Reference for Canton console commands used by validators and SV operators on the Global Synchronizer
For more involved debugging and disaster recovery, direct access to the console of a Canton node (participant, sequencer, mediator) might be required. Steps to obtain such access:Requirements:
Direct access to the Canton node process
Canton binary
Once you see the following banner for the console you have successfully gained access
docker run -it --rm --network host -v $(pwd)/console.conf:/app/app.conf ghcr.io/digital-asset/decentralized-canton-sync/docker/canton:0.9.4 --console
docker run -it --rm --network host -v $(pwd)/console.conf:/app/app.conf ghcr.io/digital-asset/decentralized-canton-sync/docker/canton:0.9.4 --console
docker run -it --rm --network host -v $(pwd)/console.conf:/app/app.conf ghcr.io/digital-asset/decentralized-canton-sync/docker/canton:0.9.4 --console
If you run the participant using the docker compose setup the docker command must be run with the docker network used by the participant. Adjust the configuration to connect to the participant container:
features.enable-repair-commands in console.conf only enables the repair commands in your console. From Splice 0.10.0 onwards, the participant’s repair service is disabled by default, so participant.repair commands also require enabling it on the participant itself:
Helm: set enableRepairCommands: true in the values of the splice-participant chart.
Docker compose: add canton.features.enable-repair-commands = yes as additional configuration of the participant.
Similarly, commands that export a participant’s private keys require key downloads to be enabled on the participant:
set enableKeyDownload: true in the values of the splice-participant chart, or pass --enable-key-download to start.sh for docker-compose deployments.
Note that this is not relevant for participants that use an external KMS; here the key export commands are always enabled, and never return private keys.It is recommended to disable repair commands and key downloads again once there is no specific reason to keep them enabled, to prevent accidental abuse and minimize attack surface.
In a K8s cluster you can use a debug pod to access the console directly from the cluster.First you can create a pod running the right canton version using:
kubectl debug "${POD_NAME}" --image "$(kubectl get pod "${POD_NAME}" -o json | jq -re '.spec.containers[0].image')" -i -t -- bash
where POD_NAME is the name of the participant/sequencer/mediator pod.Once you are inside the running pod you can install a text editor and create the config file console.conf that is described above.
$ apt-get update$ apt-get install -y vim$ vim console.conf # paste in the config from above$ /app/bin/canton -v -c console.conf
