forked from occlum/occlum
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Dockerfile.centos8.2
167 lines (151 loc) · 5.13 KB
/
Dockerfile.centos8.2
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
FROM alpine:3.11 AS alpine
LABEL maintainer="Qing Li <geding.lq@antgroup.com>"
RUN apk update && \
apk --no-cache add openjdk11 --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community
FROM centos:8.2.2004
LABEL maintainer="He Sun <bochang.sh@antgroup.com>"
#The default shell for the RUN instruction is ["/bin/sh", "-c"], which sometimes cause unexpected error
#for example "source a_file". Use bash as default shell instead.
SHELL ["/bin/bash", "-c"]
# since cmake is updated to 3.18.2-9.el8, it must work with libarchive.
RUN yum install epel-release -y && \
dnf clean all && rm -r /var/cache/dnf && \
dnf group install 'Development Tools' -y && \
dnf --enablerepo=PowerTools install -y \
astyle \
bison \
boost-devel \
cmake \
createrepo \
curl-devel \
expect \
fuse-devel \
fuse-libs \
gawk \
gmp-devel \
golang \
jq \
libarchive \
libcurl-devel \
libmpc-devel \
libxml2-devel \
mod_ssl \
mpfr-devel \
nano \
ocaml \
ocaml-ocamlbuild \
openssl \
openssl-devel \
perl \
protobuf-devel \
python2 \
python3 \
sudo \
wget \
uuid-devel \
vim \
yum-utils \
http://downloads.sourceforge.net/ltp/lcov-1.14-1.noarch.rpm &&\
alternatives --set python /usr/bin/python2
# Install cpuid tool for tests
WORKDIR /tmp
RUN wget http://www.etallen.com/cpuid/cpuid-20200211.x86_64.tar.gz && \
tar -xf ./cpuid-20200211.x86_64.tar.gz && \
cp ./cpuid-20200211/cpuid /usr/bin/ && \
rm -rf /tmp/cpuid-20200211*
# Install Rust
ENV PATH="/root/.cargo/bin:$PATH"
ENV OCCLUM_RUST_VERSION=nightly-2020-10-25
RUN curl https://sh.rustup.rs -sSf | \
sh -s -- --default-toolchain ${OCCLUM_RUST_VERSION} -y && \
rm -rf /root/.cargo/registry && rm -rf /root/.cargo/git && \
cargo -V
# Install Occlum toolchain
COPY toolchains/musl-gcc /tmp/musl-gcc
WORKDIR /tmp
RUN cd musl-gcc && ./build.sh && ./install_zlib.sh && rm -rf /tmp/musl-gcc
ENV PATH="/opt/occlum/build/bin:/usr/local/occlum/bin:$PATH"
# Install glibc
COPY toolchains/glibc /tmp/glibc
WORKDIR /tmp
RUN cd glibc && ./build.sh && rm -rf /tmp/glibc
# Install Occlum Golang toolchain
COPY toolchains/golang /tmp/golang
WORKDIR /tmp
RUN cd golang && ./build.sh && rm -rf /tmp/golang
ENV PATH="/opt/occlum/toolchains/golang/bin:$PATH"
# Install Occlum Rust toolchain
COPY toolchains/rust /tmp/rust
WORKDIR /tmp
RUN cd rust && ./build.sh && rm -rf /tmp/rust
ENV PATH="/opt/occlum/toolchains/rust/bin:$PATH"
ENV LD_LIBRARY_PATH="/opt/intel/sgxsdk/sdk_libs"
# Install Occlum Java toolchain (JDK 11)
ARG JDK11_PATH=/opt/occlum/toolchains/jvm/java-11-openjdk
COPY --from=alpine /usr/lib/jvm/java-11-openjdk $JDK11_PATH
RUN rm $JDK11_PATH/lib/security/cacerts
COPY --from=alpine /etc/ssl/certs/java/cacerts $JDK11_PATH/lib/security/cacerts
COPY toolchains/java /tmp/java
WORKDIR /tmp
RUN cd java && ./install_dragonwell.sh && rm -rf /tmp/java
ENV PATH="/opt/occlum/toolchains/jvm/bin:$PATH"
# Install SGX PSW
WORKDIR /tmp
RUN echo "ca_directory=/etc/ssl/certs" >> /etc/wgetrc && \
wget https://download.01.org/intel-sgx/sgx-linux/2.13.3/distro/centos8.2-server/sgx_rpm_local_repo.tgz && \
tar -xvf sgx_rpm_local_repo.tgz && \
rm sgx_rpm_local_repo.tgz && \
wget https://download.01.org/intel-sgx/sgx-dcap/1.10.3/linux/distro/centos8.2-server/sgx_rpm_local_repo.tgz && \
tar -xvf sgx_rpm_local_repo.tgz && \
rm sgx_rpm_local_repo.tgz && \
cd /tmp/sgx_rpm_local_repo && \
rpm -ivh libsgx-ae-pce*.rpm \
libsgx-headers*.rpm \
libsgx-ae-qe3*.rpm \
libsgx-ae-qve*.rpm \
libsgx-enclave-common*.rpm \
libsgx-quote-ex*.rpm \
libsgx-urts*.rpm \
libsgx-dcap-ql*.rpm \
libsgx-qe3-logic*.rpm \
libsgx-pce-logic*.rpm \
libsgx-dcap-quote-verify*.rpm \
libsgx-dcap-ql*.rpm \
libsgx-dcap-ql-dev*.rpm \
libsgx-dcap-default-qpl*.rpm \
libsgx-dcap-default-qpl-dev*.rpm \
libsgx-dcap-quote-verify-dev*.rpm \
libsgx-uae-service*.rpm \
libsgx-epid*.rpm \
libsgx-launch*.rpm \
libsgx-ae-le-*.rpm \
libsgx-aesm-launch-plugin-*.rpm \
sgx-aesm-service*.rpm && \
rm -rf /tmp/sgx_rpm_local_repo
# Install SGX SDK
WORKDIR /tmp
RUN git clone -b sgx_2.13.3_for_occlum https://github.com/occlum/linux-sgx && \
cd linux-sgx && \
make preparation && \
./compile_and_install.sh no_mitigation USE_OPT_LIBS=2 && \
echo 'source /opt/intel/sgxsdk/environment' >> /root/.bashrc && \
rm -rf /tmp/linux-sgx
# Install the latest version of Occlum
ARG OCCLUM_BRANCH
WORKDIR /root
RUN git clone -b $OCCLUM_BRANCH https://github.com/occlum/occlum && \
cd occlum && \
source /root/.bashrc && \
make submodule && \
OCCLUM_RELEASE_BUILD=1 make && \
make install && \
cp -r demos /root/demos && \
rm -rf /root/occlum
# Start AESM service automatically
#
# To do so, we add the script to ~/.bashrc. We cannot use systemd to run AESM
# as a "real" service since the pid 1 is not systemd in Docker. So we start
# up AESM service when an user login with an interative shell.
COPY docker/start_aesm.sh /opt/occlum/
RUN mkdir -p /var/run/aesmd && echo '/opt/occlum/start_aesm.sh' >> /root/.bashrc
WORKDIR /root