diff --git a/tools/docker/Dockerfile.ubuntu22.04 b/tools/docker/Dockerfile.ubuntu22.04 new file mode 100644 index 00000000..f50c3e92 --- /dev/null +++ b/tools/docker/Dockerfile.ubuntu22.04 @@ -0,0 +1,215 @@ +FROM alpine:3.11 AS alpine + +LABEL maintainer="Qi Zheng " + +RUN apk update && \ + apk --no-cache add openjdk11 openjdk8 --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community + +FROM ubuntu:22.04 + +LABEL maintainer="Qi Zheng " + +#The default shell for the RUN instruction is ["/bin/sh", "-c"], which sometimes cause unexpected error +#for example "source a_file". Use bash as default shell instead. +SHELL ["/bin/bash", "-c"] + +RUN apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-install-recommends \ + alien \ + astyle \ + autoconf \ + automake \ + bison \ + build-essential \ + ca-certificates \ + cmake \ + curl \ + debhelper \ + expect \ + g++ \ + gawk \ + gdb \ + git-core \ + golang-go \ + jq \ + kmod \ + lcov \ + libboost-system-dev \ + libboost-thread-dev \ + libclang-dev \ + libcurl4-openssl-dev \ + libfuse-dev \ + libjsoncpp-dev \ + liblog4cpp5-dev \ + libprotobuf-c-dev \ + libprotobuf-dev \ + libssl-dev \ + libtool \ + libxml2-dev \ + nano \ + ocaml \ + ocamlbuild \ + pkg-config \ + protobuf-compiler \ + python-is-python3 \ + python3-pip \ + sudo \ + unzip \ + uuid-dev \ + vim \ + wget \ + zip \ + gnupg \ + aptitude \ + rsync \ + cpuid \ + && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists/* + +RUN echo "ca_directory=/etc/ssl/certs" >> /etc/wgetrc && \ + echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu jammy main' | tee /etc/apt/sources.list.d/intel-sgx.list &&\ + wget -qO - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key --no-check-certificate | apt-key add - + +# Install cpuid tool for tests +# WORKDIR /tmp +# RUN wget http://www.etallen.com/cpuid/cpuid-20200211.x86_64.tar.gz && \ +# tar -xf ./cpuid-20200211.x86_64.tar.gz && \ +# cp ./cpuid-20200211/cpuid /usr/bin/ && \ +# rm -rf /tmp/cpuid-20200211* + +# Install Rust +ENV PATH="/root/.cargo/bin:$PATH" +ENV OCCLUM_RUST_VERSION=nightly-2022-10-22 +RUN curl https://sh.rustup.rs -sSf | \ + sh -s -- --default-toolchain ${OCCLUM_RUST_VERSION} -y && \ + rm -rf /root/.cargo/registry && rm -rf /root/.cargo/git && \ + cargo -V + +# Install SGX PSW +ARG PSW_VERSION=2.20.100.4 +ARG DCAP_VERSION=1.17.100.4 +RUN apt-get update && aptitude install -y \ + libsgx-launch-dev=$PSW_VERSION-jammy1 \ + libsgx-epid-dev=$PSW_VERSION-jammy1 \ + libsgx-quote-ex-dev=$PSW_VERSION-jammy1 \ + libsgx-urts=$PSW_VERSION-jammy1 \ + libsgx-enclave-common=$PSW_VERSION-jammy1 \ + libsgx-uae-service=$PSW_VERSION-jammy1 \ + libsgx-ae-epid=$PSW_VERSION-jammy1 \ + libsgx-ae-le=$PSW_VERSION-jammy1 \ + libsgx-ae-pce=$PSW_VERSION-jammy1 \ + libsgx-aesm-launch-plugin=$PSW_VERSION-jammy1 \ + sgx-aesm-service=$PSW_VERSION-jammy1 \ + libsgx-aesm-launch-plugin=$PSW_VERSION-jammy1 \ + libsgx-aesm-pce-plugin=$PSW_VERSION-jammy1 \ + libsgx-aesm-ecdsa-plugin=$PSW_VERSION-jammy1 \ + libsgx-aesm-epid-plugin=$PSW_VERSION-jammy1 \ + libsgx-aesm-quote-ex-plugin=$PSW_VERSION-jammy1 \ + libsgx-ae-id-enclave=$DCAP_VERSION-jammy1 \ + libsgx-ae-qe3=$DCAP_VERSION-jammy1 \ + libsgx-ae-qve=$DCAP_VERSION-jammy1 \ + libsgx-dcap-quote-verify=$DCAP_VERSION-jammy1 \ + libsgx-dcap-quote-verify-dev=$DCAP_VERSION-jammy1 \ + libsgx-dcap-ql=$DCAP_VERSION-jammy1 \ + libsgx-dcap-ql-dev=$DCAP_VERSION-jammy1 \ + libsgx-epid=$PSW_VERSION-jammy1 \ + libsgx-quote-ex=$PSW_VERSION-jammy1 \ + libsgx-pce-logic=$DCAP_VERSION-jammy1 \ + libsgx-qe3-logic=$DCAP_VERSION-jammy1 \ + libsgx-launch=$PSW_VERSION-jammy1 \ + libsgx-dcap-default-qpl=$DCAP_VERSION-jammy1 \ + && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists/* && \ + ln -s /usr/lib/x86_64-linux-gnu/libsgx_enclave_common.so.1 /usr/lib/x86_64-linux-gnu/libsgx_enclave_common.so + +# Install SGX SDK +WORKDIR /tmp +RUN git clone -b sgx_2.20_for_occlum https://github.com/occlum/linux-sgx && \ + mkdir /etc/init && \ + cd linux-sgx && \ + make preparation && \ + ./compile_and_install.sh no_mitigation USE_OPT_LIBS=3 && \ + echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \ + rm -rf /tmp/linux-sgx + +# Download the Occlum source +ARG OCCLUM_BRANCH +WORKDIR /root +RUN git clone -b $OCCLUM_BRANCH https://github.com/occlum/occlum && \ + cd /root/occlum && git submodule update --init && \ + mkdir -p /opt/occlum/ && \ + cp /root/occlum/tools/docker/start_aesm.sh /opt/occlum/ + +# Install Occlum toolchain +WORKDIR /root/occlum/tools/toolchains +RUN cd musl-gcc && ./build.sh && ./install_zlib.sh && cd .. && rm -rf musl-gcc +ENV PATH="/opt/occlum/build/bin:/usr/local/occlum/bin:$PATH" + +# Install glibc +WORKDIR /root/occlum/tools/toolchains +RUN cd glibc && ./build.sh occlum-glibc-2.35 && cd .. && rm -rf glibc && rm -rf /tmp/glibc* + +# Install Occlum Golang toolchain +WORKDIR /root/occlum/tools/toolchains +RUN cd golang && ./build.sh && cd .. && rm -rf golang +ENV PATH="/opt/occlum/toolchains/golang/bin:$PATH" + +# Install Occlum Rust toolchain +WORKDIR /root/occlum/tools/toolchains +RUN cd rust && ./build.sh && cd .. && rm -rf rust +ENV PATH="/opt/occlum/toolchains/rust/bin:$PATH" +ENV LD_LIBRARY_PATH="/opt/intel/sgxsdk/sdk_libs" + +# Install Occlum bash +WORKDIR /root/occlum/tools/toolchains +RUN cd bash && ./build.sh && cd .. && rm -rf bash + +# Install Occlum busybox +WORKDIR /root/occlum/tools/toolchains +RUN cd busybox && ./build.sh && cd .. && rm -rf busybox + +# Install Occlum Java toolchain (JDK 11) +ARG JDK11_PATH=/opt/occlum/toolchains/jvm/java-11-openjdk +COPY --from=alpine /usr/lib/jvm/java-11-openjdk $JDK11_PATH +RUN rm $JDK11_PATH/lib/security/cacerts +COPY --from=alpine /etc/ssl/certs/java/cacerts $JDK11_PATH/lib/security/cacerts +WORKDIR /root/occlum/tools/toolchains +RUN cd java && ./install_dragonwell.sh && cd .. && rm -rf java +ENV PATH="/opt/occlum/toolchains/jvm/bin:$PATH" + +# Install OpenJDK 8 +ARG JDK8_PATH=/opt/occlum/toolchains/jvm/java-1.8-openjdk +COPY --from=alpine /usr/lib/jvm/java-1.8-openjdk $JDK8_PATH +RUN rm $JDK8_PATH/jre/lib/security/cacerts +COPY --from=alpine /etc/ssl/certs/java/cacerts $JDK8_PATH/jre/lib/security/cacerts + +# Install DCAP library +WORKDIR /root/occlum/tools/toolchains +RUN cd dcap_lib && ./build.sh && cd .. && rm -rf dcap_lib + +# Install AECS Client library +WORKDIR /root/occlum/tools/toolchains +RUN cd aecs_client && ./build.sh && cd .. && rm -rf aecs_client + +# Install GRPC RATLS +WORKDIR /root/occlum/tools/toolchains +RUN cd grpc_ratls && ./build.sh && cd .. && rm -rf grpc_ratls && rm -rf /tmp/grpc* + +# Install Occlum +WORKDIR /root +RUN cd occlum && \ + source /opt/intel/sgxsdk/environment && \ + make submodule && \ + OCCLUM_RELEASE_BUILD=1 make install && \ + cp -r demos /root/demos && \ + rm -rf /root/occlum + +# Start AESM service automatically +# +# To do so, we add the script to ~/.bashrc. We cannot use systemd to run AESM +# as a "real" service since the pid 1 is not systemd in Docker. So we start +# up AESM service when an user login with an interactive shell. +RUN mkdir -p /var/run/aesmd && echo '/opt/occlum/start_aesm.sh' >> /root/.bashrc + +WORKDIR /root