mirror of
https://github.com/matter-labs/teepot.git
synced 2025-07-21 23:23:57 +02:00
feat: use nixsgx nix function to create containers
It refactors the way the SGX containers are built. This removes all `Dockerfile` and gramine manifest files. It also enables a single recipe for azure and non-azure variants. Additionally the `teepot-crate.nix` is now the inherited recipe to build the rust `teepot` crate. Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
This commit is contained in:
Harald Hoyer
parent
93e3e73d56
commit
d0c5950c0e
GPG key ID:
F519A1143B3FBE32
30 changed files with 337 additions and 897 deletions
|
|
@ -1,25 +0,0 @@
|
|||
# SPDX-License-Identifier: Apache-2.0
|
||||
# Copyright (c) 2024 Matter Labs
|
||||
|
||||
FROM teepot-vault-admin-sgx-azure:base
|
||||
|
||||
WORKDIR /app
|
||||
|
||||
COPY packages/container-vault-sgx-azure/test-enclave-key.pem /tmp/
|
||||
|
||||
RUN set -eux; \
|
||||
gramine-manifest -Darch_libdir=/lib/x86_64-linux-gnu \
|
||||
-Dentrypoint=$(readlink /bin/tee-vault-admin) \
|
||||
-Dexecdir=/bin \
|
||||
-Dlog_level=warning \
|
||||
tee-vault-admin.manifest.toml tee-vault-admin.manifest; \
|
||||
gramine-sgx-sign --manifest tee-vault-admin.manifest --output tee-vault-admin.manifest.sgx --key /tmp/test-enclave-key.pem; \
|
||||
rm /tmp/test-enclave-key.pem
|
||||
|
||||
VOLUME /opt/vault/tls
|
||||
|
||||
EXPOSE 8443
|
||||
|
||||
ENTRYPOINT ["/bin/sh", "-c"]
|
||||
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
|
||||
CMD [ "echo tee-vault-admin in SGX mode starting; [[ -r /var/run/aesmd/aesm.socket ]] || restart-aesmd ; exec gramine-sgx tee-vault-admin" ]
|
||||
|
|
@ -1,49 +1,53 @@
|
|||
# SPDX-License-Identifier: Apache-2.0
|
||||
# Copyright (c) 2024 Matter Labs
|
||||
{ pkgs
|
||||
, nixsgx
|
||||
, curl
|
||||
{ lib
|
||||
, pkgs
|
||||
, inputs
|
||||
, teepot
|
||||
, bash
|
||||
, coreutils
|
||||
, openssl
|
||||
, nixsgx
|
||||
, container-name ? "teepot-vault-admin-sgx-azure"
|
||||
, tag ? "latest"
|
||||
, isAzure ? true
|
||||
}:
|
||||
let manifest = ./tee-vault-admin.manifest.toml;
|
||||
in pkgs.dockerTools.buildLayeredImage {
|
||||
name = "teepot-vault-admin-sgx-azure";
|
||||
tag = "base";
|
||||
pkgs.callPackage inputs.nixsgx-flake.lib.mkSGXContainer {
|
||||
name = container-name;
|
||||
inherit tag;
|
||||
|
||||
config.Entrypoint = [ "/bin/sh" "-c" ];
|
||||
packages = [ teepot.teepot.tee_vault_admin ];
|
||||
entrypoint = "${teepot.teepot.tee_vault_admin}/bin/tee-vault-admin";
|
||||
|
||||
contents = pkgs.buildEnv {
|
||||
name = "image-root";
|
||||
isAzure = true;
|
||||
|
||||
paths = with pkgs.dockerTools; with nixsgx;[
|
||||
bash
|
||||
coreutils
|
||||
openssl.out
|
||||
azure-dcap-client
|
||||
curl.out
|
||||
teepot.teepot.tee_vault_admin
|
||||
gramine
|
||||
restart-aesmd
|
||||
sgx-dcap.quote_verify
|
||||
sgx-psw
|
||||
usrBinEnv
|
||||
binSh
|
||||
caCertificates
|
||||
fakeNss
|
||||
];
|
||||
pathsToLink = [ "/bin" "/lib" "/etc" "/app" ];
|
||||
postBuild = ''
|
||||
mkdir -p $out/{app,etc}
|
||||
cp ${manifest} $out/app/tee-vault-admin.manifest.toml
|
||||
mkdir -p $out/var/run
|
||||
mkdir -p $out/${nixsgx.sgx-psw.out}/aesm/
|
||||
touch $out/etc/sgx_default_qcnl.conf
|
||||
ln -s ${curl.out}/lib/libcurl.so $out/${nixsgx.sgx-psw.out}/aesm/
|
||||
ln -s ${nixsgx.azure-dcap-client.out}/lib/libdcap_quoteprov.so $out/${nixsgx.sgx-psw.out}/aesm/libdcap_quoteprov.so.1
|
||||
printf "precedence ::ffff:0:0/96 100\n" > $out/etc/gai.conf
|
||||
'';
|
||||
manifest = {
|
||||
loader = {
|
||||
log_level = "error";
|
||||
env = {
|
||||
### Admin Config ###
|
||||
PORT.passthrough = true;
|
||||
|
||||
### VAULT attestation ###
|
||||
VAULT_ADDR.passthrough = true;
|
||||
VAULT_SGX_MRENCLAVE.passthrough = true;
|
||||
VAULT_SGX_MRSIGNER.passthrough = true;
|
||||
VAULT_SGX_ALLOWED_TCB_LEVELS.passthrough = true;
|
||||
|
||||
### DEBUG ###
|
||||
RUST_BACKTRACE = "1";
|
||||
RUST_LOG = "info,tee_vault_admin=trace,teepot=trace,vault_tee_client=trace,tee_client=trace,awc=debug";
|
||||
|
||||
### Enclave security ###
|
||||
ALLOWED_TCB_LEVELS = "SwHardeningNeeded";
|
||||
};
|
||||
};
|
||||
|
||||
sgx = {
|
||||
edmm_enable = false;
|
||||
enclave_size = "2G";
|
||||
max_threads = 64;
|
||||
};
|
||||
|
||||
# possible tweak option, if problems with mio
|
||||
# currently mio is compiled with `mio_unsupported_force_waker_pipe`
|
||||
# sys.insecure__allow_eventfd = true
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,71 +0,0 @@
|
|||
libos.entrypoint = "{{ entrypoint }}"
|
||||
|
||||
[loader]
|
||||
argv = ["{{ entrypoint }}"]
|
||||
entrypoint = "file:{{ gramine.libos }}"
|
||||
|
||||
[loader.env]
|
||||
### Admin Config ###
|
||||
PORT = { passthrough = true }
|
||||
|
||||
### VAULT attestation ###
|
||||
VAULT_ADDR = { passthrough = true }
|
||||
VAULT_SGX_MRENCLAVE = { passthrough = true }
|
||||
VAULT_SGX_MRSIGNER = { passthrough = true }
|
||||
VAULT_SGX_ALLOWED_TCB_LEVELS = { passthrough = true }
|
||||
|
||||
### DEBUG ###
|
||||
RUST_BACKTRACE = "1"
|
||||
RUST_LOG = "info,tee_vault_admin=trace,teepot=trace,vault_tee_client=trace,tee_client=trace,awc=debug"
|
||||
|
||||
### Enclave security ###
|
||||
ALLOWED_TCB_LEVELS = "SwHardeningNeeded"
|
||||
|
||||
### Fixed values ###
|
||||
LD_LIBRARY_PATH = "/lib"
|
||||
SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt"
|
||||
PATH = "/bin"
|
||||
HOME = "/app"
|
||||
|
||||
MALLOC_ARENA_MAX = "1"
|
||||
AZDCAP_DEBUG_LOG_LEVEL = "ignore"
|
||||
AZDCAP_COLLATERAL_VERSION = "v4"
|
||||
|
||||
[fs]
|
||||
root.uri = "file:/"
|
||||
start_dir = "/app"
|
||||
mounts = [
|
||||
{ path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
|
||||
{ path = "{{ gramine.runtimedir() }}/libdcap_quoteprov.so", uri = "file:/lib/libdcap_quoteprov.so" },
|
||||
{ type = "tmpfs", path = "/var/tmp" },
|
||||
{ type = "tmpfs", path = "/tmp" },
|
||||
{ type = "tmpfs", path = "/app/.dcap-qcnl" },
|
||||
{ type = "tmpfs", path = "/app/.az-dcap-client" },
|
||||
]
|
||||
|
||||
[sgx]
|
||||
trusted_files = [
|
||||
"file:/app/",
|
||||
"file:/bin/",
|
||||
"file:/etc/gai.conf",
|
||||
"file:/etc/sgx_default_qcnl.conf",
|
||||
"file:/etc/ssl/certs/ca-bundle.crt",
|
||||
"file:/lib/",
|
||||
"file:/lib/libdcap_quoteprov.so",
|
||||
"file:/nix/",
|
||||
"file:{{ gramine.libos }}",
|
||||
"file:{{ gramine.runtimedir() }}/",
|
||||
]
|
||||
remote_attestation = "dcap"
|
||||
max_threads = 64
|
||||
edmm_enable = false
|
||||
## max enclave size
|
||||
enclave_size = "2G"
|
||||
|
||||
[sys]
|
||||
enable_extra_runtime_domain_names_conf = true
|
||||
enable_sigterm_injection = true
|
||||
|
||||
# possible tweak option, if problems with mio
|
||||
# currently mio is compiled with `mio_unsupported_force_waker_pipe`
|
||||
# insecure__allow_eventfd = true
|
||||
Loading…
Add table
Add a link
Reference in a new issue