Add Python demo

demos/README.md

@@ -17,6 +17,7 @@ This set of demos shows how real-world apps can be easily run inside SGX enclave
 * `https_server/`: A HTTPS file server based on [Mongoose Embedded Web Server Library](https://github.com/cesanta/mongoose).
 * `grpc/`: A client and server communicating through [gRPC](https://grpc.io/).
 * `openvino/` A benchmark of [OpenVINO Inference Engine](https://docs.openvinotoolkit.org/2019_R3/_docs_IE_DG_inference_engine_intro.html).
+* `python` A demo of [Python](https://www.python.org).
 * `tensorflow_lite/`: A demo and benchmark of [Tensorflow Lite](https://www.tensorflow.org/lite) inference engine.
 * `xgboost/`: A demo of [XGBoost](https://xgboost.readthedocs.io/en/latest/).
 

demos/python/.gitignore

@@ -0,0 +1 @@
+occlum_context/

demos/python/README.md

@@ -0,0 +1,21 @@
+# Use Python with Occlum
+
+This project demonstrates how Occlum enables [Python](https://www.python.org) programs running in SGX enclaves.
+
+Occlum is compatible with native binaries from Alpine Linux, so we can copy the Python from Alpine Linux and run it directly on Occlum.
+
+Step 1: Copy the `import_alpine_python.sh` script from an Occlum container to host
+```
+docker cp <occlum_container>:/root/demos/python/import_alpine_python.sh <host_dir>
+```
+The script downloads a Docker image of Alpine Linux with Python preinstalled and imports the rootfs of the image into an Occlum container so that later we can copy the Alpine's Python libraries into an Occlum secure FS image.
+
+Step 2: Import the rootfs of Alpine Linux's Python Docker image from host to the Occlum container (`/root/alpine_python`)
+```
+./<host_dir>/import_alpine_python.sh <occlum_container>
+```
+
+Step 3: You can attach to the Occlum container and run a `hello.py` sample on Occlum via
+```
+./run_python_on_occlum.sh
+```

demos/python/hello.py

@@ -0,0 +1,3 @@
+# Sample code
+
+print('Hello World, Python!')

demos/python/import_alpine_python.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+set -e
+script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}"  )" >/dev/null 2>&1 && pwd )"
+
+target_container=$1
+
+if [ "$target_container" == "" ];then
+cat <<EOF
+Import the rootfs of Alpine Linux's Python Docker image into a target Occlum container (/root/alpine_python)
+
+USAGE:
+    ./import_alpine_python.sh <target_container>
+
+<target_container>:
+    The id or name of Docker container that you want to copy to.
+EOF
+    exit 1
+fi
+
+alpine_python_container="alpine_python_docker"
+alpine_python_tar="$script_dir/alpine_python.tar"
+alpine_python="$script_dir/alpine_python"
+
+# Export the rootfs from Alpine's Docker image
+docker pull python:3.7-alpine3.10
+docker create --name $alpine_python_container python:3.7-alpine3.10
+docker export -o $alpine_python_tar $alpine_python_container
+docker rm $alpine_python_container
+
+# Copy the exported rootfs to the Occlum container
+rm -rf $alpine_python && mkdir -p $alpine_python
+tar -xf $alpine_python_tar -C $alpine_python
+docker cp $alpine_python $target_container:/root/
+
+# Clean up
+rm -rf $alpine_python $alpine_python_tar

demos/python/run_python_on_occlum.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+set -e
+
+BLUE='\033[1;34m'
+NC='\033[0m'
+
+alpine_fs="/root/alpine_python"
+
+if [ ! -d $alpine_fs ];then
+    echo "Error: cannot stat '$alpine_fs' directory"
+    echo "Please see README and import the rootfs of Alpine Linux's Python Docker image"
+    exit 1
+fi
+
+# 1. Init Occlum Workspace
+rm -rf occlum_context && mkdir occlum_context
+cd occlum_context
+occlum init
+
+# 2. Copy files into Occlum Workspace and build
+cp $alpine_fs/usr/local/bin/python3.7 image/bin
+cp $alpine_fs/usr/local/lib/libpython3.7m.so.1.0 image/lib
+cp $alpine_fs/usr/local/lib/libpython3.so image/lib
+cp -r $alpine_fs/usr/local/lib/python3.7 image/lib
+cp ../hello.py image
+occlum build
+
+# 3. Run the hello world sample
+echo -e "${BLUE}occlum run /bin/python3.7 hello.py${NC}"
+occlum run /bin/python3.7 hello.py

deps/sefs

@@ -1 +1 @@
-Subproject commit 8379fe273871de8fcfedf01f3b95ec73c91d548c
+Subproject commit 6bdce43eafde51ec9eff4fb71c0106747b18a7d1