Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build: create unified libOS+enclave bundle #270

Merged
merged 2 commits into from
Dec 18, 2023
Merged

build: create unified libOS+enclave bundle #270

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a80b2be
build: create unified libOS bundle
mythi Nov 3, 2023
988a80a
shim: pass seal data prepared by enclave-agent to runtime-boot
mythi Oct 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 6 additions & 12 deletions .github/workflows/e2e.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,31 +81,25 @@ jobs:
sed -e 's#\(.*container_instance = "\)\(.*\)$#\1'$PAYLOAD_ARTIFACTS'\2#g' config/config.toml | sudo tee /etc/enclave-cc/config.toml
working-directory: ${{ github.workspace }}/src/github.com/confidential-containers/enclave-cc/src/shim

- name: Build agent-enclave bundle
- name: Build unified bundle
run: |
mkdir $PAYLOAD_ARTIFACTS
docker build . -f tools/packaging/build/agent-enclave-bundle/Dockerfile --build-arg SGX_MODE=${SGX_MODE} --build-arg KBC=${KBC} -t agent-instance:build
docker export $(docker create agent-instance:build) | tee > ${PAYLOAD_ARTIFACTS}/agent-instance.tar
docker build . -f tools/packaging/build/unified-bundle/Dockerfile --build-arg SGX_MODE=${SGX_MODE} --build-arg KBC=${KBC} -t unified-instance:build
docker export $(docker create unified-instance:build) | tee > ${PAYLOAD_ARTIFACTS}/unified-instance.tar
working-directory: ${{ github.workspace }}/src/github.com/confidential-containers/enclave-cc

- name: Install config.json for agent-enclave bundle
run: |
jq -a -f sgx-mode-config.filter config.json.template | tee ${PAYLOAD_ARTIFACTS}/config.json
working-directory: ${{ github.workspace }}/src/github.com/confidential-containers/enclave-cc/tools/packaging/build/agent-enclave-bundle

- name: Build boot-instance bundle
run: |
docker build . -f tools/packaging/build/boot-instance-bundle/Dockerfile --build-arg SGX_MODE=${SGX_MODE} -t boot-instance:build
docker export $(docker create boot-instance:build) | tee > ${PAYLOAD_ARTIFACTS}/boot-instance.tar
working-directory: ${{ github.workspace }}/src/github.com/confidential-containers/enclave-cc
working-directory: ${{ github.workspace }}/src/github.com/confidential-containers/enclave-cc/tools/packaging/build/unified-bundle

- name: Install enclave-cc bundles
run: |
mkdir -p opt/confidential-containers/share/enclave-cc-agent-instance/rootfs
sudo tar -xf agent-instance.tar -C opt/confidential-containers/share/enclave-cc-agent-instance/rootfs
sudo tar -xf unified-instance.tar -C opt/confidential-containers/share/enclave-cc-agent-instance/rootfs
cp config.json opt/confidential-containers/share/enclave-cc-agent-instance/
mkdir -p opt/confidential-containers/share/enclave-cc-boot-instance/rootfs
sudo tar -xf boot-instance.tar -C opt/confidential-containers/share/enclave-cc-boot-instance/rootfs
sudo tar -xf unified-instance.tar -C opt/confidential-containers/share/enclave-cc-boot-instance/rootfs
working-directory: ${{env.PAYLOAD_ARTIFACTS}}

- name: Install decrypt_config.conf and ocicrypt.conf for agent-enclave bundle
Expand Down
10 changes: 9 additions & 1 deletion src/runtime-boot/init/src/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ extern crate serde_json;

use libc::syscall;

use std::env;
use std::error::Error;
use std::fs::File;
use std::io::prelude::*;
Expand Down Expand Up @@ -59,7 +60,14 @@ fn main() -> Result<(), Box<dyn Error>> {
envp: envp.as_ptr(),
};

let ret = unsafe { syscall(SYS_MOUNT_FS, key_ptr, &rootfs_config) };
let agent_boot = matches!(env::var("ENCLAVE_AGENT"), Ok(val) if val == "true" || val == "TRUE" || val == "1");
let ret = match agent_boot {
true => {
let root_config_ptr: *const i8 = std::ptr::null();
unsafe { syscall(SYS_MOUNT_FS, root_config_ptr) }
}
false => unsafe { syscall(SYS_MOUNT_FS, key_ptr, &rootfs_config) },
};
if ret < 0 {
return Err(Box::new(std::io::Error::last_os_error()));
}
Expand Down
10 changes: 5 additions & 5 deletions src/shim/runtime/v2/rune/v2/agent.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,11 +162,11 @@ func (c *agent) PullImage(ctx context.Context, req *image.PullImageReq) (*image.
}

// Create dir for store unionfs image (based on sefs)
sefsDir := filepath.Join(c.Bundle, "rootfs/images/", cid, "sefs")
lowerDir := filepath.Join(sefsDir, "lower")
upperDir := filepath.Join(sefsDir, "upper")
for _, dir := range []string{lowerDir, upperDir} {
if err := os.MkdirAll(dir, defaultDirPerm); err != nil {
for _, dir := range []string{"upper", "lower"} {
if err := os.MkdirAll(filepath.Join(c.Bundle, "rootfs", "images", cid, "sefs", dir), defaultDirPerm); err != nil {
return nil, err
}
if err := os.MkdirAll(filepath.Join(c.Bundle, "rootfs", "images", cid, "keys", "sefs", dir), defaultDirPerm); err != nil {
return nil, err
}
}
Expand Down
4 changes: 2 additions & 2 deletions test/e2e/hello-world-encrypted-HW-cc-kbc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,10 @@
{"key": "OCCLUM_RELEASE_ENCLAVE", "value": "1"}
],
"command": [
"/run/rune/boot_instance/build/bin/occlum-run",
"/run/rune/occlum_instance/build/bin/occlum-run",
"/bin/hello_world"
],
"working_dir": "/run/rune/boot_instance/",
"working_dir": "/run/rune/occlum_instance/",
"log_path":"hello.log",
"devices": [
{"container_path": "/dev/sgx_enclave", "host_path": "/dev/sgx_enclave", "permissions": "rw"}
Expand Down
4 changes: 2 additions & 2 deletions test/e2e/hello-world-encrypted-SIM-sample-kbc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,10 @@
{"key": "OCCLUM_RELEASE_ENCLAVE", "value": "0"}
],
"command": [
"/run/rune/boot_instance/build/bin/occlum-run",
"/run/rune/occlum_instance/build/bin/occlum-run",
"/bin/hello_world"
],
"working_dir": "/run/rune/boot_instance/",
"working_dir": "/run/rune/occlum_instance/",
"log_path":"hello.log",
"linux": {
}
Expand Down
4 changes: 2 additions & 2 deletions test/e2e/hello-world-unencrypted-SIM.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,10 @@
{"key": "OCCLUM_RELEASE_ENCLAVE", "value": "0"}
],
"command": [
"/run/rune/boot_instance/build/bin/occlum-run",
"/run/rune/occlum_instance/build/bin/occlum-run",
"/bin/hello_world"
],
"working_dir": "/run/rune/boot_instance/",
"working_dir": "/run/rune/occlum_instance/",
"log_path":"hello.log",
"linux": {
}
Expand Down
81 changes: 0 additions & 81 deletions tools/packaging/build/agent-enclave-bundle/Dockerfile
View file
Open in desktop

This file was deleted.

74 changes: 0 additions & 74 deletions tools/packaging/build/boot-instance-bundle/Dockerfile
View file
Open in desktop

This file was deleted.

4 changes: 0 additions & 4 deletions tools/packaging/build/boot-instance-bundle/jq.filter
View file
Open in desktop

This file was deleted.

12 changes: 4 additions & 8 deletions tools/packaging/build/build_payload.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,16 +22,12 @@ export PAYLOAD_ARTIFACTS="${SCRIPT_ROOT}/payload_artifacts"
mkdir -p ${PAYLOAD_ARTIFACTS}

# build pre-installed OCI bundle for agent enclave container
pushd ${SCRIPT_ROOT}/agent-enclave-bundle
docker build ${ENCLAVE_CC_ROOT} -f ${SCRIPT_ROOT}/agent-enclave-bundle/Dockerfile --build-arg SGX_MODE=${SGX_MODE} --build-arg KBC=${KBC} -t agent-instance
pushd ${SCRIPT_ROOT}/unified-bundle
docker build ${ENCLAVE_CC_ROOT} -f ${SCRIPT_ROOT}/unified-bundle/Dockerfile --build-arg SGX_MODE=${SGX_MODE} --build-arg KBC=${KBC} -t unified-instance
jq -a -f sgx-mode-config.filter config.json.template | tee ${PAYLOAD_ARTIFACTS}/config.json
docker export $(docker create agent-instance) | tee > ${PAYLOAD_ARTIFACTS}/agent-instance.tar
docker export $(docker create unified-instance) | tee > ${PAYLOAD_ARTIFACTS}/unified-instance.tar
mythi marked this conversation as resolved.
Show resolved Hide resolved
popd

# build pre-installed OCI bundle for boot instance
docker build ${ENCLAVE_CC_ROOT} -f ${SCRIPT_ROOT}/boot-instance-bundle/Dockerfile --build-arg SGX_MODE=${SGX_MODE} -t boot-instance
docker export $(docker create boot-instance) | tee > ${PAYLOAD_ARTIFACTS}/boot-instance.tar

# build shim-rune binary: "containerd-shim-rune-v2"
pushd ${ENCLAVE_CC_ROOT}/src/shim
docker run --pull always -t -v ${PWD}:/build --workdir /build golang:${GO_VERSION}-bookworm make binaries
Expand All @@ -55,5 +51,5 @@ fi
popd

#cleanup
docker rmi ${IMAGE} boot-instance agent-instance -f
docker rmi ${IMAGE} unified-instance -f
rm -rf payload_artifacts
Loading
Loading