general/occlum
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update docker file to use offical SGX 2.13 PSW and DCAP binaries

Browse Source
This commit is contained in:
zongmin.gu 2021-02-07 21:05:35 +08:00 committed by Zongmin.Gu
parent 4b1b6158fb
commit ad3b172506
5 changed files with 253 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
tools/docker/Dockerfile.centos8.1
View File

@ -52,14 +52,6 @@ RUN wget http://www.etallen.com/cpuid/cpuid-20200211.x86_64.tar.gz && \
cp ./cpuid-20200211/cpuid /usr/bin/ && \
rm -rf /tmp/cpuid-20200211*
# Install SGX SDK
WORKDIR /tmp
RUN git clone -b sgx_2.11_for_occlum https://github.com/occlum/linux-sgx && \
cd linux-sgx && \
./compile_and_install.sh no_mitigation USE_OPT_LIBS=2 && \
echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \
rm -rf /tmp/linux-sgx
# Install Rust
ENV PATH="/root/.cargo/bin:$PATH"
ENV OCCLUM_RUST_VERSION=nightly-2020-09-08
@ -102,6 +94,46 @@ WORKDIR /tmp
RUN cd java && ./install_dragonwell.sh && rm -rf /tmp/java
ENV PATH="/opt/occlum/toolchains/jvm/bin:$PATH"
# Install SGX PSW
WORKDIR /tmp
RUN echo "ca_directory=/etc/ssl/certs" >> /etc/wgetrc && \
wget https://download.01.org/intel-sgx/sgx-linux/2.11/distro/centos8.1-server/sgx_rpm_local_repo.tgz && \
tar -xvf sgx_rpm_local_repo.tgz && \
rm sgx_rpm_local_repo.tgz && \
wget https://download.01.org/intel-sgx/sgx-dcap/1.8/linux/distro/centos8.1-server/sgx_rpm_local_repo.tgz && \
tar -xvf sgx_rpm_local_repo.tgz && \
rm sgx_rpm_local_repo.tgz && \
cd /tmp/sgx_rpm_local_repo &&\
rpm -ivh libsgx-ae-pce*.rpm \
libsgx-ae-qe3*.rpm \
libsgx-ae-qve*.rpm \
libsgx-enclave-common*.rpm \
libsgx-quote-ex*.rpm \
libsgx-urts*.rpm \
libsgx-dcap-ql*.rpm \
libsgx-qe3-logic*.rpm \
libsgx-pce-logic*.rpm \
libsgx-dcap-quote-verify*.rpm \
libsgx-dcap-ql*.rpm \
libsgx-dcap-ql-dev*.rpm \
libsgx-dcap-default-qpl*.rpm \
libsgx-dcap-default-qpl-dev*.rpm \
libsgx-dcap-quote-verify-dev*.rpm \
libsgx-uae-service*.rpm \
libsgx-epid*.rpm \
libsgx-launch*.rpm \
sgx-aesm-service*.rpm && \
rm -rf /tmp/sgx_rpm_local_repo
# Install SGX SDK
WORKDIR /tmp
RUN git clone -b sgx_2.11_for_occlum https://github.com/occlum/linux-sgx && \
cd linux-sgx && \
make preparation && \
./compile_and_install.sh no_mitigation USE_OPT_LIBS=2 && \
echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \
rm -rf /tmp/linux-sgx
# Install the latest version of Occlum
ARG OCCLUM_BRANCH
WORKDIR /root
@ -120,6 +152,6 @@ RUN git clone -b $OCCLUM_BRANCH https://github.com/occlum/occlum && \
# as a "real" service since the pid 1 is not systemd in Docker. So we start
# up AESM service when an user login with an interative shell.
COPY docker/start_aesm.sh /opt/occlum/
RUN echo '/opt/occlum/start_aesm.sh' >> /root/.bashrc
RUN mkdir -p /var/run/aesmd && echo '/opt/occlum/start_aesm.sh' >> /root/.bashrc
WORKDIR /root

158
tools/docker/Dockerfile.centos8.2 Normal file
View File

@ -0,0 +1,158 @@
FROM alpine:3.11 AS alpine
LABEL maintainer="Qing Li <geding.lq@antgroup.com>"
RUN apk update && \
apk --no-cache add openjdk11 --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community
FROM centos:8.2.2004
LABEL maintainer="He Sun <bochang.sh@antgroup.com>"
RUN yum install epel-release -y && \
dnf clean all && rm -r /var/cache/dnf && \
dnf group install 'Development Tools' -y && \
dnf --enablerepo=PowerTools install -y \
astyle \
bison \
boost-devel \
cmake \
createrepo \
curl-devel \
expect \
fuse-devel \
fuse-libs \
gawk \
gmp-devel \
golang \
jq \
libcurl-devel \
libmpc-devel \
libxml2-devel \
mod_ssl \
mpfr-devel \
ocaml \
ocaml-ocamlbuild \
openssl \
openssl-devel \
perl \
protobuf-devel \
python2 \
python3 \
sudo \
wget \
uuid-devel \
vim \
yum-utils \
http://downloads.sourceforge.net/ltp/lcov-1.14-1.noarch.rpm &&\
alternatives --set python /usr/bin/python2
# Install cpuid tool for tests
WORKDIR /tmp
RUN wget http://www.etallen.com/cpuid/cpuid-20200211.x86_64.tar.gz && \
tar -xf ./cpuid-20200211.x86_64.tar.gz && \
cp ./cpuid-20200211/cpuid /usr/bin/ && \
rm -rf /tmp/cpuid-20200211*
# Install Rust
ENV PATH="/root/.cargo/bin:$PATH"
ENV OCCLUM_RUST_VERSION=nightly-2020-09-08
RUN curl https://sh.rustup.rs -sSf | \
sh -s -- --default-toolchain ${OCCLUM_RUST_VERSION} -y && \
rm -rf /root/.cargo/registry && rm -rf /root/.cargo/git && \
cargo -V
# Install Occlum toolchain
COPY toolchains/musl-gcc /tmp/musl-gcc
WORKDIR /tmp
RUN cd musl-gcc && ./build.sh && ./install_zlib.sh && rm -rf /tmp/musl-gcc
ENV PATH="/opt/occlum/build/bin:/usr/local/occlum/bin:$PATH"
# Install glibc
COPY toolchains/glibc /tmp/glibc
WORKDIR /tmp
RUN cd glibc && ./build.sh && rm -rf /tmp/glibc
# Install Occlum Golang toolchain
COPY toolchains/golang /tmp/golang
WORKDIR /tmp
RUN cd golang && ./build.sh && rm -rf /tmp/golang
ENV PATH="/opt/occlum/toolchains/golang/bin:$PATH"
# Install Occlum Rust toolchain
COPY toolchains/rust /tmp/rust
WORKDIR /tmp
RUN cd rust && ./build.sh && rm -rf /tmp/rust
ENV PATH="/opt/occlum/toolchains/rust/bin:$PATH"
ENV LD_LIBRARY_PATH="/opt/intel/sgxsdk/sdk_libs"
# Install Occlum Java toolchain (JDK 11)
ARG JDK11_PATH=/opt/occlum/toolchains/jvm/java-11-openjdk
COPY --from=alpine /usr/lib/jvm/java-11-openjdk $JDK11_PATH
RUN rm $JDK11_PATH/lib/security/cacerts
COPY --from=alpine /etc/ssl/certs/java/cacerts $JDK11_PATH/lib/security/cacerts
COPY toolchains/java /tmp/java
WORKDIR /tmp
RUN cd java && ./install_dragonwell.sh && rm -rf /tmp/java
ENV PATH="/opt/occlum/toolchains/jvm/bin:$PATH"
# Install SGX PSW
WORKDIR /tmp
RUN echo "ca_directory=/etc/ssl/certs" >> /etc/wgetrc && \
wget https://download.01.org/intel-sgx/sgx-linux/2.13/distro/centos8.2-server/sgx_rpm_local_repo.tgz && \
tar -xvf sgx_rpm_local_repo.tgz && \
rm sgx_rpm_local_repo.tgz && \
wget https://download.01.org/intel-sgx/sgx-dcap/1.10/linux/distro/centos8.2-server/sgx_rpm_local_repo.tgz && \
tar -xvf sgx_rpm_local_repo.tgz && \
rm sgx_rpm_local_repo.tgz && \
cd /tmp/sgx_rpm_local_repo && \
rpm -ivh libsgx-ae-pce*.rpm \
libsgx-headers*.rpm \
libsgx-ae-qe3*.rpm \
libsgx-ae-qve*.rpm \
libsgx-enclave-common*.rpm \
libsgx-quote-ex*.rpm \
libsgx-urts*.rpm \
libsgx-dcap-ql*.rpm \
libsgx-qe3-logic*.rpm \
libsgx-pce-logic*.rpm \
libsgx-dcap-quote-verify*.rpm \
libsgx-dcap-ql*.rpm \
libsgx-dcap-ql-dev*.rpm \
libsgx-dcap-default-qpl*.rpm \
libsgx-dcap-default-qpl-dev*.rpm \
libsgx-dcap-quote-verify-dev*.rpm \
libsgx-uae-service*.rpm \
libsgx-epid*.rpm \
libsgx-launch*.rpm \
sgx-aesm-service*.rpm && \
rm -rf /tmp/sgx_rpm_local_repo
# Install SGX SDK
WORKDIR /tmp
RUN git clone -b sgx_2.13_for_occlum https://github.com/occlum/linux-sgx && \
cd linux-sgx && \
make preparation && \
./compile_and_install.sh no_mitigation USE_OPT_LIBS=2 && \
echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \
rm -rf /tmp/linux-sgx
# Install the latest version of Occlum
ARG OCCLUM_BRANCH
WORKDIR /root
RUN git clone -b $OCCLUM_BRANCH https://github.com/occlum/occlum && \
cd occlum && \
source /root/.bashrc && \
make submodule && \
OCCLUM_RELEASE_BUILD=1 make && \
make install && \
cp -r demos /root/demos && \
rm -rf /root/occlum
# Start AESM service automatically
#
# To do so, we add the script to ~/.bashrc. We cannot use systemd to run AESM
# as a "real" service since the pid 1 is not systemd in Docker. So we start
# up AESM service when an user login with an interative shell.
COPY docker/start_aesm.sh /opt/occlum/
RUN mkdir -p /var/run/aesmd && echo '/opt/occlum/start_aesm.sh' >> /root/.bashrc
WORKDIR /root

62
tools/docker/Dockerfile.ubuntu18.04
View File

@ -52,10 +52,16 @@ RUN apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-i
vim \
wget \
zip \
gnupg \
aptitude \
&& \
apt-get clean && \
rm -rf /var/lib/apt/lists/*
RUN echo "ca_directory=/etc/ssl/certs" >> /etc/wgetrc && \
echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu bionic main' | tee /etc/apt/sources.list.d/intel-sgx.list &&\
wget -qO - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key --no-check-certificate | apt-key add -
# Install cpuid tool for tests
WORKDIR /tmp
RUN wget http://www.etallen.com/cpuid/cpuid-20200211.x86_64.tar.gz && \
@ -63,15 +69,6 @@ RUN wget http://www.etallen.com/cpuid/cpuid-20200211.x86_64.tar.gz && \
cp ./cpuid-20200211/cpuid /usr/bin/ && \
rm -rf /tmp/cpuid-20200211*
# Install SGX SDK
WORKDIR /tmp
RUN git clone -b sgx_2.11_for_occlum https://github.com/occlum/linux-sgx && \
mkdir /etc/init && \
cd linux-sgx && \
./compile_and_install.sh no_mitigation USE_OPT_LIBS=2 && \
echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \
rm -rf /tmp/linux-sgx
# Install Rust
ENV PATH="/root/.cargo/bin:$PATH"
ENV OCCLUM_RUST_VERSION=nightly-2020-09-08
@ -114,6 +111,49 @@ WORKDIR /tmp
RUN cd java && ./install_dragonwell.sh && rm -rf /tmp/java
ENV PATH="/opt/occlum/toolchains/jvm/bin:$PATH"
# Install SGX PSW
RUN apt-get update && aptitude install -y \
libsgx-launch-dev=2.13.100.4-bionic1 \
libsgx-epid-dev=2.13.100.4-bionic1 \
libsgx-quote-ex-dev=2.13.100.4-bionic1 \
libsgx-urts=2.13.100.4-bionic1 \
libsgx-enclave-common=2.13.100.4-bionic1 \
libsgx-uae-service=2.13.100.4-bionic1 \
libsgx-ae-epid=2.13.100.4-bionic1 \
libsgx-ae-le=2.13.100.4-bionic1 \
libsgx-ae-pce=2.13.100.4-bionic1 \
libsgx-aesm-launch-plugin=2.13.100.4-bionic1 \
sgx-aesm-service=2.13.100.4-bionic1 \
libsgx-aesm-launch-plugin=2.13.100.4-bionic1 \
libsgx-aesm-pce-plugin=2.13.100.4-bionic1 \
libsgx-aesm-ecdsa-plugin=2.13.100.4-bionic1 \
libsgx-aesm-epid-plugin=2.13.100.4-bionic1 \
libsgx-aesm-quote-ex-plugin=2.13.100.4-bionic1 \
libsgx-dcap-quote-verify=1.10.100.4-bionic1 \
libsgx-dcap-quote-verify-dev=1.10.100.4-bionic1 \
libsgx-dcap-ql=1.10.100.4-bionic1 \
libsgx-dcap-ql-dev=1.10.100.4-bionic1 \
libsgx-epid=2.13.100.4-bionic1 \
libsgx-quote-ex=2.13.100.4-bionic1 \
libsgx-pce-logic=1.10.100.4-bionic1 \
libsgx-qe3-logic=1.10.100.4-bionic1 \
libsgx-launch=2.13.100.4-bionic1 \
libsgx-dcap-default-qpl=1.10.100.4-bionic1 \
&& \
apt-get clean && \
rm -rf /var/lib/apt/lists/* && \
ln -s /usr/lib/x86_64-linux-gnu/libsgx_enclave_common.so.1 /usr/lib/x86_64-linux-gnu/libsgx_enclave_common.so
# Install SGX SDK
WORKDIR /tmp
RUN git clone -b sgx_2.13_for_occlum https://github.com/occlum/linux-sgx && \
mkdir /etc/init && \
cd linux-sgx && \
make preparation && \
./compile_and_install.sh no_mitigation USE_OPT_LIBS=2 && \
echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \
rm -rf /tmp/linux-sgx
# Install the latest version of Occlum
ARG OCCLUM_BRANCH
WORKDIR /root
@ -130,7 +170,7 @@ RUN git clone -b $OCCLUM_BRANCH https://github.com/occlum/occlum && \
# To do so, we add the script to ~/.bashrc. We cannot use systemd to run AESM
# as a "real" service since the pid 1 is not systemd in Docker. So we start
# up AESM service when an user login with an interative shell.
COPY docker/start_aesm.sh /opt/occlum/
RUN echo '/opt/occlum/start_aesm.sh' >> /root/.bashrc
COPY docker/start_aesm.sh /opt/occlum/
RUN mkdir -p /var/run/aesmd && echo '/opt/occlum/start_aesm.sh' >> /root/.bashrc
WORKDIR /root

5
tools/docker/build_image.sh
View File

@ -20,8 +20,7 @@ USAGE:
<OS_NAME>:
The name of the OS distribution that the Docker image is based on. Currently, <OS_NAME> must be one of the following values:
ubuntu18.04 Use Ubuntu 18.04 as the base image
centos7.5 Use CentOS 7.5 as the base image
centos8.1 Use CentOS 8.1 as the base image
centos8.2 Use CentOS 8.2 as the base image
The resulting Docker image will have "occlum/occlum:<OCCLUM_LABEL>-<OS_NAME>" as its label.
EOF
@ -44,7 +43,7 @@ function check_item_in_list() {
[[ $list =~ (^|[[:space:]])$item($|[[:space:]]) ]]
}
check_item_in_list "$os_name" "ubuntu18.04 centos7.5 centos8.1" || report_error
check_item_in_list "$os_name" "ubuntu18.04 centos8.2" || report_error
cd "$script_dir/.."
docker build -f "$script_dir/Dockerfile.$os_name" -t "occlum/occlum:$occlum_label-$os_name" --build-arg OCCLUM_BRANCH=$occlum_branch .

2
tools/docker/start_aesm.sh
View File

@ -1,5 +1,5 @@
#!/bin/bash
# Start AESM service required by Intel SGX SDK if it is not running
if ! pgrep "aesm_service" > /dev/null ; then
LD_LIBRARY_PATH="/opt/intel/sgxpsw/aesm:$LD_LIBRARY_PATH" /opt/intel/sgxpsw/aesm/aesm_service
LD_LIBRARY_PATH="/opt/intel/sgx-aesm-service/aesm:$LD_LIBRARY_PATH" /opt/intel/sgx-aesm-service/aesm/aesm_service --no-daemon
fi