This repository has been archived by the owner on Apr 5, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 17
/
Dockerfile
70 lines (64 loc) · 2.73 KB
/
Dockerfile
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
FROM ghcr.io/edgelesssys/edgelessdb/build-base:v0.3.2 AS build
# don't run `apt-get update` because required packages are cached in build-base for reproducibility
RUN DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
bbe \
bison \
build-essential \
ca-certificates \
clang-10 \
cmake \
git \
liblz4-dev \
libncurses-dev \
libssl-dev \
ninja-build \
zlib1g-dev
ARG erttag=v0.3.6
ARG edbtag=v0.3.2
RUN git clone -b $erttag --depth=1 https://github.com/edgelesssys/edgelessrt \
&& git clone -b $edbtag --depth=1 https://github.com/edgelesssys/edgelessdb \
&& mkdir ertbuild edbbuild
# install ert
RUN cd edgelessrt && export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct) && cd /ertbuild \
&& cmake -GNinja -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTS=OFF /edgelessrt \
&& ninja install
# build edb
RUN cd edgelessdb && export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct) && cd /edbbuild \
&& . /opt/edgelessrt/share/openenclave/openenclaverc \
&& cmake -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTS=OFF /edgelessdb \
&& make -j`nproc` edb-enclave
# sign edb
ARG heapsize=1024
ARG numtcs=64
ARG production=OFF
RUN --mount=type=secret,id=signingkey,dst=/edbbuild/private.pem,required=true \
cd edbbuild \
&& . /opt/edgelessrt/share/openenclave/openenclaverc \
&& cmake -DHEAPSIZE=$heapsize -DNUMTCS=$numtcs -DPRODUCTION=$production /edgelessdb \
&& make sign-edb \
&& cat edgelessdb-sgx.json
# deploy
FROM ubuntu:focal-20221019
ARG PSW_VERSION=2.18.100.3-focal1
ARG DCAP_VERSION=1.15.100.3-focal1
RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates gnupg libcurl4 wget \
&& wget -qO- https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | apt-key add \
&& echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu focal main' >> /etc/apt/sources.list \
&& wget -qO- https://packages.microsoft.com/keys/microsoft.asc | apt-key add \
&& echo 'deb [arch=amd64] https://packages.microsoft.com/ubuntu/20.04/prod focal main' >> /etc/apt/sources.list \
&& apt-get update && apt-get install -y --no-install-recommends \
libsgx-ae-id-enclave=$DCAP_VERSION \
libsgx-ae-pce=$PSW_VERSION \
libsgx-ae-qe3=$DCAP_VERSION \
libsgx-dcap-ql=$DCAP_VERSION \
libsgx-enclave-common=$PSW_VERSION \
libsgx-launch=$PSW_VERSION \
libsgx-pce-logic=$DCAP_VERSION \
libsgx-qe3-logic=$DCAP_VERSION \
libsgx-urts=$PSW_VERSION \
&& apt-get install -d az-dcap-client libsgx-dcap-default-qpl=$DCAP_VERSION
COPY --from=build /edbbuild/edb /edbbuild/edb-enclave.signed /edbbuild/edgelessdb-sgx.json /edgelessdb/src/entry.sh /
COPY --from=build /opt/edgelessrt/bin/erthost /opt/edgelessrt/bin/
ENV PATH=${PATH}:/opt/edgelessrt/bin
ENTRYPOINT ["/entry.sh"]
EXPOSE 3306 8080