occlum/tools/docker/Dockerfile.ubuntu20.04

FROM alpine:3.11 AS alpine

LABEL maintainer="Qing Li <geding.lq@antgroup.com>"

RUN apk update && \
    apk --no-cache add openjdk11 openjdk8 --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community

FROM ubuntu:20.04

LABEL maintainer="Qing Li <geding.lq@antgroup.com>"

#The default shell for the RUN instruction is ["/bin/sh", "-c"], which sometimes cause unexpected error
#for example "source a_file". Use bash as default shell instead.
SHELL ["/bin/bash", "-c"]

RUN apt-get update && DEBIAN_FRONTEND="noninteractive" apt-get install -y --no-install-recommends \
        alien \
        astyle \
        autoconf \
        automake \
        bison \
        build-essential \
        ca-certificates \
        cmake \
        curl \
        debhelper \
        expect \
        g++ \
        gawk \
        gdb \
        git-core \
        golang-go \
        jq \
        kmod \
        lcov \
        libboost-system-dev \
        libboost-thread-dev \
        libclang-dev \
        libcurl4-openssl-dev \
        libfuse-dev \
        libjsoncpp-dev \
        liblog4cpp5-dev \
        libprotobuf-c-dev \
        libprotobuf-dev \
        libssl-dev \
        libtool \
        libxml2-dev \
        nano \
        ocaml \
        ocamlbuild \
        pkg-config \
        protobuf-compiler \
        python \
        python3-pip \
        sudo \
        unzip \
        uuid-dev \
        vim \
        wget \
        zip \
        gnupg \
        aptitude \
        rsync \
        cpuid \
        && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

RUN echo "ca_directory=/etc/ssl/certs" >> /etc/wgetrc && \
    echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main' | tee /etc/apt/sources.list.d/intel-sgx.list &&\
    wget -qO - https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key --no-check-certificate | apt-key add -

# Install cpuid tool for tests
# WORKDIR /tmp
# RUN wget http://www.etallen.com/cpuid/cpuid-20200211.x86_64.tar.gz && \
#    tar -xf ./cpuid-20200211.x86_64.tar.gz && \
#    cp ./cpuid-20200211/cpuid /usr/bin/ && \
#    rm -rf /tmp/cpuid-20200211*

# Install Rust
ENV PATH="/root/.cargo/bin:$PATH"
ENV OCCLUM_RUST_VERSION=nightly-2022-02-23
RUN curl https://sh.rustup.rs -sSf | \
        sh -s -- --default-toolchain ${OCCLUM_RUST_VERSION} -y && \
    rm -rf /root/.cargo/registry && rm -rf /root/.cargo/git && \
    cargo -V

# Install SGX PSW
ARG PSW_VERSION=2.17.100.3
ARG DCAP_VERSION=1.14.100.3
RUN apt-get update && aptitude install -y \
        libsgx-launch-dev=$PSW_VERSION-focal1 \
        libsgx-epid-dev=$PSW_VERSION-focal1 \
        libsgx-quote-ex-dev=$PSW_VERSION-focal1 \
        libsgx-urts=$PSW_VERSION-focal1 \
        libsgx-enclave-common=$PSW_VERSION-focal1 \
        libsgx-uae-service=$PSW_VERSION-focal1 \
        libsgx-ae-epid=$PSW_VERSION-focal1 \
        libsgx-ae-le=$PSW_VERSION-focal1 \
        libsgx-ae-pce=$PSW_VERSION-focal1 \
        libsgx-aesm-launch-plugin=$PSW_VERSION-focal1 \
        sgx-aesm-service=$PSW_VERSION-focal1 \
        libsgx-aesm-launch-plugin=$PSW_VERSION-focal1 \
        libsgx-aesm-pce-plugin=$PSW_VERSION-focal1 \
        libsgx-aesm-ecdsa-plugin=$PSW_VERSION-focal1 \
        libsgx-aesm-epid-plugin=$PSW_VERSION-focal1 \
        libsgx-aesm-quote-ex-plugin=$PSW_VERSION-focal1 \
        libsgx-ae-id-enclave=$DCAP_VERSION-focal1 \
        libsgx-ae-qe3=$DCAP_VERSION-focal1 \
        libsgx-ae-qve=$DCAP_VERSION-focal1 \
        libsgx-dcap-quote-verify=$DCAP_VERSION-focal1 \
        libsgx-dcap-quote-verify-dev=$DCAP_VERSION-focal1 \
        libsgx-dcap-ql=$DCAP_VERSION-focal1 \
        libsgx-dcap-ql-dev=$DCAP_VERSION-focal1 \
        libsgx-epid=$PSW_VERSION-focal1 \
        libsgx-quote-ex=$PSW_VERSION-focal1 \
        libsgx-pce-logic=$DCAP_VERSION-focal1 \
        libsgx-qe3-logic=$DCAP_VERSION-focal1 \
        libsgx-launch=$PSW_VERSION-focal1 \
        libsgx-dcap-default-qpl=$DCAP_VERSION-focal1 \
        && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/* && \
    ln -s /usr/lib/x86_64-linux-gnu/libsgx_enclave_common.so.1 /usr/lib/x86_64-linux-gnu/libsgx_enclave_common.so

# Install SGX SDK
WORKDIR /tmp
RUN git clone -b sgx_2.17.1_for_occlum https://github.com/occlum/linux-sgx && \
    mkdir /etc/init && \
    cd linux-sgx && \
    make preparation && \
    ./compile_and_install.sh no_mitigation USE_OPT_LIBS=3 && \
    echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \
    rm -rf /tmp/linux-sgx

# Download the Occlum source
ARG OCCLUM_BRANCH
WORKDIR /root
RUN git clone -b $OCCLUM_BRANCH https://github.com/occlum/occlum && \
    cp -r /root/occlum/tools/toolchains/* /tmp/ && mkdir -p /opt/occlum/ && \
    cp /root/occlum/tools/docker/start_aesm.sh /opt/occlum/

# Install Occlum toolchain
WORKDIR /tmp
RUN cd musl-gcc && ./build.sh && ./install_zlib.sh && rm -rf /tmp/musl-gcc
ENV PATH="/opt/occlum/build/bin:/usr/local/occlum/bin:$PATH"

# Install glibc
WORKDIR /tmp
RUN cd glibc && ./build.sh && rm -rf /tmp/glibc

# Install Occlum Golang toolchain
WORKDIR /tmp
RUN cd golang && ./build.sh && rm -rf /tmp/golang
ENV PATH="/opt/occlum/toolchains/golang/bin:$PATH"

# Install Occlum Rust toolchain
WORKDIR /tmp
RUN cd rust && ./build.sh && rm -rf /tmp/rust
ENV PATH="/opt/occlum/toolchains/rust/bin:$PATH"
ENV LD_LIBRARY_PATH="/opt/intel/sgxsdk/sdk_libs"

# Install Occlum bash
WORKDIR /tmp
RUN cd bash && ./build.sh && rm -rf /tmp/bash

# Install Occlum busybox
WORKDIR /tmp
RUN cd busybox && ./build.sh && rm -rf /tmp/busybox

# Install Occlum Java toolchain (JDK 11)
ARG JDK11_PATH=/opt/occlum/toolchains/jvm/java-11-openjdk
COPY --from=alpine /usr/lib/jvm/java-11-openjdk $JDK11_PATH
RUN rm $JDK11_PATH/lib/security/cacerts
COPY --from=alpine /etc/ssl/certs/java/cacerts $JDK11_PATH/lib/security/cacerts
WORKDIR /tmp
RUN cd java && ./install_dragonwell.sh && rm -rf /tmp/java
ENV PATH="/opt/occlum/toolchains/jvm/bin:$PATH"

# Install OpenJDK 8
ARG JDK8_PATH=/opt/occlum/toolchains/jvm/java-1.8-openjdk
COPY --from=alpine /usr/lib/jvm/java-1.8-openjdk $JDK8_PATH
RUN rm $JDK8_PATH/jre/lib/security/cacerts
COPY --from=alpine /etc/ssl/certs/java/cacerts $JDK8_PATH/jre/lib/security/cacerts

WORKDIR /root
RUN cd occlum && \
    source /opt/intel/sgxsdk/environment && \
    make submodule && \
    OCCLUM_RELEASE_BUILD=1 make && \
    make install && \
    cp -r demos /root/demos && \
    rm -rf /root/occlum

# Start AESM service automatically
#
# To do so, we add the script to ~/.bashrc. We cannot use systemd to run AESM
# as a "real" service since the pid 1 is not systemd in Docker. So we start
# up AESM service when an user login with an interative shell.
RUN mkdir -p /var/run/aesmd && echo '/opt/occlum/start_aesm.sh' >> /root/.bashrc

WORKDIR /root