Skip to content

Commit 94cae0a

Browse files
kvinwangkvinwang
authored
Merge pull request #22 from Leechael/main
Default Pre-launch script of Phala Cloud
2 parents ccc6727 + 00572ea commit 94cae0a

File tree

2 files changed

+181
-0
lines changed

2 files changed

+181
-0
lines changed

‎phala-cloud-prelaunch-script/README.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Default Pre-launch script of Phala Cloud
2+
3+
## Overview
4+
5+
This pre-launch script for Phala Cloud handles:
6+
7+
- Pull private images from Docker Hub
8+
- Pull private images from AWS ECR
9+
- Remove unused images and containers from local disk
10+
- Expose App ID via `DSTACK_APP_ID` environment variable
11+
12+
## Private registry support
13+
14+
### Docker Hub Authentication
15+
16+
Set these encrypted environment variables:
17+
18+
- `DSTACK_DOCKER_USERNAME` - Your Docker Hub username
19+
- `DSTACK_DOCKER_PASSWORD` - Your Docker Hub password or access token
20+
21+
### AWS ECR Authentication
22+
23+
Set these encrypted environment variables:
24+
25+
- `DSTACK_AWS_ACCESS_KEY_ID` - Your AWS access key ID
26+
- `DSTACK_AWS_SECRET_ACCESS_KEY` - Your AWS secret access key
27+
- `DSTACK_AWS_REGION` - AWS region for your ECR repository
28+
- `DSTACK_AWS_ECR_REGISTRY` - Your AWS ECR registry URL
29+
- `DSTACK_AWS_SESSION_TOKEN` - Only needed for temporary AWS credentials

‎phala-cloud-prelaunch-script/prelaunch.sh‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
#!/bin/bash
2+
echo "----------------------------------------------"
3+
echo "Running Phala Cloud Pre-Launch Script v0.0.5"
4+
echo "----------------------------------------------"
5+
set -e
6+
7+
# Function: notify host
8+
9+
notify_host() {
10+
if command -v dstack-util >/dev/null 2>&1; then
11+
dstack-util notify-host -e "$1" -d "$2"
12+
else
13+
tdxctl notify-host -e "$1" -d "$2"
14+
fi
15+
}
16+
17+
notify_host_hoot_info() {
18+
notify_host "boot.progress" "$1"
19+
}
20+
21+
notify_host_hoot_error() {
22+
notify_host "boot.error" "$1"
23+
}
24+
25+
# Function: Perform Docker cleanup
26+
perform_cleanup() {
27+
echo "Pruning unused images"
28+
docker image prune -af
29+
echo "Pruning unused volumes"
30+
docker volume prune -f
31+
notify_host_hoot_info "docker cleanup completed"
32+
}
33+
34+
# Function: Check Docker login status without exposing credentials
35+
check_docker_login() {
36+
# Try to verify login status without exposing credentials
37+
if docker info 2>/dev/null | grep -q "Username"; then
38+
return 0
39+
else
40+
return 1
41+
fi
42+
}
43+
44+
# Main logic starts here
45+
echo "Starting login process..."
46+
47+
# Check if Docker credentials exist
48+
if [[ -n "$DSTACK_DOCKER_USERNAME" && -n "$DSTACK_DOCKER_PASSWORD" ]]; then
49+
echo "Docker credentials found"
50+
51+
# Check if already logged in
52+
if check_docker_login; then
53+
echo "Already logged in to Docker registry"
54+
else
55+
echo "Logging in to Docker registry..."
56+
# Login without exposing password in process list
57+
if [[ -n "$DSTACK_DOCKER_REGISTRY" ]]; then
58+
echo "$DSTACK_DOCKER_PASSWORD" | docker login -u "$DSTACK_DOCKER_USERNAME" --password-stdin "$DSTACK_DOCKER_REGISTRY"
59+
else
60+
echo "$DSTACK_DOCKER_PASSWORD" | docker login -u "$DSTACK_DOCKER_USERNAME" --password-stdin
61+
fi
62+
63+
if [ $? -eq 0 ]; then
64+
echo "Docker login successful"
65+
else
66+
echo "Docker login failed"
67+
notify_host_hoot_error "docker login failed"
68+
exit 1
69+
fi
70+
fi
71+
# Check if AWS ECR credentials exist
72+
elif [[ -n "$DSTACK_AWS_ACCESS_KEY_ID" && -n "$DSTACK_AWS_SECRET_ACCESS_KEY" && -n "$DSTACK_AWS_REGION" && -n "$DSTACK_AWS_ECR_REGISTRY" ]]; then
73+
echo "AWS ECR credentials found"
74+
75+
# Check if AWS CLI is installed
76+
if ! command -v aws &> /dev/null; then
77+
notify_host_hoot_info "awscli not installed, installing..."
78+
echo "AWS CLI not installed, installing..."
79+
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-2.24.14.zip" -o "awscliv2.zip"
80+
echo "6ff031a26df7daebbfa3ccddc9af1450 awscliv2.zip" | md5sum -c
81+
if [ $? -ne 0 ]; then
82+
echo "MD5 checksum failed"
83+
notify_host_hoot_error "awscli install failed"
84+
exit 1
85+
fi
86+
unzip awscliv2.zip &> /dev/null
87+
./aws/install
88+
89+
# Clean up installation files
90+
rm -rf awscliv2.zip aws
91+
else
92+
echo "AWS CLI is already installed: $(which aws)"
93+
fi
94+
95+
# Set AWS credentials as environment variables
96+
export AWS_ACCESS_KEY_ID="$DSTACK_AWS_ACCESS_KEY_ID"
97+
export AWS_SECRET_ACCESS_KEY="$DSTACK_AWS_SECRET_ACCESS_KEY"
98+
export AWS_DEFAULT_REGION="$DSTACK_AWS_REGION"
99+
100+
# Set session token if provided (for temporary credentials)
101+
if [[ -n "$DSTACK_AWS_SESSION_TOKEN" ]]; then
102+
echo "AWS session token found, using temporary credentials"
103+
export AWS_SESSION_TOKEN="$DSTACK_AWS_SESSION_TOKEN"
104+
fi
105+
106+
# Test AWS credentials before attempting ECR login
107+
echo "Testing AWS credentials..."
108+
if ! aws sts get-caller-identity &> /dev/null; then
109+
echo "AWS credentials test failed"
110+
notify_host_hoot_error "Invalid AWS credentials"
111+
exit 1
112+
fi
113+
114+
echo "Logging in to AWS ECR..."
115+
aws ecr get-login-password --region $DSTACK_AWS_REGION | docker login --username AWS --password-stdin "$DSTACK_AWS_ECR_REGISTRY"
116+
if [ $? -eq 0 ]; then
117+
echo "AWS ECR login successful"
118+
notify_host_hoot_info "AWS ECR login successful"
119+
else
120+
echo "AWS ECR login failed"
121+
notify_host_hoot_error "AWS ECR login failed"
122+
exit 1
123+
fi
124+
fi
125+
126+
perform_cleanup
127+
128+
#
129+
# Set root password if DSTACK_ROOT_PASSWORD is set.
130+
#
131+
if [[ -n "$DSTACK_ROOT_PASSWORD" ]]; then
132+
echo "root:$DSTACK_ROOT_PASSWORD" | chpasswd
133+
unset $DSTACK_ROOT_PASSWORD
134+
echo "Root password set"
135+
fi
136+
if [[ -n "$DSTACK_ROOT_PUBLIC_KEY" ]]; then
137+
mkdir -p /root/.ssh
138+
echo "$DSTACK_ROOT_PUBLIC_KEY" > /root/.ssh/authorized_keys
139+
unset $DSTACK_ROOT_PUBLIC_KEY
140+
echo "Root public key set"
141+
fi
142+
143+
144+
if [[ -e /var/run/dstack.sock ]]; then
145+
export DSTACK_APP_ID=$(curl -s --unix-socket /var/run/dstack.sock http://dstack/Info | jq -j .app_id)
146+
else
147+
export DSTACK_APP_ID=$(curl -s --unix-socket /var/run/tappd.sock http://dstack/prpc/Tappd.Info | jq -j .app_id)
148+
fi
149+
150+
echo "----------------------------------------------"
151+
echo "Script execution completed"
152+
echo "----------------------------------------------"

0 commit comments

Comments
 (0)