diff --git a/.circleci/config.yml b/.circleci/config.yml
index 4be9c710b..c0b5b8b4f 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -596,8 +596,8 @@ jobs:
                       command: |
                         docker push filecoin/<<parameters.image>>:<<parameters.channel>>
                         if [[ ! -z $CIRCLE_SHA ]]; then
-                          docker image tag filecoin/<<parameters.image>>:<<parameters.channel>>-<<parameters.network>> filecoin/<<parameters.image>>:"${CIRCLE_SHA}"
-                          docker push filecoin/<<parameters.image>>:"${CIRCLE_SHA}"
+                          docker image tag filecoin/<<parameters.image>>:<<parameters.channel>>> filecoin/<<parameters.image>>:"${CIRCLE_SHA:0:7}"
+                          docker push filecoin/<<parameters.image>>:"${CIRCLE_SHA:0:7}"
                         fi
                         if [[ ! -z $CIRCLE_TAG ]]; then
                           docker image tag filecoin/<<parameters.image>>:<<parameters.channel>> filecoin/<<parameters.image>>:"${CIRCLE_TAG}"
@@ -626,8 +626,8 @@ jobs:
                       command: |
                         docker push filecoin/<<parameters.image>>:<<parameters.channel>>-<<parameters.network>>
                         if [[ ! -z $CIRCLE_SHA ]]; then
-                          docker image tag filecoin/<<parameters.image>>:<<parameters.channel>>-<<parameters.network>> filecoin/<<parameters.image>>:"${CIRCLE_SHA}"-<<parameters.network>>
-                          docker push filecoin/<<parameters.image>>:"${CIRCLE_SHA}"-<<parameters.network>>
+                          docker image tag filecoin/<<parameters.image>>:<<parameters.channel>>-<<parameters.network>> filecoin/<<parameters.image>>:"${CIRCLE_SHA:0:7}"-<<parameters.network>>
+                          docker push filecoin/<<parameters.image>>:"${CIRCLE_SHA:0:7}"-<<parameters.network>>
                         fi
                         if [[ ! -z $CIRCLE_TAG ]]; then
                           docker image tag filecoin/<<parameters.image>>:<<parameters.channel>>-<<parameters.network>> filecoin/<<parameters.image>>:"${CIRCLE_TAG}"-<<parameters.network>>
diff --git a/.circleci/template.yml b/.circleci/template.yml
index 4240d7ae2..f56950faf 100644
--- a/.circleci/template.yml
+++ b/.circleci/template.yml
@@ -596,8 +596,8 @@ jobs:
                       command: |
                         docker push filecoin/<<parameters.image>>:<<parameters.channel>>
                         if [["[[ ! -z $CIRCLE_SHA ]]"]]; then
-                          docker image tag filecoin/<<parameters.image>>:<<parameters.channel>>-<<parameters.network>> filecoin/<<parameters.image>>:"${CIRCLE_SHA}"
-                          docker push filecoin/<<parameters.image>>:"${CIRCLE_SHA}"
+                          docker image tag filecoin/<<parameters.image>>:<<parameters.channel>>> filecoin/<<parameters.image>>:"${CIRCLE_SHA:0:7}"
+                          docker push filecoin/<<parameters.image>>:"${CIRCLE_SHA:0:7}"
                         fi
                         if [["[[ ! -z $CIRCLE_TAG ]]"]]; then
                           docker image tag filecoin/<<parameters.image>>:<<parameters.channel>> filecoin/<<parameters.image>>:"${CIRCLE_TAG}"
@@ -626,8 +626,8 @@ jobs:
                       command: |
                         docker push filecoin/<<parameters.image>>:<<parameters.channel>>-<<parameters.network>>
                         if [["[[ ! -z $CIRCLE_SHA ]]"]]; then
-                          docker image tag filecoin/<<parameters.image>>:<<parameters.channel>>-<<parameters.network>> filecoin/<<parameters.image>>:"${CIRCLE_SHA}"-<<parameters.network>>
-                          docker push filecoin/<<parameters.image>>:"${CIRCLE_SHA}"-<<parameters.network>>
+                          docker image tag filecoin/<<parameters.image>>:<<parameters.channel>>-<<parameters.network>> filecoin/<<parameters.image>>:"${CIRCLE_SHA:0:7}"-<<parameters.network>>
+                          docker push filecoin/<<parameters.image>>:"${CIRCLE_SHA:0:7}"-<<parameters.network>>
                         fi
                         if [["[[ ! -z $CIRCLE_TAG ]]"]]; then
                           docker image tag filecoin/<<parameters.image>>:<<parameters.channel>>-<<parameters.network>> filecoin/<<parameters.image>>:"${CIRCLE_TAG}"-<<parameters.network>>
diff --git a/cli/helper.go b/cli/helper.go
index c4a61397c..81a5bb033 100644
--- a/cli/helper.go
+++ b/cli/helper.go
@@ -4,6 +4,8 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"os/signal"
+	"syscall"
 
 	ufcli "github.com/urfave/cli/v2"
 	"golang.org/x/xerrors"
@@ -36,6 +38,13 @@ func IncorrectNumArgs(cctx *ufcli.Context) error {
 }
 
 func RunApp(app *ufcli.App) {
+	c := make(chan os.Signal, 1)
+	signal.Notify(c, syscall.SIGTERM, syscall.SIGINT)
+	go func() {
+		<-c
+		os.Exit(1)
+	}()
+
 	if err := app.Run(os.Args); err != nil {
 		if os.Getenv("LOTUS_DEV") != "" {
 			log.Warnf("%+v", err)
diff --git a/itests/kit/log.go b/itests/kit/log.go
index 2932255d2..beac3895c 100644
--- a/itests/kit/log.go
+++ b/itests/kit/log.go
@@ -13,6 +13,7 @@ func QuietMiningLogs() {
 	_ = logging.SetLogLevel("chainstore", "ERROR")
 	_ = logging.SetLogLevel("chain", "ERROR")
 	_ = logging.SetLogLevel("sub", "ERROR")
+	_ = logging.SetLogLevel("wdpost", "ERROR")
 	_ = logging.SetLogLevel("storageminer", "ERROR")
 	_ = logging.SetLogLevel("pubsub", "ERROR")
 	_ = logging.SetLogLevel("gen", "ERROR")
diff --git a/itests/multisig_test.go b/itests/multisig_test.go
index 63cc2f511..b20dcf16b 100644
--- a/itests/multisig_test.go
+++ b/itests/multisig_test.go
@@ -133,7 +133,7 @@ func TestMultisigReentrant(t *testing.T) {
 	sl, err := client.StateReplay(ctx, types.EmptyTSK, pm.Cid())
 	require.NoError(t, err, "failed to replay reentrant propose message (StateWaitMsg)")
 
-	require.Equal(t, 1025, countDepth(sl.ExecutionTrace))
+	require.Equal(t, 1025, countDepth(sl.ExecutionTrace), "failed: %s", sl.Error)
 }
 
 func countDepth(trace types.ExecutionTrace) int {
diff --git a/itests/raft_messagesigner_test.go b/itests/raft_messagesigner_test.go
index 22dd7a5eb..220da9699 100644
--- a/itests/raft_messagesigner_test.go
+++ b/itests/raft_messagesigner_test.go
@@ -488,6 +488,8 @@ func TestChainStoreSync(t *testing.T) {
 }
 
 func TestGoRPCAuth(t *testing.T) {
+	// TODO Fix Raft, then enable this test. https://github.com/filecoin-project/lotus/issues/9888
+	t.SkipNow()
 
 	blockTime := 1 * time.Second
 
diff --git a/node/shutdown.go b/node/shutdown.go
index e630031da..f44ca0857 100644
--- a/node/shutdown.go
+++ b/node/shutdown.go
@@ -51,6 +51,7 @@ func MonitorShutdown(triggerCh <-chan struct{}, handlers ...ShutdownHandler) <-c
 		close(out)
 	}()
 
+	signal.Reset(syscall.SIGTERM, syscall.SIGINT)
 	signal.Notify(sigCh, syscall.SIGTERM, syscall.SIGINT)
 	return out
 }
diff --git a/snap/snapcraft.yaml b/snap/snapcraft.yaml
index 8c7323a2b..2b9862808 100644
--- a/snap/snapcraft.yaml
+++ b/snap/snapcraft.yaml
@@ -36,7 +36,7 @@ parts:
       - libhwloc15
       - ocl-icd-libopencl1
     override-build: |
-      LDFLAGS="" make lotus lotus-miner lotus-worker
+      LDFLAGS="-z noexecstack" make lotus lotus-miner lotus-worker
       cp lotus lotus-miner lotus-worker $SNAPCRAFT_PART_INSTALL
       cp scripts/snap-lotus-entrypoint.sh $SNAPCRAFT_PART_INSTALL