerfile produces different image on each rebuild.
  3. Supply chain attack surface — Anyone (including attackers) could upload new alpine:latest to Docker Hub. Containers auto-pull the poisoned image.
  4. Production safety compromised — Cannot rollback to previous version if new alpine breaks the app. Cannot diagnose which version caused the problem.
  5. Deployment uncertainty — Image contents are non-deterministic. Violates infrastructure-as-code principle.

Fix:

docker pull alpine:3.20
docker inspect alpine:3.20 --format='{{index .RepoDigests 0}}'
# Replace: FROM alpine:3.20@sha256:xyz789...

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in f330c1a. Switched to alpine:3.20@sha256:d9e853e87e55526f6b2917df91a2115c36dd7c696a35be12163d44e6e2a4b6bc. Agree that :latest provides no reproducibility guarantee.

WORKDIR /home/monitor

# Create logs directory owned by the non-root user
RUN mkdir -p logs && chown -R monitor:monitor /home/monitor

# Copy the binary from builder
COPY --from=builder --chown=monitor:monitor /app/slack_sr_monitor .

USER monitor

# Command to run
CMD ["./slack_sr_monitor"]
63 changes: 63 additions & 0 deletions tools/slack_sr_monitor/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,63 @@
## Slack SR Monitor Tool
The Slack SR Monitor tool is designed to monitor TRON Super Representatives (SRs) and notify a Slack channel after every maintenance period.
It automatically tracks vote changes and detects replacements in the top 27 SR positions, providing a clear and formatted report.

### Build and Run the monitor
To run the monitor tool, you can choose between native Go execution or Docker deployment.

#### Native Go Execution
Make sure you have Go 1.25+ installed.
```shell
# enter the directory
cd tools/slack_sr_monitor
# install dependencies
go mod tidy
# run the tool
go run main.go
```

#### Docker Deployment
We provide a Docker-based deployment for easier management in production environments.
```shell
# build and start the container
docker-compose up -d --build
# check logs
docker logs -f slack-sr-monitor
```

### Configuration
All configurations are managed via environment variables or a `.env` file in the project root. Please refer to [.env.example](./.env.example) as an example.

- `SLACK_WEBHOOK`: The Slack Incoming Webhook URL used to send notifications.
- `TRON_NODE`: The TRON node HTTP API endpoint (e.g., `http://https://api.trongrid.io`). Default is Trongrid.

### Key Features

#### SR vote monitor
Use `/wallet/getpaginatednowwitnesslist` to get the top **28** real-time votes, also the SR address and URL.

#### Dynamic Scheduling
Instead of a fixed interval, the tool queries `/wallet/getnextmaintenancetime` to calculate the exact wait time. It triggers the report **1 minute** after each maintenance period begins to ensure data consistency.

#### Parallel Data Acquisition
The tool uses Go routines to fetch `account_name` for all 28 witnesses in parallel from the `/wallet/getaccount` interface, significantly reducing the collection time.

#### Vote Change Tracking
The tool maintains an in-memory snapshot of the previous period's votes. It calculates the `Change` for each SR:
```text
*1. Poloniex*
Current: `3,228,089,488` Change: `+89,488`
```

#### Top 27 Replacement Detection
After each report, it compares the current Top 27 list with the previous one and highlights any changes:
```text
SR Replacement Detected:
>:inbox_tray: *Entered:* New_SR_Name
>:outbox_tray: *Left:* Old_SR_Name
```
If no changes occur, it displays `Top 27 SRs remain unchanged.`

### Notifications

This monitor only support java-tron node v4.8.1+, because of the API it used.
10 changes: 10 additions & 0 deletions tools/slack_sr_monitor/docker-compose.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
services:
slack-sr-monitor:
build: .
container_name: slack-sr-monitor
restart: unless-stopped
environment:
- SLACK_WEBHOOK=${SLACK_WEBHOOK}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[SHOULD] Restart policy 'always' risks infinite restart loop

Problem:

restart: always

Container will be restarted infinitely, even on persistent failures.

Why this is P1 (Should Fix):

Scenario: Invalid Slack Webhook

10:00:00 - Container starts → checks SLACK_WEBHOOK env var → invalid → os.Exit(1)
10:00:01 - Docker: container crashed, restart: always → restart container
10:00:02 - Container starts → checks SLACK_WEBHOOK → invalid → os.Exit(1)
10:00:03 - Docker: container crashed → restart
...
10:05:00 - 300+ restart attempts, logs flooded, CPU spinning

Consequences:

  1. Problem masking — Error is hidden in restart loop. Developer sees "container restarting" but doesn't see the root cause (invalid webhook URL).
  2. Log spam — Logs filled with restart attempts, making debugging harder. Real errors buried under restart messages.
  3. Resource waste — Container keeps starting/stopping, wasting CPU and I/O.
  4. Delayed incident response — Takes longer to discover and diagnose the actual problem.
  5. Hard to stop gracefully — Docker stop doesn't prevent auto-restart; need docker update --restart=no to halt it.

Comparison of restart policies:

Policy Behavior Use Case
always Restart forever, even after intentional stop ❌ Masks failures
unless-stopped Restart unless manually stopped (recommended) ✅ Failures visible, can diagnose
on-failure:5 Restart max 5 times ✅ Expose persistent failures after N retries

Fix:

services:
  slack-sr-monitor:
    # Option 1 (Recommended): Stop on failure, allow manual restart
    restart: unless-stopped
    
    # Option 2: Auto-restart but stop after 5 failed attempts
    # restart: on-failure:5

Benefit of 'unless-stopped': When the service crashes, it stays down until manual intervention. This forces developers to investigate instead of ignoring the logs.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed, switched to restart: unless-stopped in f330c1a. Your reasoning about failure visibility makes sense — a misconfigured webhook should surface as a stopped container rather than be hidden in a restart loop.

- TRON_NODE=${TRON_NODE:-https://api.trongrid.io}
volumes:
- ./logs:/home/monitor/logs
5 changes: 5 additions & 0 deletions tools/slack_sr_monitor/go.mod
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
module github.com/tronprotocol/tron-docker/tools/slack_sr_monitor

go 1.25.5

require github.com/joho/godotenv v1.5.1
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please check the security of this package

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This package is the de-facto standard for environment variable management in the Go community (10k+ Stars), repo: https://github.com/joho/godotenv. Its logic is minimal and transparent (reading local files only).

I've scanned the project using the official Go vulnerability tool govulncheck, and no vulnerabilities were detected in this package.

2 changes: 2 additions & 0 deletions tools/slack_sr_monitor/go.sum
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
Loading