use public ethereum2-monitor image

[vaclav-ssvlabs]

use public e2m lmage instead of building it locally

[ovidiu-ssv-labs]

Small, correct change: it drops the local clone/build of ethereum2-monitor and points params.yaml at the public ssvlabs/ethereum2-monitor:latest image. Verified on Docker Hub that the image exists, is public, and resolves to a runnable linux/amd64 image, and the wiring (utils.get_monitor_image → params → monitor.star ServiceConfig) needed no code changes. No correctness/concurrency/security defects, and the monitor is disabled by default so the blast radius is small.

Verdict: with fixes — findings 2 and 3 are left inline on params.yaml:61; findings 1 and 4 below aren't tied to a changed line.

---

Finding 1 · [IMPORTANT] Stale docs still instruct cloning/building the monitor locally — README.md:16

This PR removes the ethereum2-monitor clone/build from the Makefile prepare target and repoints the image to the public registry, but three pieces of documentation still describe the old behavior and are now wrong:

• README.md:16-17 — the make run-with-prepare description says it will "Clone the required repositories (ssv, anchor, ethereum2-monitor)" and checkout branches for it. After this PR, prepare does neither for the monitor.
• README.md:36-38 and CLAUDE.md:50-52 — the Manual Setup sections tell contributors to git clone .../ethereum2-monitor.git and docker build -t monitor .. That locally-built monitor tag is now silently ignored, because params.yaml points at ssvlabs/ethereum2-monitor:latest. This is exactly the footgun the README already documents for anchor at lines 105-113.
• README.md:101 — the Repository Management section still lists Ethereum2-Monitor cloning as something prepare does.
• Makefile:9 — the run-with-prepare comment still reads "Downloads latest repos (ssv stage, anchor unstable, ethereum2-monitor main) and builds Docker images".

Why it matters: docs are the contract for a dev-environment repo whose whole purpose is easy onboarding. Leaving these inconsistent sends contributors down a dead-end setup path and erodes trust in the README.

Suggested fix: Update all four locations: README.md:16-17 drop ethereum2-monitor from the clone/checkout bullets; README.md:36-38 and CLAUDE.md:50-52 remove the git clone/docker build block or note ssv-mini now consumes the public image (mirroring the anchor note at README:105-113); README.md:101 remove the Ethereum2-Monitor clone bullet; Makefile:9 drop 'ethereum2-monitor main' from the comment.

---

Finding 4 · [MINOR] Removes the local-monitor iteration path with no documented override — Makefile:9

By deleting the clone+build block from prepare, this PR removes the only supported way to run ssv-mini against a locally-modified ethereum2-monitor build. A developer iterating on the monitor itself can no longer just make prepare and have their changes picked up; they must manually build and edit params.yaml:61 to point at it — the same manual workaround the README already documents for anchor (README:105-113).

This is an intentional trade-off of the PR (the goal is to consume the public image), not a defect, so it is minor. But since the anchor override is already called out in the docs, the monitor deserves a parallel note so the workflow isn't lost tribal knowledge.

Suggested fix: Add a short note near the existing anchor workaround (README:105-113): to test local monitor changes, docker build -t node/monitor . in ethereum2-monitor and set images.monitor: "node/monitor" in params.yaml.

---

4 findings — inline on the diff where possible.

[ovidiu-ssv-labs]

Finding 2 · [MINOR] Pin monitor image to a version instead of floating :latest

The new reference ssvlabs/ethereum2-monitor:latest uses a mutable, floating tag. Confirmed on Docker Hub that this repo's tags are NOT immutable (immutable_tags_settings.enabled: false), so latest drifts whenever a new image is pushed (it currently points at the same digest as v1.0.134, pushed 2026-06-18).

This is inconsistent with the rest of the repo, which pins essentially everything else for reproducibility: ssv via SSV_COMMIT, anchor: sigp/anchor:v0.3.1, redis: 7.4.2, postgres: 15, el_image: ethereum/client-go:v1.15.10, cl_image: sigp/lighthouse:v8.0.0-rc.1. With :latest, two developers running make run on different days can silently get different monitor versions, and a future monitor release can break ssv-mini with no diff in this repo. Minor rather than important because monitoring is disabled by default (params.yaml:49 monitor.enabled: false).

Suggested fix:

  monitor: "ssvlabs/ethereum2-monitor:v1.0.134" # bump deliberately; use :latest only for local experimentation

[ovidiu-ssv-labs]

Finding 3 · [MINOR] Public image is amd64-only — emulated on Apple Silicon

Inspecting the Docker Hub manifest for every tag of ssvlabs/ethereum2-monitor (including latest), the only runnable platform published is linux/amd64; the second manifest entry is unknown/unknown (the buildx SBOM/provenance attestation, not arm64). There is no native arm64 variant.

Previously make prepare built the monitor locally, which on Apple Silicon produced a native arm64 image. After this change, enabling the monitor pulls the amd64-only image and Docker Desktop runs it under emulation (qemu/Rosetta), which is slower and occasionally surfaces subtle runtime differences. Not a hard break, and the monitor is off by default, but a real regression in the local-dev experience worth flagging.

Suggested fix: Ideally publish ethereum2-monitor as a multi-arch (amd64+arm64) image so Apple Silicon devs get native execution. Short of that, add a one-line note in the README monitor/troubleshooting section that the published image is amd64-only and runs emulated on arm64 hosts.