mirror of
https://github.com/matter-labs/teepot.git
synced 2025-07-21 15:13:56 +02:00
feat: use nixsgx nix function to create containers
It refactors the way the SGX containers are built. This removes all `Dockerfile` and gramine manifest files. It also enables a single recipe for azure and non-azure variants. Additionally the `teepot-crate.nix` is now the inherited recipe to build the rust `teepot` crate. Signed-off-by: Harald Hoyer <harald@matterlabs.dev>
This commit is contained in:
Harald Hoyer
parent
93e3e73d56
commit
d0c5950c0e
GPG key ID:
F519A1143B3FBE32
30 changed files with 337 additions and 897 deletions
|
|
@ -1,25 +0,0 @@
|
|||
# SPDX-License-Identifier: Apache-2.0
|
||||
# Copyright (c) 2024 Matter Labs
|
||||
|
||||
FROM teepot-vault-sgx-azure:base
|
||||
|
||||
WORKDIR /opt/vault
|
||||
|
||||
COPY packages/container-vault-sgx-azure/test-enclave-key.pem /tmp/
|
||||
RUN set -eux; \
|
||||
gramine-manifest \
|
||||
-Dtee_ratls_preexec=$(readlink /bin/tee-ratls-preexec) \
|
||||
-Dvault_exec=$(readlink /bin/vault) \
|
||||
-Darch_libdir=/lib/x86_64-linux-gnu \
|
||||
-Dexecdir=/bin \
|
||||
-Dlog_level=warning \
|
||||
vault.manifest.toml vault.manifest; \
|
||||
gramine-sgx-sign --manifest vault.manifest --output vault.manifest.sgx --key /tmp/test-enclave-key.pem; \
|
||||
rm /tmp/test-enclave-key.pem
|
||||
|
||||
VOLUME /opt/vault/tls
|
||||
VOLUME /opt/vault/data
|
||||
|
||||
ENTRYPOINT ["/bin/sh", "-c"]
|
||||
ENV SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt
|
||||
CMD [ "echo vault in SGX mode starting; [[ -r /var/run/aesmd/aesm.socket ]] || restart-aesmd ; exec gramine-sgx vault" ]
|
||||
|
|
@ -1,54 +1,92 @@
|
|||
# SPDX-License-Identifier: Apache-2.0
|
||||
# Copyright (c) 2024 Matter Labs
|
||||
{ pkgs
|
||||
, vat
|
||||
, nixsgx
|
||||
, curl
|
||||
{ lib
|
||||
, pkgs
|
||||
, inputs
|
||||
, teepot
|
||||
, bash
|
||||
, coreutils
|
||||
, openssl
|
||||
, nixsgx
|
||||
, vat
|
||||
, vault
|
||||
, container-name ? "teepot-vault-sgx-azure"
|
||||
, tag ? "latest"
|
||||
, isAzure ? true
|
||||
}:
|
||||
let manifest = ./vault.manifest.toml;
|
||||
in pkgs.dockerTools.buildLayeredImage {
|
||||
name = "teepot-vault-sgx-azure";
|
||||
tag = "base";
|
||||
let
|
||||
entrypoint = "${teepot.teepot.tee_ratls_preexec}/bin/tee-ratls-preexec";
|
||||
appDir = "/opt/vault";
|
||||
in
|
||||
pkgs.callPackage inputs.nixsgx-flake.lib.mkSGXContainer {
|
||||
name = container-name;
|
||||
inherit tag;
|
||||
inherit appDir;
|
||||
|
||||
config.Entrypoint = [ "/bin/sh" "-c" ];
|
||||
packages = [
|
||||
teepot.teepot.tee_ratls_preexec
|
||||
vault
|
||||
vat.vault-auth-tee
|
||||
teepot.container-vault-start-config
|
||||
];
|
||||
inherit entrypoint;
|
||||
|
||||
contents = pkgs.buildEnv {
|
||||
name = "image-root";
|
||||
isAzure = true;
|
||||
|
||||
paths = with pkgs.dockerTools; with nixsgx;[
|
||||
bash
|
||||
coreutils
|
||||
teepot.teepot.tee_ratls_preexec
|
||||
vault
|
||||
azure-dcap-client
|
||||
openssl.out
|
||||
curl.out
|
||||
vat.vault-auth-tee
|
||||
gramine
|
||||
restart-aesmd
|
||||
sgx-dcap.quote_verify
|
||||
sgx-psw
|
||||
usrBinEnv
|
||||
binSh
|
||||
caCertificates
|
||||
fakeNss
|
||||
teepot.container-vault-start-config
|
||||
extraPostBuild = ''
|
||||
mkdir -p $out/${appDir}/{data,.cache,tls,plugins}
|
||||
ln -s ${vat.vault-auth-tee}/bin/vault-auth-tee $out/opt/vault/plugins
|
||||
'';
|
||||
|
||||
manifest = {
|
||||
loader = {
|
||||
argv = [
|
||||
entrypoint
|
||||
"--"
|
||||
"${vault}/bin/vault"
|
||||
"server"
|
||||
"-config=/opt/vault/config.hcl"
|
||||
"-log-level=trace"
|
||||
];
|
||||
log_level = "error";
|
||||
env = {
|
||||
VAULT_CLUSTER_ADDR.passthrough = true;
|
||||
VAULT_API_ADDR.passthrough = true;
|
||||
VAULT_RAFT_NODE_ID.passthrough = true;
|
||||
|
||||
DNS_NAMES = "vault-1,vault-2,vault-3";
|
||||
|
||||
# otherwise vault will lock a lot of unused EPC memory
|
||||
VAULT_RAFT_INITIAL_MMAP_SIZE = "0";
|
||||
|
||||
# possible tweak option, if problems with raft
|
||||
# VAULT_RAFT_DISABLE_MAP_POPULATE = "true"
|
||||
};
|
||||
};
|
||||
|
||||
fs.mounts = [
|
||||
{ type = "tmpfs"; path = "/opt/vault/tls"; }
|
||||
{ type = "encrypted"; path = "/opt/vault/.cache"; uri = "file:/opt/vault/.cache"; key_name = "_sgx_mrsigner"; }
|
||||
{ type = "encrypted"; path = "/opt/vault/data"; uri = "file:/opt/vault/data"; key_name = "_sgx_mrsigner"; }
|
||||
];
|
||||
pathsToLink = [ "/bin" "/lib" "/etc" "/opt/vault" ];
|
||||
postBuild = ''
|
||||
mkdir -p $out/var/run
|
||||
mkdir -p $out/${nixsgx.sgx-psw.out}/aesm/
|
||||
mkdir -p $out/opt/vault/data $out/opt/vault/.cache $out/opt/vault/tls
|
||||
ln -s ${curl.out}/lib/libcurl.so $out/${nixsgx.sgx-psw.out}/aesm/
|
||||
ln -s ${nixsgx.azure-dcap-client.out}/lib/libdcap_quoteprov.so $out/${nixsgx.sgx-psw.out}/aesm/libdcap_quoteprov.so.1
|
||||
mkdir -p $out/opt/vault/plugins
|
||||
ln -s ${vat.vault-auth-tee}/bin/vault-auth-tee $out/opt/vault/plugins
|
||||
cp ${manifest} $out/opt/vault/vault.manifest.toml
|
||||
'';
|
||||
|
||||
sgx = {
|
||||
debug = false;
|
||||
edmm_enable = false;
|
||||
enclave_size = "8G";
|
||||
max_threads = 64;
|
||||
nonpie_binary = true;
|
||||
|
||||
trusted_files = [
|
||||
"file:/opt/vault/plugins/"
|
||||
"file:/opt/vault/config.hcl"
|
||||
"file:/opt/vault/cacert.pem"
|
||||
"file:/opt/vault/cakey.pem"
|
||||
];
|
||||
|
||||
};
|
||||
|
||||
sys.stack.size = "1M";
|
||||
# vault needs flock
|
||||
sys.experimental__enable_flock = true;
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -1,39 +0,0 @@
|
|||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIG5AIBAAKCAYEAwDrEJDyGnIGv/xWF4/MQtVEshpft/xGECSdjuHOU87nwCWon
|
||||
hirmOyggPPU772tobmaqRhAMHn0NwvRyFCQcSwTIjd0e/cfwH/QtEd/fp4yaw/z7
|
||||
FZmesTm+wjaobnRfPwrNHAfM8U2EQPXp1yYyjUqPVEXb/7ivdR+u7qnb0o6oNfzA
|
||||
ibRF6H+Fozj5FwepfbQ1DTauTEwdjywD+/21W+Ru5qF7SQVHYwf9OuyD4yZBm9os
|
||||
0Aqnk1nO6ZUSJfrL1gd10LoblnPUjNxwQtWhxIPyeKRYwmVpoaYL45U+6iNOkBiL
|
||||
PyGJDC+lq+AS8YtwzPOt3pUUpFh/XZyxSHla3Q8qPAikjcv1DvTiK+NVEVXoFrbs
|
||||
/uG6Ii9BSRbZ3NQH1bOLtdkW7W6GPGCMr/KuXEvIQaOpDb27/DEtvCh3T/9vrKsO
|
||||
etpTI0an6NZ1oshZ3X2TxZ9nNxh9zMvPswXBdy9O9/WybAN6a1PvIb3v66bxJW6T
|
||||
Pu87/q0DKzeMM20pAgEDAoIBgQCAJy1tfa8TAR//Y66X92B44MhZup6qC61bb5fQ
|
||||
TQ330Uqw8W+ux0QncBV9+NKfnPBJmcbZYAgUU16B+EwNbWgyAzBek2n+hUq/+B4L
|
||||
6pUaXbyCqKdju78g0SnWzxr0TZTUsd4Sr932M62Ao/E6GXcI3F+Ng+f/0HT4v8n0
|
||||
cT03CcV5UysGeC6a/65s0KYPWnD+eCNeJHQy3WkKHVf9U849QvSZwPzbWNpCBVN8
|
||||
na1CGYESkXM1XG+3kTSbuLbD/Ia8KvGsaOeVORvhXr04kD9qW2ioaisSAcXELHY7
|
||||
qFcktM1cYnDJn1/LcCH6tUlnJdGIKWYlbBcmJvhT2FqpULg5IPldNiu9ybh5yQY9
|
||||
HB0pnzg6Ldcb/aunyjdwXgcaPgdkOOpnqRYGq6yrmWk6WsnNMK/QFmgxadbfOU0i
|
||||
xjSrSYVItugHwOrH2eH842jBP2wbe1UJCOrKNytzZ3mBcb0RJbbFYjV0QzdPeVTN
|
||||
Y9ermQTt29tJVrd+Emzo8CK4+gMCgcEA4sXchskGNcoChkDpAqie0W2YLm2XDyPY
|
||||
CoiA+OVLc5lDd995Vqe2kCIC8VMMGIHhxG3NIqxrfxpH5LvqDczphyH6dlWl/O2M
|
||||
CrS/67NjCTm6935ADeR0qndYdMm5XyfYEjl5qESoq4oNq4Pg/0/P1Q/mhN8GQiKb
|
||||
qYAIHE/28dw1tsF6Kl7oqALpBXLQ/iRuFqJmrSPgQ32c5bEQUBD3F7HZq8T7V+O2
|
||||
7/jH8A1A2XddnddIe6fTqboFsghcPAHrAoHBANkBLsdTugDUKDSNa2tUo9ONPU2X
|
||||
gRg+6PDa2ZEzcL961w2laLoKwsrlb8J9GL5Q1LxHx4PGhmwDwvscPzyzXQA7ubnh
|
||||
vPQv1E2SmOSFxkmtWMfz6kcAw/wIlavAFdZPJK0ksnIWzTfi9Y92jdkar9Ny2gSj
|
||||
BoF8XgPbMeuvMV008gjXOETaCk986+gOh4LEyZ2iLYruJsRIH7n/iSDKLsXE4yQd
|
||||
ZuW68IQlJ/2a65DKDCLNgdVFVRfXWhvG++H0OwKBwQCXLpMEhgQj3AGu1fCscGng
|
||||
87rJnmS0wpAHBatQmNz3u4JP6lDkb88KwVdLjLK7AUEtnojByEeqEYVDJ/FeiJuv
|
||||
a/xO48P987KxzdVHzOyw0SdPqYAJQvhxpOWjMSY/b+Vhe6ZwLcXHsV5yV+tU39/j
|
||||
X+8DP1mBbGfGVVq9iqShPXkkgPwcP0XFV0YDoeCpbZ65wZnIwpWCU73udgrgC09l
|
||||
ITvH2KeP7SSf+y/1Xis7pOkT5Nr9Go0b0VkhWugoAUcCgcEAkKt0hOJ8AI1wIwjy
|
||||
R43CjQjTiQ+rZX9F9ec7tiJLKlHks8ObJrHXMe5Kgai7KYs4fYUvrS8ESAKB/L1/
|
||||
fczoqtJ70UEoosqNiQxl7a6EMR47L/fxhKstUrBjx9Vj5DTDHhh29rneJUH5Ck8J
|
||||
O2cf4kyRWGyvAP2UApIhR8og6M32sI962JFcNP3ymrRaVy3bvmweXJ7Egtq/0VUG
|
||||
FdwfLoNCGBOZ7nygWBjFU7ydCzFdbIkBONjjZTo8EoSn6/gnAoHBAJ/XSbhoVzkI
|
||||
CgW7gXSp+qKMhtbR2QawL3006KfQbK/sdcJ0Cyd4IfHXswrFQKV4BrL4tOxay1PT
|
||||
HoQZW5+pLTbZjz3d0tDU9WpSd6FNovoxB6lUA3ymD4ay8Zysy3FflNqOSO6XkwKq
|
||||
0GApQ6pIiDTst+LpnfgvQBDAnJXK3Hik2wDgXThXEofUoMDcGNsQ+NbdackR7/yL
|
||||
8ep5ZLAhczGi4XE471ut48CHtxKq0eGde/lHx0Origk9PPbsNoH2XA==
|
||||
-----END RSA PRIVATE KEY-----
|
||||
|
|
@ -1,77 +0,0 @@
|
|||
libos.entrypoint = "{{ tee_ratls_preexec }}"
|
||||
|
||||
[loader]
|
||||
entrypoint = "file:{{ gramine.libos }}"
|
||||
argv = [
|
||||
"{{ tee_ratls_preexec }}",
|
||||
"--",
|
||||
"{{ vault_exec }}",
|
||||
"server",
|
||||
"-config=/opt/vault/config.hcl",
|
||||
"-log-level=trace",
|
||||
]
|
||||
# set a log level for gramine
|
||||
log_level = "{{ log_level }}"
|
||||
|
||||
[loader.env]
|
||||
LD_LIBRARY_PATH = "/lib"
|
||||
SSL_CERT_FILE = "/etc/ssl/certs/ca-bundle.crt"
|
||||
PATH = "{{ execdir }}"
|
||||
HOME = "/opt/vault"
|
||||
|
||||
VAULT_CLUSTER_ADDR.passthrough = true
|
||||
VAULT_API_ADDR.passthrough = true
|
||||
VAULT_RAFT_NODE_ID.passthrough = true
|
||||
|
||||
DNS_NAMES = "vault-1,vault-2,vault-3"
|
||||
|
||||
# otherwise vault will lock a lot of unused EPC memory
|
||||
VAULT_RAFT_INITIAL_MMAP_SIZE = "0"
|
||||
|
||||
# possible tweak option, if problems with raft
|
||||
# VAULT_RAFT_DISABLE_MAP_POPULATE = "true"
|
||||
|
||||
[fs]
|
||||
root.uri = "file:/"
|
||||
start_dir = "/opt/vault"
|
||||
mounts = [
|
||||
{ path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
|
||||
{ path = "{{ gramine.runtimedir() }}/libdcap_quoteprov.so", uri = "file:/lib/libdcap_quoteprov.so" },
|
||||
{ type = "tmpfs", path = "/var/tmp" },
|
||||
{ type = "tmpfs", path = "/tmp" },
|
||||
{ type = "tmpfs", path = "/opt/vault/tls" },
|
||||
{ type = "tmpfs", path = "/opt/vault/.dcap-qcnl" },
|
||||
{ type = "tmpfs", path = "/opt/vault/.az-dcap-client" },
|
||||
{ type = "encrypted", path = "/opt/vault/.cache", uri = "file:/opt/vault/.cache", key_name = "_sgx_mrsigner" },
|
||||
{ type = "encrypted", path = "/opt/vault/data", uri = "file:/opt/vault/data", key_name = "_sgx_mrsigner" },
|
||||
]
|
||||
|
||||
[sgx]
|
||||
debug = false
|
||||
edmm_enable = false
|
||||
enclave_size = "8G"
|
||||
max_threads = 64
|
||||
nonpie_binary = true
|
||||
remote_attestation = "dcap"
|
||||
|
||||
trusted_files = [
|
||||
"file:/bin/",
|
||||
"file:/etc/gai.conf",
|
||||
"file:/etc/ssl/certs/ca-bundle.crt",
|
||||
"file:/lib/",
|
||||
"file:/nix/",
|
||||
"file:/opt/vault/plugins/",
|
||||
"file:/opt/vault/config.hcl",
|
||||
"file:/opt/vault/cacert.pem",
|
||||
"file:/opt/vault/cakey.pem",
|
||||
"file:{{ gramine.libos }}",
|
||||
"file:{{ gramine.runtimedir() }}/",
|
||||
]
|
||||
|
||||
[sys]
|
||||
stack.size = "1M"
|
||||
enable_extra_runtime_domain_names_conf = true
|
||||
enable_sigterm_injection = true
|
||||
|
||||
# vault needs flock
|
||||
experimental__enable_flock = true
|
||||
Loading…
Add table
Add a link
Reference in a new issue