Add dockerfile for Aliyun Linux image
This commit is contained in:
Hui, Chunyang
Zongmin.Gu
parent
2a45fdd3b0
commit
a9850745f8
87
.github/workflows/build_and_push_alinux2_image.yml
vendored
Normal file
87
.github/workflows/build_and_push_alinux2_image.yml
vendored
Normal file
@ -0,0 +1,87 @@
|
|||||||
|
name: Alinux2 Docker Build and Push
|
||||||
|
|
||||||
|
# This is a manual trigger.
|
||||||
|
on:
|
||||||
|
workflow_dispatch:
|
||||||
|
inputs:
|
||||||
|
only_test:
|
||||||
|
description: 'Only Test? <Y/N>'
|
||||||
|
required: true
|
||||||
|
default: 'N'
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
generate-alinux2-image:
|
||||||
|
runs-on: ubuntu-18.04
|
||||||
|
if: github.event.inputs.only_test == 'N'
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Checkout code
|
||||||
|
uses: actions/checkout@v2
|
||||||
|
|
||||||
|
# Because "Build and push" step `context` field can't be subdir,
|
||||||
|
# we need to copy files needed by dockerfile to root dir of the project
|
||||||
|
- name: Copy context for docker build
|
||||||
|
run: |
|
||||||
|
cp -r tools/toolchains .
|
||||||
|
cp -r tools/docker .
|
||||||
|
|
||||||
|
- name: Get Occlum release version
|
||||||
|
run: echo "RELEASE_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;
|
||||||
|
|
||||||
|
- name: Get branch name
|
||||||
|
# GITHUB_REF=refs/heads/branch-name
|
||||||
|
# ${GITHUB_REF##*/} == branch-name
|
||||||
|
run: echo "OCCLUM_BRANCH=$(echo ${GITHUB_REF##*/})" >> $GITHUB_ENV;
|
||||||
|
|
||||||
|
- name: Set up QEMU
|
||||||
|
uses: docker/setup-qemu-action@v1
|
||||||
|
|
||||||
|
- name: Set up Docker Buildx
|
||||||
|
uses: docker/setup-buildx-action@v1
|
||||||
|
with:
|
||||||
|
driver-opts: env.BUILDKIT_STEP_LOG_MAX_SIZE=104857600
|
||||||
|
|
||||||
|
- name: Login to DockerHub
|
||||||
|
uses: docker/login-action@v1
|
||||||
|
with:
|
||||||
|
username: ${{ secrets.DOCKER_USERNAME }}
|
||||||
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
||||||
|
|
||||||
|
- name: Build and push
|
||||||
|
uses: docker/build-push-action@v2
|
||||||
|
with:
|
||||||
|
context: .
|
||||||
|
file: ./tools/docker/Dockerfile.aliyunlinux
|
||||||
|
platforms: linux/amd64
|
||||||
|
build-args: OCCLUM_BRANCH=${{ env.OCCLUM_BRANCH }}
|
||||||
|
push: true
|
||||||
|
tags: occlum/occlum:${{ env.RELEASE_VERSION }}-aliyunlinux
|
||||||
|
|
||||||
|
|
||||||
|
Make_test_on_alinux2:
|
||||||
|
if: ${{ always() }}
|
||||||
|
needs: generate-alinux2-image
|
||||||
|
runs-on: ubuntu-18.04
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- uses: actions/checkout@v1
|
||||||
|
with:
|
||||||
|
submodules: true
|
||||||
|
|
||||||
|
- name: Get occlum version
|
||||||
|
run: echo "OCCLUM_VERSION=$(grep 'Version =' src/pal/include/occlum_version.h | awk '{print $4}')" >> $GITHUB_ENV;
|
||||||
|
|
||||||
|
- name: Create container with Aliyun Linux image
|
||||||
|
run: docker run -itd --name=alinux2-test -v $GITHUB_WORKSPACE:/root/occlum occlum/occlum:${{ env.OCCLUM_VERSION }}-aliyunlinux
|
||||||
|
|
||||||
|
- name: Build dependencies
|
||||||
|
run: docker exec alinux2-test bash -c "cd /root/occlum; make submodule"
|
||||||
|
|
||||||
|
- name: Build source
|
||||||
|
run: docker exec alinux2-test bash -c "cd /root/occlum; OCCLUM_RELEASE_BUILD=y SGX_MODE=SIM make"
|
||||||
|
|
||||||
|
- name: Integration test
|
||||||
|
run: docker exec alinux2-test bash -c "cd /root/occlum; OCCLUM_LOG_LEVEL=trace SGX_MODE=SIM make test"
|
||||||
|
|
||||||
|
- name: Integration test with Glibc
|
||||||
|
run: docker exec alinux2-test bash -c "cd /root/occlum; OCCLUM_LOG_LEVEL=trace SGX_MODE=SIM make test-glibc"
|
||||||
192
tools/docker/Dockerfile.aliyunlinux
Normal file
192
tools/docker/Dockerfile.aliyunlinux
Normal file
@ -0,0 +1,192 @@
|
|||||||
|
FROM alpine:3.11 AS alpine
|
||||||
|
|
||||||
|
RUN apk update && \
|
||||||
|
apk --no-cache add openjdk11 --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community
|
||||||
|
|
||||||
|
FROM registry.cn-hangzhou.aliyuncs.com/alinux/aliyunlinux
|
||||||
|
|
||||||
|
LABEL maintainer="Chunyang Hui <sanqian.hcy@antgroup.com>"
|
||||||
|
|
||||||
|
RUN yum install -y --nogpgcheck \
|
||||||
|
alinux-release-experimentals && \
|
||||||
|
yum install -y --nogpgcheck \
|
||||||
|
astyle \
|
||||||
|
autoconf \
|
||||||
|
automake \
|
||||||
|
bison \
|
||||||
|
bzip2 \
|
||||||
|
boost-devel \
|
||||||
|
ca-certificates \
|
||||||
|
cmake \
|
||||||
|
curl \
|
||||||
|
curl-devel \
|
||||||
|
createrepo \
|
||||||
|
expect \
|
||||||
|
expat \
|
||||||
|
expat-devel \
|
||||||
|
gettext \
|
||||||
|
file \
|
||||||
|
fuse-devel \
|
||||||
|
fuse-libs \
|
||||||
|
gawk \
|
||||||
|
gcc \
|
||||||
|
gcc-c++ \
|
||||||
|
glibc-headers \
|
||||||
|
gdb \
|
||||||
|
git-core \
|
||||||
|
gmp-devel \
|
||||||
|
golang \
|
||||||
|
jq \
|
||||||
|
libmpc-devel \
|
||||||
|
libxml2-devel \
|
||||||
|
libtool \
|
||||||
|
pkgconfig \
|
||||||
|
python \
|
||||||
|
kmod \
|
||||||
|
make \
|
||||||
|
mod_ssl \
|
||||||
|
mpfr-devel \
|
||||||
|
ocaml \
|
||||||
|
ocaml-ocamlbuild \
|
||||||
|
openssl \
|
||||||
|
openssl-devel \
|
||||||
|
patch \
|
||||||
|
python3 \
|
||||||
|
sudo \
|
||||||
|
uuid-devel \
|
||||||
|
vim \
|
||||||
|
wget \
|
||||||
|
yum-utils && \
|
||||||
|
yum groupinstall -y 'Development Tools' && \
|
||||||
|
yum clean all
|
||||||
|
|
||||||
|
# Upgrade gcc to compile occlum toolchain.
|
||||||
|
# This may vary across different platforms depending on the source of gcc.
|
||||||
|
# Use aliyunlinux devtoolset to upgrade gcc to 8.
|
||||||
|
RUN yum install -y scl-utils alinux-release-experimentals rpm-build && \
|
||||||
|
yum install -y devtoolset-8-gcc-c++ devtoolset-8-gcc devtoolset-8-gdb devtoolset-8-binutils devtoolset-8-make && \
|
||||||
|
printf "unset BASH_ENV PROMPT_COMMAND ENV\nsource scl_source enable devtoolset-8\n" > /usr/bin/scl_enable
|
||||||
|
|
||||||
|
ENV BASH_ENV="/usr/bin/scl_enable"
|
||||||
|
ENV ENV="/usr/bin/scl_enable"
|
||||||
|
ENV PROMPT_COMMAND=". /usr/bin/scl_enable"
|
||||||
|
|
||||||
|
# With alinux-release-experimentals, install higher version of git and protobuf (3.5).
|
||||||
|
RUN yum install -y \
|
||||||
|
git \
|
||||||
|
protobuf \
|
||||||
|
protobuf-c \
|
||||||
|
protobuf-compiler \
|
||||||
|
protobuf-c-compiler \
|
||||||
|
protobuf-c-devel \
|
||||||
|
protobuf-devel
|
||||||
|
|
||||||
|
# Install PSW and DCAP RPM packages
|
||||||
|
WORKDIR /tmp
|
||||||
|
RUN wget https://mirrors.openanolis.org/inclavare-containers/alinux2/sgx_rpm_local_repo.tar.gz && \
|
||||||
|
tar -xzf sgx_rpm_local_repo.tar.gz && \
|
||||||
|
rm -f sgx_rpm_local_repo.tar.gz && \
|
||||||
|
cd /tmp/sgx_rpm_local_repo && \
|
||||||
|
rpm -ivh --nodeps libsgx-ae-pce*.rpm \
|
||||||
|
libsgx-headers*.rpm \
|
||||||
|
libsgx-ae-qe3*.rpm \
|
||||||
|
libsgx-ae-qve*.rpm \
|
||||||
|
libsgx-enclave-common*.rpm \
|
||||||
|
libsgx-quote-ex*.rpm \
|
||||||
|
libsgx-urts*.rpm \
|
||||||
|
libsgx-dcap-ql*.rpm \
|
||||||
|
libsgx-qe3-logic*.rpm \
|
||||||
|
libsgx-pce-logic*.rpm \
|
||||||
|
libsgx-dcap-quote-verify*.rpm \
|
||||||
|
libsgx-dcap-ql*.rpm \
|
||||||
|
libsgx-dcap-ql-dev*.rpm \
|
||||||
|
libsgx-dcap-default-qpl*.rpm \
|
||||||
|
libsgx-dcap-default-qpl-dev*.rpm \
|
||||||
|
libsgx-dcap-quote-verify-dev*.rpm \
|
||||||
|
libsgx-uae-service*.rpm \
|
||||||
|
libsgx-epid*.rpm \
|
||||||
|
libsgx-launch*.rpm \
|
||||||
|
libsgx-ae-le-*.rpm \
|
||||||
|
libsgx-aesm-launch-plugin-*.rpm \
|
||||||
|
sgx-aesm-service*.rpm && \
|
||||||
|
rm -rf /tmp/sgx_rpm_local_repo
|
||||||
|
|
||||||
|
# Install SGX SDK
|
||||||
|
WORKDIR /tmp
|
||||||
|
RUN git clone -b sgx_2.13_for_occlum https://github.com/occlum/linux-sgx && \
|
||||||
|
cd linux-sgx && \
|
||||||
|
make preparation && \
|
||||||
|
./compile_and_install.sh no_mitigation USE_OPT_LIBS=2 && \
|
||||||
|
echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \
|
||||||
|
rm -rf /tmp/linux-sgx
|
||||||
|
|
||||||
|
# Install cpuid tool for tests
|
||||||
|
WORKDIR /tmp
|
||||||
|
RUN wget http://www.etallen.com/cpuid/cpuid-20200211.x86_64.tar.gz && \
|
||||||
|
tar -xf ./cpuid-20200211.x86_64.tar.gz && \
|
||||||
|
cp ./cpuid-20200211/cpuid /usr/bin/ && \
|
||||||
|
rm -rf /tmp/cpuid-20200211*
|
||||||
|
|
||||||
|
# Install Occlum toolchain
|
||||||
|
COPY toolchains/musl-gcc /tmp/musl-gcc
|
||||||
|
WORKDIR /tmp
|
||||||
|
RUN cd musl-gcc && ./build.sh && ./install_zlib.sh && rm -rf /tmp/musl-gcc
|
||||||
|
ENV PATH="/opt/occlum/build/bin:/usr/local/occlum/bin:$PATH"
|
||||||
|
|
||||||
|
# Install glibc
|
||||||
|
COPY toolchains/glibc /tmp/glibc
|
||||||
|
WORKDIR /tmp
|
||||||
|
RUN cd glibc && ./build.sh && rm -rf /tmp/glibc
|
||||||
|
|
||||||
|
# Install Occlum Golang toolchain
|
||||||
|
COPY toolchains/golang /tmp/golang
|
||||||
|
WORKDIR /tmp
|
||||||
|
RUN yum install -y go && cd golang && ./build.sh && rm -rf /tmp/golang
|
||||||
|
ENV PATH="/usr/local/occlum/golang/bin:$PATH"
|
||||||
|
|
||||||
|
# Install Occlum Java toolchain (JDK 11)
|
||||||
|
ARG JDK11_PATH=/opt/occlum/toolchains/jvm/java-11-openjdk
|
||||||
|
COPY --from=alpine /usr/lib/jvm/java-11-openjdk $JDK11_PATH
|
||||||
|
RUN rm $JDK11_PATH/lib/security/cacerts
|
||||||
|
COPY --from=alpine /etc/ssl/certs/java/cacerts $JDK11_PATH/lib/security/cacerts
|
||||||
|
COPY toolchains/java /tmp/java
|
||||||
|
WORKDIR /tmp
|
||||||
|
RUN cd java && ./install_dragonwell.sh && rm -rf /tmp/java
|
||||||
|
ENV PATH="/opt/occlum/toolchains/jvm/bin:$PATH"
|
||||||
|
|
||||||
|
# Install Rust
|
||||||
|
ENV PATH="/root/.cargo/bin:$PATH"
|
||||||
|
ENV OCCLUM_RUST_VERSION=nightly-2020-09-08
|
||||||
|
RUN curl https://sh.rustup.rs -sSf | \
|
||||||
|
sh -s -- --default-toolchain ${OCCLUM_RUST_VERSION} -y && \
|
||||||
|
rm -rf /root/.cargo/registry && rm -rf /root/.cargo/git && \
|
||||||
|
cargo -V
|
||||||
|
|
||||||
|
# Install Occlum Rust toolchain
|
||||||
|
COPY toolchains/rust /tmp/rust
|
||||||
|
WORKDIR /tmp
|
||||||
|
RUN cd rust && ./build.sh && rm -rf /tmp/rust
|
||||||
|
ENV PATH="/opt/occlum/toolchains/rust/bin:$PATH"
|
||||||
|
|
||||||
|
ARG OCCLUM_BRANCH
|
||||||
|
ENV LD_LIBRARY_PATH="/opt/intel/sgxpsw/aesm:/usr/lib64/:/usr/local/lib:/opt/intel/sgxsdk/sdk_libs:/usr/lib:$LD_LIBRARY_PATH"
|
||||||
|
# Install the latest version of Occlum
|
||||||
|
WORKDIR /root/occlum
|
||||||
|
RUN rm -rf occlum && \
|
||||||
|
source scl_source enable devtoolset-8 && \
|
||||||
|
git clone -b $OCCLUM_BRANCH https://github.com/occlum/occlum && \
|
||||||
|
cd occlum && \
|
||||||
|
make submodule && \
|
||||||
|
OCCLUM_RELEASE_BUILD=1 make install && \
|
||||||
|
cp -r demos /root/demos && \
|
||||||
|
rm -rf /root/occlum
|
||||||
|
|
||||||
|
# Start AESM service automatically
|
||||||
|
#
|
||||||
|
# To do so, we add the script to ~/.bashrc. We cannot use systemd to run AESM
|
||||||
|
# as a "real" service since the pid 1 is not systemd in Docker. So we start
|
||||||
|
# up AESM service when an user login with an interative shell.
|
||||||
|
COPY docker/start_aesm.sh /opt/occlum/
|
||||||
|
RUN mkdir -p /var/run/aesmd && echo 'sudo /opt/occlum/start_aesm.sh' >> /root/.bashrc
|
||||||
|
|
||||||
|
WORKDIR /root
|
||||||
Loading…
Reference in New Issue
Block a user