forked from occlum/occlum
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Dockerfile.centos8.2
182 lines (162 loc) · 5.53 KB
/
Dockerfile.centos8.2
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
FROM alpine:3.11 AS alpine
LABEL maintainer="Qing Li <[email protected]>"
RUN apk update && \
apk --no-cache add openjdk11 openjdk8 --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community
FROM centos:8
LABEL maintainer="He Sun <[email protected]>"
#The default shell for the RUN instruction is ["/bin/sh", "-c"], which sometimes cause unexpected error
#for example "source a_file". Use bash as default shell instead.
SHELL ["/bin/bash", "-c"]
# since cmake is updated to 3.18.2-9.el8, it must work with libarchive.
RUN yum install epel-release -y && \
dnf clean all && rm -r /var/cache/dnf && \
dnf group install 'Development Tools' -y && \
dnf -y install dnf-plugins-core && \
dnf -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm && \
dnf config-manager --set-enabled powertools && \
dnf install -y \
astyle \
bison \
boost-devel \
clang \
cmake \
createrepo \
curl-devel \
expect \
fuse-devel \
fuse-libs \
gawk \
gmp-devel \
golang \
jq \
libarchive \
libcurl-devel \
libmpc-devel \
libxml2-devel \
mod_ssl \
mpfr-devel \
nano \
ocaml \
ocaml-ocamlbuild \
openssl \
openssl-devel \
perl \
protobuf-devel \
python2 \
python3 \
sudo \
wget \
uuid-devel \
vim \
yum-utils \
rsync \
http://downloads.sourceforge.net/ltp/lcov-1.14-1.noarch.rpm &&\
alternatives --set python /usr/bin/python2
# Install cpuid tool for tests
WORKDIR /tmp
RUN wget http://www.etallen.com/cpuid/cpuid-20200211.x86_64.tar.gz && \
tar -xf ./cpuid-20200211.x86_64.tar.gz && \
cp ./cpuid-20200211/cpuid /usr/bin/ && \
rm -rf /tmp/cpuid-20200211*
# Install Rust
ENV PATH="/root/.cargo/bin:$PATH"
ENV OCCLUM_RUST_VERSION=nightly-2021-09-13
RUN curl https://sh.rustup.rs -sSf | \
sh -s -- --default-toolchain ${OCCLUM_RUST_VERSION} -y && \
rm -rf /root/.cargo/registry && rm -rf /root/.cargo/git && \
cargo -V
# Install SGX PSW
WORKDIR /tmp
RUN echo "ca_directory=/etc/ssl/certs" >> /etc/wgetrc && \
wget https://download.01.org/intel-sgx/sgx-linux/2.15.1/distro/centos8.2-server/sgx_rpm_local_repo.tgz && \
tar -xvf sgx_rpm_local_repo.tgz && \
rm sgx_rpm_local_repo.tgz && \
cd /tmp/sgx_rpm_local_repo && \
rpm -ivh libsgx-ae-pce*.rpm \
libsgx-headers*.rpm \
libsgx-ae-qe3*.rpm \
libsgx-ae-qve*.rpm \
libsgx-enclave-common*.rpm \
libsgx-quote-ex*.rpm \
libsgx-urts*.rpm \
libsgx-dcap-ql*.rpm \
libsgx-qe3-logic*.rpm \
libsgx-pce-logic*.rpm \
libsgx-dcap-quote-verify*.rpm \
libsgx-dcap-ql*.rpm \
libsgx-dcap-ql-dev*.rpm \
libsgx-dcap-default-qpl*.rpm \
libsgx-dcap-default-qpl-dev*.rpm \
libsgx-dcap-quote-verify-dev*.rpm \
libsgx-uae-service*.rpm \
libsgx-epid*.rpm \
libsgx-launch*.rpm \
libsgx-ae-le-*.rpm \
libsgx-aesm-launch-plugin-*.rpm \
sgx-aesm-service*.rpm && \
rm -rf /tmp/sgx_rpm_local_repo
# Install SGX SDK
WORKDIR /tmp
RUN git clone -b sgx_2.15.1_for_occlum https://github.com/occlum/linux-sgx && \
cd linux-sgx && \
make preparation && \
./compile_and_install.sh no_mitigation USE_OPT_LIBS=3 && \
echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \
rm -rf /tmp/linux-sgx
# Download the Occlum source
ARG OCCLUM_BRANCH
WORKDIR /root
RUN git clone -b $OCCLUM_BRANCH https://github.com/occlum/occlum && \
cp -r /root/occlum/tools/toolchains/* /tmp/ && mkdir -p /opt/occlum/ && \
cp /root/occlum/tools/docker/start_aesm.sh /opt/occlum/
# Install Occlum toolchain
WORKDIR /tmp
RUN cd musl-gcc && ./build.sh && ./install_zlib.sh && rm -rf /tmp/musl-gcc
ENV PATH="/opt/occlum/build/bin:/usr/local/occlum/bin:$PATH"
# Install glibc
WORKDIR /tmp
RUN cd glibc && ./build.sh && rm -rf /tmp/glibc
# Install Occlum Golang toolchain
WORKDIR /tmp
RUN cd golang && ./build.sh && rm -rf /tmp/golang
ENV PATH="/opt/occlum/toolchains/golang/bin:$PATH"
# Install Occlum Rust toolchain
WORKDIR /tmp
RUN cd rust && ./build.sh && rm -rf /tmp/rust
ENV PATH="/opt/occlum/toolchains/rust/bin:$PATH"
ENV LD_LIBRARY_PATH="/opt/intel/sgxsdk/sdk_libs"
# Install Occlum bash
WORKDIR /tmp
RUN cd bash && ./build.sh && rm -rf /tmp/bash
# Install Occlum busybox
WORKDIR /tmp
RUN cd busybox && ./build.sh && rm -rf /tmp/busybox
# Install Occlum Java toolchain (JDK 11)
ARG JDK11_PATH=/opt/occlum/toolchains/jvm/java-11-openjdk
COPY --from=alpine /usr/lib/jvm/java-11-openjdk $JDK11_PATH
RUN rm $JDK11_PATH/lib/security/cacerts
COPY --from=alpine /etc/ssl/certs/java/cacerts $JDK11_PATH/lib/security/cacerts
WORKDIR /tmp
RUN cd java && ./install_dragonwell.sh && rm -rf /tmp/java
ENV PATH="/opt/occlum/toolchains/jvm/bin:$PATH"
# Install OpenJDK 8
ARG JDK8_PATH=/opt/occlum/toolchains/jvm/java-1.8-openjdk
COPY --from=alpine /usr/lib/jvm/java-1.8-openjdk $JDK8_PATH
RUN rm $JDK8_PATH/jre/lib/security/cacerts
COPY --from=alpine /etc/ssl/certs/java/cacerts $JDK8_PATH/jre/lib/security/cacerts
# Build and install Occlum
WORKDIR /root
RUN cd occlum && \
source /opt/intel/sgxsdk/environment && \
make submodule && \
OCCLUM_RELEASE_BUILD=1 make && \
make install && \
cp -r demos /root/demos && \
rm -rf /root/occlum
# Start AESM service automatically
#
# To do so, we add the script to ~/.bashrc. We cannot use systemd to run AESM
# as a "real" service since the pid 1 is not systemd in Docker. So we start
# up AESM service when an user login with an interative shell.
RUN mkdir -p /var/run/aesmd && echo '/opt/occlum/start_aesm.sh' >> /root/.bashrc
WORKDIR /root