Skip to content

Commit 51b8a44

Browse files
kvinwangkvinwang
authored
Merge pull request #255 from Dstack-TEE/kms-gw-action
Add Actions for gateway/kms release
2 parents 9077b89 + 2344fc1 commit 51b8a44

File tree

12 files changed

+959
-16
lines changed

12 files changed

+959
-16
lines changed

‎.github/workflows/gateway-release.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Gateway Release
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
tags:
7+
- 'gateway-v*'
8+
permissions:
9+
attestations: write
10+
id-token: write
11+
contents: write
12+
packages: write
13+
14+
jobs:
15+
build-and-release:
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout repository
19+
uses: actions/checkout@v4
20+
21+
- name: Parse version from tag
22+
run: |
23+
# Extract version from tag (e.g., gateway-v1.2.3 -> 1.2.3)
24+
VERSION=${GITHUB_REF#refs/tags/gateway-v}
25+
echo "VERSION=$VERSION" >> $GITHUB_ENV
26+
echo "Parsed version: $VERSION"
27+
28+
- name: Log in to Docker Hub
29+
uses: docker/login-action@v3
30+
with:
31+
username: ${{ vars.DOCKERHUB_USERNAME }}
32+
password: ${{ secrets.DOCKERHUB_TOKEN }}
33+
34+
- name: Set up Docker Buildx
35+
uses: docker/setup-buildx-action@v3
36+
37+
- name: Get Git commit timestamps
38+
run: |
39+
echo "TIMESTAMP=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
40+
echo "GIT_REV=$(git rev-parse HEAD)" >> $GITHUB_ENV
41+
42+
- name: Build and push Docker image
43+
id: build-and-push
44+
uses: docker/build-push-action@v5
45+
env:
46+
SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
47+
with:
48+
context: gateway/dstack-app/builder
49+
push: true
50+
tags: ${{ vars.DOCKERHUB_USERNAME }}/gateway:${{ env.VERSION }}
51+
platforms: linux/amd64
52+
provenance: false
53+
build-args: |
54+
DSTACK_REV=${{ env.GIT_REV }}
55+
SOURCE_DATE_EPOCH=${{ env.TIMESTAMP }}
56+
57+
- name: Generate artifact attestation
58+
uses: actions/attest-build-provenance@v1
59+
with:
60+
subject-name: "docker.io/${{ vars.DOCKERHUB_USERNAME }}/gateway"
61+
subject-digest: ${{ steps.build-and-push.outputs.digest }}
62+
push-to-registry: true
63+
64+
- name: GitHub Release
65+
uses: softprops/action-gh-release@v1
66+
with:
67+
name: "Gateway Release v${{ env.VERSION }}"
68+
body: |
69+
## Docker Image Information
70+
71+
**Image**: `docker.io/${{ vars.DOCKERHUB_USERNAME }}/gateway:${{ env.VERSION }}`
72+
73+
**Digest (SHA256)**: `${{ steps.build-and-push.outputs.digest }}`
74+
75+
**Verification**: [Verify on Sigstore](https://search.sigstore.dev/?hash=${{ steps.build-and-push.outputs.digest }})

‎.github/workflows/kms-release.yml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
name: KMS Release
2+
3+
on:
4+
workflow_dispatch:
5+
push:
6+
tags:
7+
- 'kms-v*'
8+
permissions:
9+
attestations: write
10+
id-token: write
11+
contents: write
12+
packages: write
13+
14+
jobs:
15+
build-and-release:
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout repository
19+
uses: actions/checkout@v4
20+
21+
- name: Parse version from tag
22+
run: |
23+
# Extract version from tag (e.g., kms-v1.2.3 -> 1.2.3)
24+
VERSION=${GITHUB_REF#refs/tags/kms-v}
25+
echo "VERSION=$VERSION" >> $GITHUB_ENV
26+
echo "Parsed version: $VERSION"
27+
28+
- name: Log in to Docker Hub
29+
uses: docker/login-action@v3
30+
with:
31+
username: ${{ vars.DOCKERHUB_USERNAME }}
32+
password: ${{ secrets.DOCKERHUB_TOKEN }}
33+
34+
- name: Set up Docker Buildx
35+
uses: docker/setup-buildx-action@v3
36+
37+
- name: Write GIT_REV
38+
run: git rev-parse HEAD > kms/dstack-app/builder/.GIT_REV
39+
40+
- name: Get Git commit timestamps
41+
run: |
42+
echo "TIMESTAMP=$(git log -1 --pretty=%ct)" >> $GITHUB_ENV
43+
echo "GIT_REV=$(git rev-parse HEAD)" >> $GITHUB_ENV
44+
45+
- name: Build and push Docker image
46+
id: build-and-push
47+
uses: docker/build-push-action@v5
48+
env:
49+
SOURCE_DATE_EPOCH: ${{ env.TIMESTAMP }}
50+
with:
51+
context: kms/dstack-app/builder
52+
push: true
53+
tags: ${{ vars.DOCKERHUB_USERNAME }}/kms:${{ env.VERSION }}
54+
platforms: linux/amd64
55+
provenance: false
56+
build-args: |
57+
DSTACK_REV=${{ env.GIT_REV }}
58+
DSTACK_SRC_URL=${{ github.server_url }}/${{ github.repository }}
59+
SOURCE_DATE_EPOCH=${{ env.TIMESTAMP }}
60+
61+
- name: Generate artifact attestation
62+
uses: actions/attest-build-provenance@v1
63+
with:
64+
subject-name: "docker.io/${{ vars.DOCKERHUB_USERNAME }}/kms"
65+
subject-digest: ${{ steps.build-and-push.outputs.digest }}
66+
push-to-registry: true
67+
68+
- name: Setup Node.js
69+
uses: actions/setup-node@v4
70+
with:
71+
node-version: '18'
72+
cache: 'npm'
73+
cache-dependency-path: kms/auth-eth/package-lock.json
74+
75+
- name: Install dependencies and compile contracts
76+
run: |
77+
cd kms/auth-eth
78+
npm ci
79+
npx hardhat compile
80+
81+
- name: GitHub Release
82+
uses: softprops/action-gh-release@v1
83+
with:
84+
name: "KMS Release v${{ env.VERSION }}"
85+
files: |
86+
kms/auth-eth/artifacts/contracts/DstackKms.sol/DstackKms.json
87+
kms/auth-eth/artifacts/contracts/DstackApp.sol/DstackApp.json
88+
body: |
89+
## Docker Image Information
90+
91+
**Image**: `docker.io/${{ vars.DOCKERHUB_USERNAME }}/kms:${{ env.VERSION }}`
92+
93+
**Digest (SHA256)**: `${{ steps.build-and-push.outputs.digest }}`
94+
95+
**Verification**: [Verify on Sigstore](https://search.sigstore.dev/?hash=${{ steps.build-and-push.outputs.digest }})
96+
97+
## Contract ABIs
98+
99+
This release includes the compiled contract ABIs:
100+
- `DstackKms.json` - Main KMS contract ABI
101+
- `DstackApp.json` - Application contract ABI

‎gateway/dstack-app/Dockerfile‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
FROM rust:1.86.0@sha256:300ec56abce8cc9448ddea2172747d048ed902a3090e6b57babb2bf19f754081 AS gateway-builder
2+
ARG DSTACK_REV
3+
WORKDIR /src
4+
5+
# Install build dependencies
6+
RUN apt-get update && \
7+
apt-get install -y --no-install-recommends \
8+
git \
9+
build-essential \
10+
libssl-dev \
11+
protobuf-compiler \
12+
libprotobuf-dev \
13+
libclang-dev \
14+
&& rm -rf /var/lib/apt/lists/*
15+
16+
# Clone and checkout specific revision
17+
RUN git clone https://github.com/Dstack-TEE/dstack.git && \
18+
cd dstack && \
19+
git checkout ${DSTACK_REV}
20+
21+
# Build the gateway binary
22+
WORKDIR /src/dstack
23+
RUN cargo build --release -p dstack-gateway
24+
25+
# Runtime stage
26+
FROM debian:bookworm@sha256:ced9eb5eca0a3ba2e29d0045513863b3baaee71cd8c2eed403c9f7d3eaccfd2b
27+
WORKDIR /app
28+
29+
# Install runtime dependencies
30+
RUN apt-get update && \
31+
apt-get install -y --no-install-recommends \
32+
wireguard-tools \
33+
iproute2 \
34+
jq \
35+
&& rm -rf /var/lib/apt/lists/*
36+
37+
# Copy the built binary
38+
COPY --from=gateway-builder /src/dstack/target/release/dstack-gateway /usr/local/bin/dstack-gateway
39+
40+
# Copy entrypoint script
41+
COPY entrypoint.sh /app/entrypoint.sh
42+
RUN chmod +x /app/entrypoint.sh
43+
44+
# Store git revision for reproducibility
45+
ARG DSTACK_REV
46+
RUN echo "${DSTACK_REV}" > /etc/.GIT_REV
47+
48+
ENTRYPOINT ["/app/entrypoint.sh"]
49+
CMD ["dstack-gateway"]

‎gateway/dstack-app/builder/Dockerfile‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
FROM rust:1.86.0@sha256:300ec56abce8cc9448ddea2172747d048ed902a3090e6b57babb2bf19f754081 AS gateway-builder
2+
COPY ./shared /build
3+
ARG DSTACK_REV
4+
WORKDIR /build
5+
RUN ./pin-packages.sh ./builder-pinned-packages.txt
6+
RUN apt-get update && \
7+
apt-get install -y --no-install-recommends \
8+
git \
9+
build-essential \
10+
musl-tools \
11+
libssl-dev \
12+
protobuf-compiler \
13+
libprotobuf-dev \
14+
clang \
15+
libclang-dev
16+
RUN git clone https://github.com/Dstack-TEE/dstack.git && \
17+
cd dstack && \
18+
git checkout ${DSTACK_REV}
19+
RUN rustup target add x86_64-unknown-linux-musl
20+
RUN cd dstack && cargo build --release -p dstack-gateway --target x86_64-unknown-linux-musl
21+
RUN echo "${DSTACK_REV}" > /build/.GIT_REV
22+
23+
FROM debian:bookworm@sha256:0d8498a0e9e6a60011df39aab78534cfe940785e7c59d19dfae1eb53ea59babe
24+
COPY ./shared /build
25+
WORKDIR /build
26+
RUN ./pin-packages.sh ./pinned-packages.txt && \
27+
apt-get update && \
28+
apt-get install -y --no-install-recommends \
29+
git \
30+
wireguard-tools \
31+
iproute2 \
32+
jq \
33+
&& rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/ldconfig/aux-cache
34+
COPY --from=gateway-builder /build/dstack/target/x86_64-unknown-linux-musl/release/dstack-gateway /usr/local/bin/dstack-gateway
35+
COPY --from=gateway-builder /build/.GIT_REV /etc/
36+
WORKDIR /app
37+
COPY entrypoint.sh /app/entrypoint.sh
38+
RUN chmod +x /app/entrypoint.sh
39+
ENTRYPOINT ["/app/entrypoint.sh"]
40+
CMD ["dstack-gateway"]

‎gateway/dstack-app/builder/README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Dstack KMS Builder
2+
3+
This directory contains the necessary files to build and run the dstack-kms Docker image for development.
4+
5+
## Overview
6+
7+
The builder creates a Docker image that includes:
8+
- The dstack-kms service compiled from Rust source code
9+
- Command line tool dstack-acpi-tables for generating ACPI tables for dstack CVM
10+
11+
## Prerequisites
12+
13+
- Docker with BuildKit support (v20.10.0+)
14+
- Git
15+
16+
## Building the Image
17+
18+
To build the KMS Docker image, use the provided `build-image.sh` script:
19+
20+
```bash
21+
./build-image.sh <image-name>[:<tag>]
22+
```
23+
24+
For example:
25+
```bash
26+
./build-image.sh kvin/kms
27+
```
28+
29+
## Running the Built Image
30+
31+
### Using Docker Compose
32+
33+
The easiest way to run the KMS service is using the provided `docker-compose.yaml`:
34+
35+
```yaml
36+
services:
37+
kms:
38+
image: kvin/kms
39+
ports:
40+
- "8003:8000"
41+
volumes:
42+
- /var/run/docker.sock:/var/run/docker.sock
43+
- ./kms:/kms
44+
environment:
45+
- IMAGE_DOWNLOAD_URL=${IMAGE_DOWNLOAD_URL:-http://localhost:8001/mr_{OS_IMAGE_HASH}.tar.gz}
46+
- AUTH_TYPE=dev
47+
- DEV_DOMAIN=kms.1022.kvin.wang
48+
- QUOTE_ENABLED=false
49+
```
50+
51+
To start the service:
52+
53+
```bash
54+
docker-compose up
55+
```

‎gateway/dstack-app/builder/build-image.sh‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
#!/bin/bash
2+
set -e
3+
4+
#NO_CACHE=--no-cache
5+
6+
extract-packages() {
7+
local name=$1
8+
local pkg_list_file=$2
9+
if [ -z "$pkg_list_file" ]; then
10+
return
11+
fi
12+
docker run --rm --entrypoint bash $name -c "dpkg -l | grep '^ii' | awk '{print \$2\"=\"\$3}' | sort" > "$pkg_list_file"
13+
}
14+
15+
# Function to build Docker image and optionally extract package list
16+
docker-build() {
17+
local name=$1
18+
local target=$2
19+
local pkg_list_file=$3
20+
# Get the commit timestamp for SOURCE_DATE_EPOCH
21+
local commit_timestamp=$(git show -s --format=%ct $GIT_REV)
22+
local build_args="--build-arg SOURCE_DATE_EPOCH=$commit_timestamp --build-arg DSTACK_REV=$GIT_REV"
23+
24+
local args="--builder buildkit_20 $NO_CACHE $build_args"
25+
26+
# Add target if specified
27+
if [ -n "$target" ]; then
28+
args="$args --target $target"
29+
fi
30+
31+
# Build the image
32+
docker buildx build $args --output type=docker,name=$name,rewrite-timestamp=true --progress=plain .
33+
extract-packages $name $pkg_list_file
34+
}
35+
36+
NAME=$1
37+
if [ -z "$NAME" ]; then
38+
echo "Usage: $0 <name>[:<tag>]"
39+
exit 1
40+
fi
41+
42+
# Check if buildkit_20 already exists before creating it
43+
if ! docker buildx inspect buildkit_20 &>/dev/null; then
44+
docker buildx create --use --driver-opt image=moby/buildkit:v0.20.2 --name buildkit_20
45+
fi
46+
47+
touch shared/builder-pinned-packages.txt
48+
touch shared/pinned-packages.txt
49+
GIT_REV=${GIT_REV:-HEAD}
50+
GIT_REV=$(git rev-parse $GIT_REV)
51+
52+
docker-build "$NAME" "" "shared/pinned-packages.txt"
53+
docker-build "gateway-builder-temp" "gateway-builder" "shared/builder-pinned-packages.txt"
54+
55+
git_status=$(git status --porcelain -- shared/)
56+
if [ -n "$git_status" ]; then
57+
echo "The working tree is not clean, please commit or stash your changes before re-running the build"
58+
exit 1
59+
fi
60+

‎gateway/dstack-app/entrypoint.sh‎ renamed to ‎gateway/dstack-app/builder/entrypoint.sh‎

File renamed without changes.

0 commit comments

Comments
 (0)