Incident 2026-07-10: a Meridian build pipeline tagged its 12MB distroless meridian-service image as nemesis8:latest (created 12:48:55Z, entrypoint /meridian-service). Every subsequent n8 launch "hung": no entry, no shell, no TUI — the host n8 sat in raw mode forever and ^C was swallowed as TTY bytes (correctly, but invisibly).
Fix: stamp our image builds with a label (e.g. nemesis8.image=<version>) and have every launch path verify it via docker image inspect (containerless, ~ms) before running. On mismatch: refuse with a one-line error — "nemesis8:latest is not a nemesis8 image (entrypoint /meridian-service). Run: n8 build" — instead of an unkillable-looking hang. Also gives n8 doctor a check for free.
Secondary: consider a startup watchdog on the interactive path — if the container produces no entry banner within N seconds, print a diagnostic instead of waiting forever.
Incident 2026-07-10: a Meridian build pipeline tagged its 12MB distroless meridian-service image as
nemesis8:latest(created 12:48:55Z, entrypoint /meridian-service). Every subsequent n8 launch "hung": no entry, no shell, no TUI — the host n8 sat in raw mode forever and ^C was swallowed as TTY bytes (correctly, but invisibly).Fix: stamp our image builds with a label (e.g.
nemesis8.image=<version>) and have every launch path verify it viadocker image inspect(containerless, ~ms) before running. On mismatch: refuse with a one-line error — "nemesis8:latest is not a nemesis8 image (entrypoint /meridian-service). Run: n8 build" — instead of an unkillable-looking hang. Also givesn8 doctora check for free.Secondary: consider a startup watchdog on the interactive path — if the container produces no entry banner within N seconds, print a diagnostic instead of waiting forever.