harald/teepot
1
0
Fork 0
mirror of https://github.com/matter-labs/teepot.git synced 2025-07-21 23:23:57 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(tdx-google): enhance container service setup

Browse source 
- Add `vector.service` and `chronyd.service` dependencies to `docker_start_container` service.
- Use `EnvironmentFile` and a pre-start script to dynamically generate environment variables for container setup.
- Improve error handling and clarity in container initialization.
This commit is contained in:
Harald Hoyer 2025-02-13 15:46:23 +01:00
parent 908579cd60
commit a41460b7f0
Signed by: harald
GPG key ID: F519A1143B3FBE32
3 changed files with 50 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

3
bin/tdx-test/src/main.rs
View file

@ -46,7 +46,8 @@ enum AppError {
#[tokio::main] #[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error + Send + Sync>> { async fn main() -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
let config = load_config_with_telemetry(|config: &AppConfig| &config.telemetry).await?; let config =
load_config_with_telemetry("APP".into(), |config: &AppConfig| &config.telemetry).await?;
loop { loop {
error!(?config, "error test!"); error!(?config, "error test!");

40
crates/teepot/src/config/mod.rs
View file

@ -170,27 +170,35 @@ fn protocol_from_string(protocol: &str) -> Result<opentelemetry_otlp::Protocol,
pub async fn load_config_with_telemetry< pub async fn load_config_with_telemetry<
S: Default + Serialize + for<'a> Deserialize<'a> + Send + 'static, S: Default + Serialize + for<'a> Deserialize<'a> + Send + 'static,
>( >(
env_prefix: String,
get_telemetry_config: fn(&S) -> &TelemetryConfig, get_telemetry_config: fn(&S) -> &TelemetryConfig,
) -> Result<S, Box<dyn std::error::Error + Send + Sync>> { ) -> Result<S, Box<dyn std::error::Error + Send + Sync>> {
with_console_logging(async move { with_console_logging(async move {
trace!("Loading config"); trace!("Loading config");
// Load configuration // Load configuration
let config = ConfigBuilder::<AsyncState>::default() let config = {
.add_source(Config::try_from(&S::default())?) let c = ConfigBuilder::<AsyncState>::default()
.add_source(File::with_name("config/default").required(false)) .add_source(Config::try_from(&S::default())?)
.add_source( .add_source(File::with_name("config/default").required(false))
config::Environment::with_prefix("APP") .add_source(
.try_parsing(true) config::Environment::with_prefix(&env_prefix)
.separator("_"), .try_parsing(true)
) .separator("_"),
.add_async_source(HttpSource { );
uri: DEFAULT_INSTANCE_METADATA_BASE_URL.into(),
format: FileFormat::Json, if std::env::var_os("GOOGLE_METADATA").is_some() {
required: false, c.add_async_source(HttpSource {
}) uri: DEFAULT_INSTANCE_METADATA_BASE_URL.into(),
.build() format: FileFormat::Json,
.await? required: false,
.try_deserialize::<S>()?; })
.build()
.await?
.try_deserialize::<S>()?
} else {
c.build().await?.try_deserialize::<S>()?
}
};
// Initialize telemetry // Initialize telemetry
init_telemetry(get_telemetry_config(&config))?; init_telemetry(get_telemetry_config(&config))?;

35
packages/tdx_google/configuration.nix
View file

@ -85,23 +85,36 @@
systemd.services.docker_start_container = { systemd.services.docker_start_container = {
description = "The main application container"; description = "The main application container";
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
after = [ "network-online.target" "docker.service" ]; after = [ "network-online.target" "docker.service" "vector.service" "chronyd.service" ];
requires = [ "network-online.target" "docker.service" ]; requires = [ "network-online.target" "docker.service" "vector.service" ];
serviceConfig = { serviceConfig = {
Type = "exec"; Type = "exec";
User = "root"; User = "root";
EnvironmentFile = "-/run/container/env";
ExecStartPre = "+" + toString (
pkgs.writeShellScript "container-start-pre" ''
set -eu -o pipefail
: "''${CONTAINER_IMAGE:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_image" -H "Metadata-Flavor: Google")}"
: "''${CONTAINER_HUB:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_hub" -H "Metadata-Flavor: Google")}"
: "''${CONTAINER_USER:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_user" -H "Metadata-Flavor: Google")}"
: "''${CONTAINER_TOKEN:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_token" -H "Metadata-Flavor: Google")}"
: "''${CONTAINER_IMAGE:?Error: Missing CONTAINER_IMAGE}"
: "''${CONTAINER_HUB:?Error: Missing CONTAINER_HUB}"
mkdir -p /run/container
cat >/run/container/env <<EOF
CONTAINER_IMAGE="''${CONTAINER_IMAGE}"
CONTAINER_HUB="''${CONTAINER_HUB}"
CONTAINER_USER="''${CONTAINER_USER}"
CONTAINER_TOKEN="''${CONTAINER_TOKEN}"
EOF
''
);
}; };
path = [ pkgs.curl pkgs.docker pkgs.teepot.teepot.tdx_extend pkgs.coreutils ]; path = [ pkgs.curl pkgs.docker pkgs.teepot.teepot.tdx_extend pkgs.coreutils ];
script = '' script = ''
set -eu -o pipefail set -eu -o pipefail
: "''${CONTAINER_IMAGE:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_image" -H "Metadata-Flavor: Google")}"
: "''${CONTAINER_HUB:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_hub" -H "Metadata-Flavor: Google")}"
: "''${CONTAINER_USER:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_user" -H "Metadata-Flavor: Google")}"
: "''${CONTAINER_TOKEN:=$(curl --silent --fail "http://metadata.google.internal/computeMetadata/v1/instance/attributes/container_token" -H "Metadata-Flavor: Google")}"
: "''${CONTAINER_IMAGE:?Error: Missing CONTAINER_IMAGE}"
: "''${CONTAINER_HUB:?Error: Missing CONTAINER_HUB}"
if [[ $CONTAINER_USER ]] && [[ $CONTAINER_TOKEN ]]; then if [[ $CONTAINER_USER ]] && [[ $CONTAINER_TOKEN ]]; then
docker login -u "$CONTAINER_USER" -p "$CONTAINER_TOKEN" "$CONTAINER_HUB" docker login -u "$CONTAINER_USER" -p "$CONTAINER_TOKEN" "$CONTAINER_HUB"
fi fi
@ -111,7 +124,7 @@
DIGEST=''${DIGEST#sha256:} DIGEST=''${DIGEST#sha256:}
echo "Measuring $DIGEST" >&2 echo "Measuring $DIGEST" >&2
test -c /dev/tdx_guest && tdx-extend --digest "$DIGEST" --rtmr 3 test -c /dev/tdx_guest && tdx-extend --digest "$DIGEST" --rtmr 3
exec docker run --network=host --init --privileged "sha256:$DIGEST" exec docker run --env "GOOGLE_METADATA=1" --network=host --init --privileged "sha256:$DIGEST"
''; '';
postStop = lib.mkDefault '' postStop = lib.mkDefault ''