feat: use nixsgx nix function to create containers

It refactors the way the SGX containers are built.
This removes all `Dockerfile` and gramine manifest files.
It also enables a single recipe for azure and non-azure variants.

Additionally the `teepot-crate.nix` is now the inherited recipe to
build the rust `teepot` crate.

Signed-off-by: Harald Hoyer <harald@matterlabs.dev>

packages/container-self-attestation-test-sgx-azure/Dockerfile

@@ -1,23 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-# Copyright (c) 2024 Matter Labs
-
-FROM teepot-self-attestation-test-sgx-azure:base
-
-WORKDIR /app
-
-COPY packages/container-vault-sgx-azure/test-enclave-key.pem /tmp/
-
-RUN set -eux; \
-    gramine-manifest -Darch_libdir=/lib/x86_64-linux-gnu \
-      -Dentrypoint=$(readlink /bin/tee-self-attestation-test) \
-      -Dexecdir=/bin \
-      -Dlog_level=error \
-      tee-self-attestation-test.manifest.toml tee-self-attestation-test.manifest; \
-    gramine-sgx-sign --manifest tee-self-attestation-test.manifest --output tee-self-attestation-test.manifest.sgx --key /tmp/test-enclave-key.pem; \
-    rm /tmp/test-enclave-key.pem
-
-EXPOSE 8443
-
-ENTRYPOINT ["/bin/sh", "-c"]
-ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
-CMD [ "[[ -r /var/run/aesmd/aesm.socket ]] || restart-aesmd >&2; exec gramine-sgx tee-self-attestation-test" ]

packages/container-self-attestation-test-sgx-azure/default.nix

@@ -1,50 +1,35 @@
 # SPDX-License-Identifier: Apache-2.0
 # Copyright (c) 2024 Matter Labs
-{ pkgs
-, nixsgx
-, curl
+{ lib
+, pkgs
+, inputs
 , teepot
-, bash
-, coreutils
-, openssl
+, nixsgx
+, container-name ? "teepot-self-attestation-test-sgx-azure"
+, tag ? "latest"
+, isAzure ? true
 }:
-let manifest = ./tee-self-attestation-test.manifest.toml;
-in pkgs.dockerTools.buildLayeredImage {
-  name = "teepot-self-attestation-test-sgx-azure";
-  tag = "base";
+pkgs.callPackage inputs.nixsgx-flake.lib.mkSGXContainer {
+  name = container-name;
+  inherit tag;
 
-  config.Entrypoint = [ "/bin/sh" "-c" ];
+  packages = [ teepot.teepot.tee_self_attestation_test ];
+  entrypoint = "${teepot.teepot.tee_self_attestation_test}/bin/tee-self-attestation-test";
 
-  contents = pkgs.buildEnv {
-    name = "image-root";
+  inherit isAzure;
 
-    paths = with pkgs.dockerTools; with nixsgx;[
-      bash
-      coreutils
-      openssl.out
-      azure-dcap-client
-      curl.out
-      teepot.teepot.tee_self_attestation_test
-      gramine
-      restart-aesmd
-      sgx-dcap.quote_verify
-      sgx-psw
-      usrBinEnv
-      binSh
-      caCertificates
-      fakeNss
-    ];
-    pathsToLink = [ "/bin" "/lib" "/etc" "/share" "/app" ];
-    postBuild = ''
-      mkdir -p $out/{app,etc}
-      cp ${manifest} $out/app/tee-self-attestation-test.manifest.toml
-      mkdir -p $out/var/run
-      mkdir -p $out/${nixsgx.sgx-psw.out}/aesm/
-      touch $out/etc/sgx_default_qcnl.conf
-      mkdir -p $out/opt/vault/.cache $out/opt/vault/tls
-      ln -s ${curl.out}/lib/libcurl.so $out/${nixsgx.sgx-psw.out}/aesm/
-      ln -s ${nixsgx.azure-dcap-client.out}/lib/libdcap_quoteprov.so $out/${nixsgx.sgx-psw.out}/aesm/libdcap_quoteprov.so.1
-      printf "precedence ::ffff:0:0/96  100\n" > $out/etc/gai.conf
-    '';
+  manifest = {
+    loader = {
+      log_level = "error";
+      env = {
+        RUST_BACKTRACE = "1";
+        RUST_LOG = "warning";
+      };
+    };
+    sgx = {
+      edmm_enable = false;
+      enclave_size = "2G";
+      max_threads = 64;
+    };
   };
 }

packages/container-self-attestation-test-sgx-azure/tee-self-attestation-test.manifest.toml

@@ -1,56 +0,0 @@
-libos.entrypoint = "{{ entrypoint }}"
-
-[loader]
-argv = ["{{ entrypoint }}"]
-entrypoint = "file:{{ gramine.libos }}"
-log_level = "{{ log_level }}"
-
-[loader.env]
-### DEBUG ###
-RUST_BACKTRACE = "1"
-RUST_LOG = "warning"
-
-### Fixed values ###
-LD_LIBRARY_PATH = "{{ gramine.runtimedir() }}:/lib"
-SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt"
-PATH = "/bin"
-HOME = "/app"
-
-MALLOC_ARENA_MAX = "1"
-AZDCAP_DEBUG_LOG_LEVEL = "ignore"
-AZDCAP_COLLATERAL_VERSION = "v4"
-
-[fs]
-root.uri = "file:/"
-start_dir = "/app"
-mounts = [
-  { type = "tmpfs", path = "/var/tmp" },
-  { type = "tmpfs", path = "/tmp" },
-  { type = "tmpfs", path = "/app/.dcap-qcnl" },
-  { type = "tmpfs", path = "/app/.az-dcap-client" },
-]
-
-[sgx]
-trusted_files = [
-  "file:/app/",
-  "file:/bin/",
-  "file:/etc/gai.conf",
-  "file:/etc/ssl/certs/ca-bundle.crt",
-  "file:/lib/",
-  "file:/nix/",
-  "file:{{ gramine.libos }}",
-  "file:{{ gramine.runtimedir() }}/",
-]
-remote_attestation = "dcap"
-max_threads = 64
-edmm_enable = false
-## max enclave size
-enclave_size = "2G"
-
-[sys]
-enable_extra_runtime_domain_names_conf = true
-enable_sigterm_injection = true
-
-# possible tweak option, if problems with mio
-# currently mio is compiled with `mio_unsupported_force_waker_pipe`
-# insecure__allow_eventfd = true