[tools] Add dockerfile based on ubuntu22.04
This commit is contained in:
Qi Zheng
volcano
parent
f9839299b2
commit
54eb41d256
215
tools/docker/Dockerfile.ubuntu22.04
Normal file
215
tools/docker/Dockerfile.ubuntu22.04
Normal file
@ -0,0 +1,215 @@
|
||||
FROM alpine:3.11 AS alpine
|
||||
|
||||
LABEL maintainer="Qi Zheng <huaiqing.zq@antgroup.com>"
|
||||
|
||||
RUN apk update && \
|
||||
apk --no-cache add openjdk11 openjdk8 --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community
|
||||
|
||||
FROM ubuntu:22.04
|
||||
|
||||
LABEL maintainer="Qi Zheng <huaiqing.zq@antgroup.com>"
|
||||
|
||||
#The default shell for the RUN instruction is ["/bin/sh", "-c"], which sometimes cause unexpected error
|
||||
#for example "source a_file". Use bash as default shell instead.
|
||||
SHELL ["/bin/bash", "-c"]
|
||||
|
||||
RUN apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-install-recommends \
|
||||
alien \
|
||||
astyle \
|
||||
autoconf \
|
||||
automake \
|
||||
bison \
|
||||
build-essential \
|
||||
ca-certificates \
|
||||
cmake \
|
||||
curl \
|
||||
debhelper \
|
||||
expect \
|
||||
g++ \
|
||||
gawk \
|
||||
gdb \
|
||||
git-core \
|
||||
golang-go \
|
||||
jq \
|
||||
kmod \
|
||||
lcov \
|
||||
libboost-system-dev \
|
||||
libboost-thread-dev \
|
||||
libclang-dev \
|
||||
libcurl4-openssl-dev \
|
||||
libfuse-dev \
|
||||
libjsoncpp-dev \
|
||||
liblog4cpp5-dev \
|
||||
libprotobuf-c-dev \
|
||||
libprotobuf-dev \
|
||||
libssl-dev \
|
||||
libtool \
|
||||
libxml2-dev \
|
||||
nano \
|
||||
ocaml \
|
||||
ocamlbuild \
|
||||
pkg-config \
|
||||
protobuf-compiler \
|
||||
python-is-python3 \
|
||||
python3-pip \
|
||||
sudo \
|
||||
unzip \
|
||||
uuid-dev \
|
||||
vim \
|
||||
wget \
|
||||
zip \
|
||||
gnupg \
|
||||
aptitude \
|
||||
rsync \
|
||||
cpuid \
|
||||
&& \
|
||||
apt-get clean && \
|
||||
rm -rf /var/lib/apt/lists/*
|
||||
|
||||
RUN echo "ca_directory=/etc/ssl/certs" >> /etc/wgetrc && \
|
||||
echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu jammy main' | tee /etc/apt/sources.list.d/intel-sgx.list &&\
|
||||
wget -qO - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key --no-check-certificate | apt-key add -
|
||||
|
||||
# Install cpuid tool for tests
|
||||
# WORKDIR /tmp
|
||||
# RUN wget http://www.etallen.com/cpuid/cpuid-20200211.x86_64.tar.gz && \
|
||||
# tar -xf ./cpuid-20200211.x86_64.tar.gz && \
|
||||
# cp ./cpuid-20200211/cpuid /usr/bin/ && \
|
||||
# rm -rf /tmp/cpuid-20200211*
|
||||
|
||||
# Install Rust
|
||||
ENV PATH="/root/.cargo/bin:$PATH"
|
||||
ENV OCCLUM_RUST_VERSION=nightly-2022-10-22
|
||||
RUN curl https://sh.rustup.rs -sSf | \
|
||||
sh -s -- --default-toolchain ${OCCLUM_RUST_VERSION} -y && \
|
||||
rm -rf /root/.cargo/registry && rm -rf /root/.cargo/git && \
|
||||
cargo -V
|
||||
|
||||
# Install SGX PSW
|
||||
ARG PSW_VERSION=2.20.100.4
|
||||
ARG DCAP_VERSION=1.17.100.4
|
||||
RUN apt-get update && aptitude install -y \
|
||||
libsgx-launch-dev=$PSW_VERSION-jammy1 \
|
||||
libsgx-epid-dev=$PSW_VERSION-jammy1 \
|
||||
libsgx-quote-ex-dev=$PSW_VERSION-jammy1 \
|
||||
libsgx-urts=$PSW_VERSION-jammy1 \
|
||||
libsgx-enclave-common=$PSW_VERSION-jammy1 \
|
||||
libsgx-uae-service=$PSW_VERSION-jammy1 \
|
||||
libsgx-ae-epid=$PSW_VERSION-jammy1 \
|
||||
libsgx-ae-le=$PSW_VERSION-jammy1 \
|
||||
libsgx-ae-pce=$PSW_VERSION-jammy1 \
|
||||
libsgx-aesm-launch-plugin=$PSW_VERSION-jammy1 \
|
||||
sgx-aesm-service=$PSW_VERSION-jammy1 \
|
||||
libsgx-aesm-launch-plugin=$PSW_VERSION-jammy1 \
|
||||
libsgx-aesm-pce-plugin=$PSW_VERSION-jammy1 \
|
||||
libsgx-aesm-ecdsa-plugin=$PSW_VERSION-jammy1 \
|
||||
libsgx-aesm-epid-plugin=$PSW_VERSION-jammy1 \
|
||||
libsgx-aesm-quote-ex-plugin=$PSW_VERSION-jammy1 \
|
||||
libsgx-ae-id-enclave=$DCAP_VERSION-jammy1 \
|
||||
libsgx-ae-qe3=$DCAP_VERSION-jammy1 \
|
||||
libsgx-ae-qve=$DCAP_VERSION-jammy1 \
|
||||
libsgx-dcap-quote-verify=$DCAP_VERSION-jammy1 \
|
||||
libsgx-dcap-quote-verify-dev=$DCAP_VERSION-jammy1 \
|
||||
libsgx-dcap-ql=$DCAP_VERSION-jammy1 \
|
||||
libsgx-dcap-ql-dev=$DCAP_VERSION-jammy1 \
|
||||
libsgx-epid=$PSW_VERSION-jammy1 \
|
||||
libsgx-quote-ex=$PSW_VERSION-jammy1 \
|
||||
libsgx-pce-logic=$DCAP_VERSION-jammy1 \
|
||||
libsgx-qe3-logic=$DCAP_VERSION-jammy1 \
|
||||
libsgx-launch=$PSW_VERSION-jammy1 \
|
||||
libsgx-dcap-default-qpl=$DCAP_VERSION-jammy1 \
|
||||
&& \
|
||||
apt-get clean && \
|
||||
rm -rf /var/lib/apt/lists/* && \
|
||||
ln -s /usr/lib/x86_64-linux-gnu/libsgx_enclave_common.so.1 /usr/lib/x86_64-linux-gnu/libsgx_enclave_common.so
|
||||
|
||||
# Install SGX SDK
|
||||
WORKDIR /tmp
|
||||
RUN git clone -b sgx_2.20_for_occlum https://github.com/occlum/linux-sgx && \
|
||||
mkdir /etc/init && \
|
||||
cd linux-sgx && \
|
||||
make preparation && \
|
||||
./compile_and_install.sh no_mitigation USE_OPT_LIBS=3 && \
|
||||
echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \
|
||||
rm -rf /tmp/linux-sgx
|
||||
|
||||
# Download the Occlum source
|
||||
ARG OCCLUM_BRANCH
|
||||
WORKDIR /root
|
||||
RUN git clone -b $OCCLUM_BRANCH https://github.com/occlum/occlum && \
|
||||
cd /root/occlum && git submodule update --init && \
|
||||
mkdir -p /opt/occlum/ && \
|
||||
cp /root/occlum/tools/docker/start_aesm.sh /opt/occlum/
|
||||
|
||||
# Install Occlum toolchain
|
||||
WORKDIR /root/occlum/tools/toolchains
|
||||
RUN cd musl-gcc && ./build.sh && ./install_zlib.sh && cd .. && rm -rf musl-gcc
|
||||
ENV PATH="/opt/occlum/build/bin:/usr/local/occlum/bin:$PATH"
|
||||
|
||||
# Install glibc
|
||||
WORKDIR /root/occlum/tools/toolchains
|
||||
RUN cd glibc && ./build.sh occlum-glibc-2.35 && cd .. && rm -rf glibc && rm -rf /tmp/glibc*
|
||||
|
||||
# Install Occlum Golang toolchain
|
||||
WORKDIR /root/occlum/tools/toolchains
|
||||
RUN cd golang && ./build.sh && cd .. && rm -rf golang
|
||||
ENV PATH="/opt/occlum/toolchains/golang/bin:$PATH"
|
||||
|
||||
# Install Occlum Rust toolchain
|
||||
WORKDIR /root/occlum/tools/toolchains
|
||||
RUN cd rust && ./build.sh && cd .. && rm -rf rust
|
||||
ENV PATH="/opt/occlum/toolchains/rust/bin:$PATH"
|
||||
ENV LD_LIBRARY_PATH="/opt/intel/sgxsdk/sdk_libs"
|
||||
|
||||
# Install Occlum bash
|
||||
WORKDIR /root/occlum/tools/toolchains
|
||||
RUN cd bash && ./build.sh && cd .. && rm -rf bash
|
||||
|
||||
# Install Occlum busybox
|
||||
WORKDIR /root/occlum/tools/toolchains
|
||||
RUN cd busybox && ./build.sh && cd .. && rm -rf busybox
|
||||
|
||||
# Install Occlum Java toolchain (JDK 11)
|
||||
ARG JDK11_PATH=/opt/occlum/toolchains/jvm/java-11-openjdk
|
||||
COPY --from=alpine /usr/lib/jvm/java-11-openjdk $JDK11_PATH
|
||||
RUN rm $JDK11_PATH/lib/security/cacerts
|
||||
COPY --from=alpine /etc/ssl/certs/java/cacerts $JDK11_PATH/lib/security/cacerts
|
||||
WORKDIR /root/occlum/tools/toolchains
|
||||
RUN cd java && ./install_dragonwell.sh && cd .. && rm -rf java
|
||||
ENV PATH="/opt/occlum/toolchains/jvm/bin:$PATH"
|
||||
|
||||
# Install OpenJDK 8
|
||||
ARG JDK8_PATH=/opt/occlum/toolchains/jvm/java-1.8-openjdk
|
||||
COPY --from=alpine /usr/lib/jvm/java-1.8-openjdk $JDK8_PATH
|
||||
RUN rm $JDK8_PATH/jre/lib/security/cacerts
|
||||
COPY --from=alpine /etc/ssl/certs/java/cacerts $JDK8_PATH/jre/lib/security/cacerts
|
||||
|
||||
# Install DCAP library
|
||||
WORKDIR /root/occlum/tools/toolchains
|
||||
RUN cd dcap_lib && ./build.sh && cd .. && rm -rf dcap_lib
|
||||
|
||||
# Install AECS Client library
|
||||
WORKDIR /root/occlum/tools/toolchains
|
||||
RUN cd aecs_client && ./build.sh && cd .. && rm -rf aecs_client
|
||||
|
||||
# Install GRPC RATLS
|
||||
WORKDIR /root/occlum/tools/toolchains
|
||||
RUN cd grpc_ratls && ./build.sh && cd .. && rm -rf grpc_ratls && rm -rf /tmp/grpc*
|
||||
|
||||
# Install Occlum
|
||||
WORKDIR /root
|
||||
RUN cd occlum && \
|
||||
source /opt/intel/sgxsdk/environment && \
|
||||
make submodule && \
|
||||
OCCLUM_RELEASE_BUILD=1 make install && \
|
||||
cp -r demos /root/demos && \
|
||||
rm -rf /root/occlum
|
||||
|
||||
# Start AESM service automatically
|
||||
#
|
||||
# To do so, we add the script to ~/.bashrc. We cannot use systemd to run AESM
|
||||
# as a "real" service since the pid 1 is not systemd in Docker. So we start
|
||||
# up AESM service when an user login with an interactive shell.
|
||||
RUN mkdir -p /var/run/aesmd && echo '/opt/occlum/start_aesm.sh' >> /root/.bashrc
|
||||
|
||||
WORKDIR /root
|
||||
Loading…
Reference in New Issue
Block a user