feat: support creating canisters via a proxy canister#481
Conversation
Add an optional `proxy` parameter to `CreateOperation::new()`. When provided, canister creation is routed through the proxy canister's `proxy` method instead of calling the cycles ledger or management canister directly. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Combine the mutually exclusive `proxy` and `subnet` parameters into a single `CreateTarget` enum with `Subnet`, `Proxy`, and `None` variants. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add a --proxy CLI argument that conflicts with --subnet. When provided, canister creation is routed through the proxy canister. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds support for creating canisters via a proxy canister so icp canister create --proxy <principal> forwards create_canister through the proxy, ensuring placement on the proxy’s subnet.
Changes:
- Add
--proxyoption toicp canister createand document it. - Introduce
CreateTargetto route canister creation via subnet selection, proxy, or default behavior. - Add an integration test covering canister creation through a proxy and update the changelog entry.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| docs/reference/cli.md | Documents new --proxy option for icp canister create. |
| crates/icp-cli/tests/canister_create_tests.rs | Adds integration test for creating a canister via a proxy canister. |
| crates/icp-cli/src/operations/create.rs | Implements proxy-based creation path and introduces CreateTarget. |
| crates/icp-cli/src/commands/deploy.rs | Adapts deploy flow to new CreateTarget API (subnet vs default). |
| crates/icp-cli/src/commands/canister/create.rs | Adds --proxy CLI flag and wires it into creation logic via CreateTarget. |
| CHANGELOG.md | Notes the new icp canister create --proxy feature in Unreleased. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| /// When specified, the canister will be created on the same subnet as the | ||
| /// proxy canister by forwarding the management canister call through the | ||
| /// proxy's `proxy` method. | ||
| #[arg(long, conflicts_with = "subnet")] |
There was a problem hiding this comment.
is that an actual limitation of the proxy canister?
There was a problem hiding this comment.
Yes. It's the proxy canister making the inter-canister call to the management canister's create_canister method. There's no way to specify a subnet in that path; the new canister will always be created on the same subnet as the caller (the proxy canister).
The current interface-spec restricts the create_canister:
This method can only be called by canisters, i.e., it cannot be called by external users via ingress messages.
For the recent cloud-engine subnet feature, we enabled the subnet admin to call this method via ingress messages. An ingress message can use the effective_canister_id field to indirectly target a specific subnet — which is exactly how we did it.
Summary
--proxyis specified onicp canister create, thecreate_canistercall is forwarded through the proxy, placing the new canister on the same subnet as the proxyicp deployalso creates canisters but additionally involves installation;--proxysupport for deploy will be added once all involved operations support proxyingTest plan
canister_create_through_proxyintegration test passes🤖 Generated with Claude Code