diff --git a/tools/docker/Dockerfile.centos8.1 b/tools/docker/Dockerfile.centos8.1 index bfa8b7fe..adadfe13 100644 --- a/tools/docker/Dockerfile.centos8.1 +++ b/tools/docker/Dockerfile.centos8.1 @@ -52,14 +52,6 @@ RUN wget http://www.etallen.com/cpuid/cpuid-20200211.x86_64.tar.gz && \ cp ./cpuid-20200211/cpuid /usr/bin/ && \ rm -rf /tmp/cpuid-20200211* -# Install SGX SDK -WORKDIR /tmp -RUN git clone -b sgx_2.11_for_occlum https://github.com/occlum/linux-sgx && \ - cd linux-sgx && \ - ./compile_and_install.sh no_mitigation USE_OPT_LIBS=2 && \ - echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \ - rm -rf /tmp/linux-sgx - # Install Rust ENV PATH="/root/.cargo/bin:$PATH" ENV OCCLUM_RUST_VERSION=nightly-2020-09-08 @@ -102,6 +94,46 @@ WORKDIR /tmp RUN cd java && ./install_dragonwell.sh && rm -rf /tmp/java ENV PATH="/opt/occlum/toolchains/jvm/bin:$PATH" +# Install SGX PSW +WORKDIR /tmp +RUN echo "ca_directory=/etc/ssl/certs" >> /etc/wgetrc && \ + wget https://download.01.org/intel-sgx/sgx-linux/2.11/distro/centos8.1-server/sgx_rpm_local_repo.tgz && \ + tar -xvf sgx_rpm_local_repo.tgz && \ + rm sgx_rpm_local_repo.tgz && \ + wget https://download.01.org/intel-sgx/sgx-dcap/1.8/linux/distro/centos8.1-server/sgx_rpm_local_repo.tgz && \ + tar -xvf sgx_rpm_local_repo.tgz && \ + rm sgx_rpm_local_repo.tgz && \ + cd /tmp/sgx_rpm_local_repo &&\ + rpm -ivh libsgx-ae-pce*.rpm \ + libsgx-ae-qe3*.rpm \ + libsgx-ae-qve*.rpm \ + libsgx-enclave-common*.rpm \ + libsgx-quote-ex*.rpm \ + libsgx-urts*.rpm \ + libsgx-dcap-ql*.rpm \ + libsgx-qe3-logic*.rpm \ + libsgx-pce-logic*.rpm \ + libsgx-dcap-quote-verify*.rpm \ + libsgx-dcap-ql*.rpm \ + libsgx-dcap-ql-dev*.rpm \ + libsgx-dcap-default-qpl*.rpm \ + libsgx-dcap-default-qpl-dev*.rpm \ + libsgx-dcap-quote-verify-dev*.rpm \ + libsgx-uae-service*.rpm \ + libsgx-epid*.rpm \ + libsgx-launch*.rpm \ + sgx-aesm-service*.rpm && \ + rm -rf /tmp/sgx_rpm_local_repo + +# Install SGX SDK +WORKDIR /tmp +RUN git clone -b sgx_2.11_for_occlum https://github.com/occlum/linux-sgx && \ + cd linux-sgx && \ + make preparation && \ + ./compile_and_install.sh no_mitigation USE_OPT_LIBS=2 && \ + echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \ + rm -rf /tmp/linux-sgx + # Install the latest version of Occlum ARG OCCLUM_BRANCH WORKDIR /root @@ -120,6 +152,6 @@ RUN git clone -b $OCCLUM_BRANCH https://github.com/occlum/occlum && \ # as a "real" service since the pid 1 is not systemd in Docker. So we start # up AESM service when an user login with an interative shell. COPY docker/start_aesm.sh /opt/occlum/ -RUN echo '/opt/occlum/start_aesm.sh' >> /root/.bashrc +RUN mkdir -p /var/run/aesmd && echo '/opt/occlum/start_aesm.sh' >> /root/.bashrc WORKDIR /root diff --git a/tools/docker/Dockerfile.centos8.2 b/tools/docker/Dockerfile.centos8.2 new file mode 100644 index 00000000..f8ec3a2b --- /dev/null +++ b/tools/docker/Dockerfile.centos8.2 @@ -0,0 +1,158 @@ +FROM alpine:3.11 AS alpine +LABEL maintainer="Qing Li " +RUN apk update && \ + apk --no-cache add openjdk11 --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community + +FROM centos:8.2.2004 + +LABEL maintainer="He Sun " + +RUN yum install epel-release -y && \ + dnf clean all && rm -r /var/cache/dnf && \ + dnf group install 'Development Tools' -y && \ + dnf --enablerepo=PowerTools install -y \ + astyle \ + bison \ + boost-devel \ + cmake \ + createrepo \ + curl-devel \ + expect \ + fuse-devel \ + fuse-libs \ + gawk \ + gmp-devel \ + golang \ + jq \ + libcurl-devel \ + libmpc-devel \ + libxml2-devel \ + mod_ssl \ + mpfr-devel \ + ocaml \ + ocaml-ocamlbuild \ + openssl \ + openssl-devel \ + perl \ + protobuf-devel \ + python2 \ + python3 \ + sudo \ + wget \ + uuid-devel \ + vim \ + yum-utils \ + http://downloads.sourceforge.net/ltp/lcov-1.14-1.noarch.rpm &&\ + alternatives --set python /usr/bin/python2 + +# Install cpuid tool for tests +WORKDIR /tmp +RUN wget http://www.etallen.com/cpuid/cpuid-20200211.x86_64.tar.gz && \ + tar -xf ./cpuid-20200211.x86_64.tar.gz && \ + cp ./cpuid-20200211/cpuid /usr/bin/ && \ + rm -rf /tmp/cpuid-20200211* + +# Install Rust +ENV PATH="/root/.cargo/bin:$PATH" +ENV OCCLUM_RUST_VERSION=nightly-2020-09-08 +RUN curl https://sh.rustup.rs -sSf | \ + sh -s -- --default-toolchain ${OCCLUM_RUST_VERSION} -y && \ + rm -rf /root/.cargo/registry && rm -rf /root/.cargo/git && \ + cargo -V + +# Install Occlum toolchain +COPY toolchains/musl-gcc /tmp/musl-gcc +WORKDIR /tmp +RUN cd musl-gcc && ./build.sh && ./install_zlib.sh && rm -rf /tmp/musl-gcc +ENV PATH="/opt/occlum/build/bin:/usr/local/occlum/bin:$PATH" + +# Install glibc +COPY toolchains/glibc /tmp/glibc +WORKDIR /tmp +RUN cd glibc && ./build.sh && rm -rf /tmp/glibc + +# Install Occlum Golang toolchain +COPY toolchains/golang /tmp/golang +WORKDIR /tmp +RUN cd golang && ./build.sh && rm -rf /tmp/golang +ENV PATH="/opt/occlum/toolchains/golang/bin:$PATH" + +# Install Occlum Rust toolchain +COPY toolchains/rust /tmp/rust +WORKDIR /tmp +RUN cd rust && ./build.sh && rm -rf /tmp/rust +ENV PATH="/opt/occlum/toolchains/rust/bin:$PATH" +ENV LD_LIBRARY_PATH="/opt/intel/sgxsdk/sdk_libs" + +# Install Occlum Java toolchain (JDK 11) +ARG JDK11_PATH=/opt/occlum/toolchains/jvm/java-11-openjdk +COPY --from=alpine /usr/lib/jvm/java-11-openjdk $JDK11_PATH +RUN rm $JDK11_PATH/lib/security/cacerts +COPY --from=alpine /etc/ssl/certs/java/cacerts $JDK11_PATH/lib/security/cacerts +COPY toolchains/java /tmp/java +WORKDIR /tmp +RUN cd java && ./install_dragonwell.sh && rm -rf /tmp/java +ENV PATH="/opt/occlum/toolchains/jvm/bin:$PATH" + +# Install SGX PSW +WORKDIR /tmp +RUN echo "ca_directory=/etc/ssl/certs" >> /etc/wgetrc && \ + wget https://download.01.org/intel-sgx/sgx-linux/2.13/distro/centos8.2-server/sgx_rpm_local_repo.tgz && \ + tar -xvf sgx_rpm_local_repo.tgz && \ + rm sgx_rpm_local_repo.tgz && \ + wget https://download.01.org/intel-sgx/sgx-dcap/1.10/linux/distro/centos8.2-server/sgx_rpm_local_repo.tgz && \ + tar -xvf sgx_rpm_local_repo.tgz && \ + rm sgx_rpm_local_repo.tgz && \ + cd /tmp/sgx_rpm_local_repo && \ + rpm -ivh libsgx-ae-pce*.rpm \ + libsgx-headers*.rpm \ + libsgx-ae-qe3*.rpm \ + libsgx-ae-qve*.rpm \ + libsgx-enclave-common*.rpm \ + libsgx-quote-ex*.rpm \ + libsgx-urts*.rpm \ + libsgx-dcap-ql*.rpm \ + libsgx-qe3-logic*.rpm \ + libsgx-pce-logic*.rpm \ + libsgx-dcap-quote-verify*.rpm \ + libsgx-dcap-ql*.rpm \ + libsgx-dcap-ql-dev*.rpm \ + libsgx-dcap-default-qpl*.rpm \ + libsgx-dcap-default-qpl-dev*.rpm \ + libsgx-dcap-quote-verify-dev*.rpm \ + libsgx-uae-service*.rpm \ + libsgx-epid*.rpm \ + libsgx-launch*.rpm \ + sgx-aesm-service*.rpm && \ + rm -rf /tmp/sgx_rpm_local_repo + +# Install SGX SDK +WORKDIR /tmp +RUN git clone -b sgx_2.13_for_occlum https://github.com/occlum/linux-sgx && \ + cd linux-sgx && \ + make preparation && \ + ./compile_and_install.sh no_mitigation USE_OPT_LIBS=2 && \ + echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \ + rm -rf /tmp/linux-sgx + +# Install the latest version of Occlum +ARG OCCLUM_BRANCH +WORKDIR /root +RUN git clone -b $OCCLUM_BRANCH https://github.com/occlum/occlum && \ + cd occlum && \ + source /root/.bashrc && \ + make submodule && \ + OCCLUM_RELEASE_BUILD=1 make && \ + make install && \ + cp -r demos /root/demos && \ + rm -rf /root/occlum + +# Start AESM service automatically +# +# To do so, we add the script to ~/.bashrc. We cannot use systemd to run AESM +# as a "real" service since the pid 1 is not systemd in Docker. So we start +# up AESM service when an user login with an interative shell. +COPY docker/start_aesm.sh /opt/occlum/ +RUN mkdir -p /var/run/aesmd && echo '/opt/occlum/start_aesm.sh' >> /root/.bashrc + +WORKDIR /root diff --git a/tools/docker/Dockerfile.ubuntu18.04 b/tools/docker/Dockerfile.ubuntu18.04 index 3e6d09c2..1dfe1b48 100644 --- a/tools/docker/Dockerfile.ubuntu18.04 +++ b/tools/docker/Dockerfile.ubuntu18.04 @@ -52,10 +52,16 @@ RUN apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-i vim \ wget \ zip \ + gnupg \ + aptitude \ && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* +RUN echo "ca_directory=/etc/ssl/certs" >> /etc/wgetrc && \ + echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu bionic main' | tee /etc/apt/sources.list.d/intel-sgx.list &&\ + wget -qO - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key --no-check-certificate | apt-key add - + # Install cpuid tool for tests WORKDIR /tmp RUN wget http://www.etallen.com/cpuid/cpuid-20200211.x86_64.tar.gz && \ @@ -63,15 +69,6 @@ RUN wget http://www.etallen.com/cpuid/cpuid-20200211.x86_64.tar.gz && \ cp ./cpuid-20200211/cpuid /usr/bin/ && \ rm -rf /tmp/cpuid-20200211* -# Install SGX SDK -WORKDIR /tmp -RUN git clone -b sgx_2.11_for_occlum https://github.com/occlum/linux-sgx && \ - mkdir /etc/init && \ - cd linux-sgx && \ - ./compile_and_install.sh no_mitigation USE_OPT_LIBS=2 && \ - echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \ - rm -rf /tmp/linux-sgx - # Install Rust ENV PATH="/root/.cargo/bin:$PATH" ENV OCCLUM_RUST_VERSION=nightly-2020-09-08 @@ -114,6 +111,49 @@ WORKDIR /tmp RUN cd java && ./install_dragonwell.sh && rm -rf /tmp/java ENV PATH="/opt/occlum/toolchains/jvm/bin:$PATH" +# Install SGX PSW +RUN apt-get update && aptitude install -y \ + libsgx-launch-dev=2.13.100.4-bionic1 \ + libsgx-epid-dev=2.13.100.4-bionic1 \ + libsgx-quote-ex-dev=2.13.100.4-bionic1 \ + libsgx-urts=2.13.100.4-bionic1 \ + libsgx-enclave-common=2.13.100.4-bionic1 \ + libsgx-uae-service=2.13.100.4-bionic1 \ + libsgx-ae-epid=2.13.100.4-bionic1 \ + libsgx-ae-le=2.13.100.4-bionic1 \ + libsgx-ae-pce=2.13.100.4-bionic1 \ + libsgx-aesm-launch-plugin=2.13.100.4-bionic1 \ + sgx-aesm-service=2.13.100.4-bionic1 \ + libsgx-aesm-launch-plugin=2.13.100.4-bionic1 \ + libsgx-aesm-pce-plugin=2.13.100.4-bionic1 \ + libsgx-aesm-ecdsa-plugin=2.13.100.4-bionic1 \ + libsgx-aesm-epid-plugin=2.13.100.4-bionic1 \ + libsgx-aesm-quote-ex-plugin=2.13.100.4-bionic1 \ + libsgx-dcap-quote-verify=1.10.100.4-bionic1 \ + libsgx-dcap-quote-verify-dev=1.10.100.4-bionic1 \ + libsgx-dcap-ql=1.10.100.4-bionic1 \ + libsgx-dcap-ql-dev=1.10.100.4-bionic1 \ + libsgx-epid=2.13.100.4-bionic1 \ + libsgx-quote-ex=2.13.100.4-bionic1 \ + libsgx-pce-logic=1.10.100.4-bionic1 \ + libsgx-qe3-logic=1.10.100.4-bionic1 \ + libsgx-launch=2.13.100.4-bionic1 \ + libsgx-dcap-default-qpl=1.10.100.4-bionic1 \ + && \ + apt-get clean && \ + rm -rf /var/lib/apt/lists/* && \ + ln -s /usr/lib/x86_64-linux-gnu/libsgx_enclave_common.so.1 /usr/lib/x86_64-linux-gnu/libsgx_enclave_common.so + +# Install SGX SDK +WORKDIR /tmp +RUN git clone -b sgx_2.13_for_occlum https://github.com/occlum/linux-sgx && \ + mkdir /etc/init && \ + cd linux-sgx && \ + make preparation && \ + ./compile_and_install.sh no_mitigation USE_OPT_LIBS=2 && \ + echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \ + rm -rf /tmp/linux-sgx + # Install the latest version of Occlum ARG OCCLUM_BRANCH WORKDIR /root @@ -130,7 +170,7 @@ RUN git clone -b $OCCLUM_BRANCH https://github.com/occlum/occlum && \ # To do so, we add the script to ~/.bashrc. We cannot use systemd to run AESM # as a "real" service since the pid 1 is not systemd in Docker. So we start # up AESM service when an user login with an interative shell. -COPY docker/start_aesm.sh /opt/occlum/ -RUN echo '/opt/occlum/start_aesm.sh' >> /root/.bashrc +COPY docker/start_aesm.sh /opt/occlum/ +RUN mkdir -p /var/run/aesmd && echo '/opt/occlum/start_aesm.sh' >> /root/.bashrc WORKDIR /root diff --git a/tools/docker/build_image.sh b/tools/docker/build_image.sh index 4e97023c..c1b64d7d 100755 --- a/tools/docker/build_image.sh +++ b/tools/docker/build_image.sh @@ -20,8 +20,7 @@ USAGE: : The name of the OS distribution that the Docker image is based on. Currently, must be one of the following values: ubuntu18.04 Use Ubuntu 18.04 as the base image - centos7.5 Use CentOS 7.5 as the base image - centos8.1 Use CentOS 8.1 as the base image + centos8.2 Use CentOS 8.2 as the base image The resulting Docker image will have "occlum/occlum:-" as its label. EOF @@ -44,7 +43,7 @@ function check_item_in_list() { [[ $list =~ (^|[[:space:]])$item($|[[:space:]]) ]] } -check_item_in_list "$os_name" "ubuntu18.04 centos7.5 centos8.1" || report_error +check_item_in_list "$os_name" "ubuntu18.04 centos8.2" || report_error cd "$script_dir/.." docker build -f "$script_dir/Dockerfile.$os_name" -t "occlum/occlum:$occlum_label-$os_name" --build-arg OCCLUM_BRANCH=$occlum_branch . diff --git a/tools/docker/start_aesm.sh b/tools/docker/start_aesm.sh index caee22f4..36be66a9 100755 --- a/tools/docker/start_aesm.sh +++ b/tools/docker/start_aesm.sh @@ -1,5 +1,5 @@ #!/bin/bash # Start AESM service required by Intel SGX SDK if it is not running if ! pgrep "aesm_service" > /dev/null ; then - LD_LIBRARY_PATH="/opt/intel/sgxpsw/aesm:$LD_LIBRARY_PATH" /opt/intel/sgxpsw/aesm/aesm_service + LD_LIBRARY_PATH="/opt/intel/sgx-aesm-service/aesm:$LD_LIBRARY_PATH" /opt/intel/sgx-aesm-service/aesm/aesm_service --no-daemon fi