Skip to content

Commit 88b6ae8

Browse files
kvinwangkvinwang
authored
Merge pull request #229 from Dstack-TEE/kms-builder
Add reproducible docker image builder for KMS
2 parents e9614b7 + 99589f3 commit 88b6ae8

File tree

9 files changed

+934
-0
lines changed

9 files changed

+934
-0
lines changed

‎kms/dstack-app/.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
.app-compose.json
22
.env
3+
.GIT_REV

‎kms/dstack-app/builder/Dockerfile‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
FROM rust:1.86.0@sha256:300ec56abce8cc9448ddea2172747d048ed902a3090e6b57babb2bf19f754081 AS kms-builder
2+
COPY ./shared /build
3+
ARG DSTACK_REV
4+
WORKDIR /build
5+
RUN ./pin-packages.sh ./kms-pinned-packages.txt
6+
RUN apt-get update && \
7+
apt-get install -y --no-install-recommends \
8+
git \
9+
build-essential \
10+
musl-tools \
11+
libssl-dev \
12+
protobuf-compiler \
13+
libprotobuf-dev \
14+
clang \
15+
libclang-dev
16+
RUN git clone https://github.com/Dstack-TEE/dstack.git && \
17+
cd dstack && \
18+
git checkout ${DSTACK_REV}
19+
RUN rustup target add x86_64-unknown-linux-musl
20+
RUN cd dstack && cargo build --release -p dstack-kms --target x86_64-unknown-linux-musl
21+
22+
FROM debian:bookworm@sha256:0d8498a0e9e6a60011df39aab78534cfe940785e7c59d19dfae1eb53ea59babe
23+
COPY ./shared /build
24+
WORKDIR /build
25+
ARG QEMU_REV=d98440811192c08eafc07c7af110593c6b3758ff
26+
RUN ./pin-packages.sh ./qemu-pinned-packages.txt && \
27+
apt-get update && \
28+
apt-get install -y --no-install-recommends \
29+
git \
30+
libslirp-dev \
31+
python3-pip \
32+
ninja-build \
33+
pkg-config \
34+
libglib2.0-dev \
35+
python3-sphinx \
36+
python3-sphinx-rtd-theme \
37+
build-essential \
38+
flex \
39+
bison && \
40+
rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/ldconfig/aux-cache
41+
RUN git clone https://github.com/kvinwang/qemu-tdx.git --depth 1 --branch passthrough-dump-acpi --single-branch && \
42+
cd qemu-tdx && git fetch --depth 1 origin ${QEMU_REV} && \
43+
git checkout ${QEMU_REV} && \
44+
../config-qemu.sh ./build /usr/local && \
45+
cd build && \
46+
ninja && \
47+
strip qemu-system-x86_64 && \
48+
install -m 755 qemu-system-x86_64 /usr/local/bin/dstack-acpi-tables && \
49+
cd ../ && \
50+
install -d /usr/local/share/qemu && \
51+
install -m 644 pc-bios/efi-virtio.rom /usr/local/share/qemu/ && \
52+
install -m 644 pc-bios/kvmvapic.bin /usr/local/share/qemu/ && \
53+
install -m 644 pc-bios/linuxboot_dma.bin /usr/local/share/qemu/ && \
54+
cd .. && rm -rf qemu-tdx
55+
COPY --from=kms-builder /build/dstack/target/x86_64-unknown-linux-musl/release/dstack-kms /usr/local/bin/dstack-kms
56+
COPY entrypoint.sh /entrypoint.sh
57+
COPY .GIT_REV /etc/.GIT_REV
58+
RUN chmod +x /entrypoint.sh
59+
ENTRYPOINT ["/entrypoint.sh"]
60+
CMD ["dstack-kms"]

‎kms/dstack-app/builder/README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# Dstack KMS Builder
2+
3+
This directory contains the necessary files to build and run the dstack-kms Docker image for development.
4+
5+
## Overview
6+
7+
The builder creates a Docker image that includes:
8+
- The dstack-kms service compiled from Rust source code
9+
- Command line tool dstack-acpi-tables for generating ACPI tables for dstack CVM
10+
11+
## Prerequisites
12+
13+
- Docker with BuildKit support (v20.10.0+)
14+
- Git
15+
16+
## Building the Image
17+
18+
To build the KMS Docker image, use the provided `build-image.sh` script:
19+
20+
```bash
21+
./build-image.sh <image-name>[:<tag>]
22+
```
23+
24+
For example:
25+
```bash
26+
./build-image.sh kvin/kms
27+
```
28+
29+
## Running the Built Image
30+
31+
### Using Docker Compose
32+
33+
The easiest way to run the KMS service is using the provided `docker-compose.yaml`:
34+
35+
```yaml
36+
services:
37+
kms:
38+
image: kvin/kms
39+
ports:
40+
- "8003:8000"
41+
volumes:
42+
- /var/run/docker.sock:/var/run/docker.sock
43+
- ./kms:/kms
44+
environment:
45+
- IMAGE_DOWNLOAD_URL=${IMAGE_DOWNLOAD_URL:-http://localhost:8001/mr_{OS_IMAGE_HASH}.tar.gz}
46+
- AUTH_TYPE=dev
47+
- DEV_DOMAIN=kms.1022.kvin.wang
48+
- QUOTE_ENABLED=false
49+
```
50+
51+
To start the service:
52+
53+
```bash
54+
docker-compose up
55+
```

‎kms/dstack-app/builder/build-image.sh‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#!/bin/bash
2+
set -e
3+
4+
NO_CACHE=--no-cache
5+
6+
extract-packages() {
7+
local name=$1
8+
local pkg_list_file=$2
9+
if [ -z "$pkg_list_file" ]; then
10+
return
11+
fi
12+
docker run --rm --entrypoint bash $name -c "dpkg -l | grep '^ii' | awk '{print \$2\"=\"\$3}' | sort" > "$pkg_list_file"
13+
}
14+
15+
# Function to build Docker image and optionally extract package list
16+
docker-build() {
17+
local name=$1
18+
local target=$2
19+
local pkg_list_file=$3
20+
# Get the commit timestamp for SOURCE_DATE_EPOCH
21+
local commit_timestamp=$(git show -s --format=%ct $GIT_REV)
22+
local build_args="--build-arg SOURCE_DATE_EPOCH=$commit_timestamp --build-arg DSTACK_REV=$GIT_REV"
23+
24+
local args="--builder buildkit_20 $NO_CACHE $build_args"
25+
26+
# Add target if specified
27+
if [ -n "$target" ]; then
28+
args="$args --target $target"
29+
fi
30+
31+
# Build the image
32+
docker buildx build $args --output type=docker,name=$name,rewrite-timestamp=true --progress=plain .
33+
extract-packages $name $pkg_list_file
34+
}
35+
36+
NAME=$1
37+
if [ -z "$NAME" ]; then
38+
echo "Usage: $0 <name>[:<tag>]"
39+
exit 1
40+
fi
41+
42+
# Check if buildkit_20 already exists before creating it
43+
if ! docker buildx inspect buildkit_20 &>/dev/null; then
44+
docker buildx create --use --driver-opt image=moby/buildkit:v0.20.2 --name buildkit_20
45+
fi
46+
47+
touch shared/kms-pinned-packages.txt
48+
touch shared/qemu-pinned-packages.txt
49+
GIT_REV=$(git rev-parse HEAD)
50+
echo $GIT_REV > .GIT_REV
51+
52+
# First build the qemu-builder stage and extract package list
53+
docker-build "$NAME" "" "shared/qemu-pinned-packages.txt"
54+
# Then build the kms-builder stage and extract package list
55+
docker-build "kms-builder-temp" "kms-builder" "shared/kms-pinned-packages.txt"
56+
57+
git_status=$(git status --porcelain -- shared/)
58+
if [ -n "$git_status" ]; then
59+
echo "The working tree is not clean, please commit or stash your changes before re-running the build"
60+
exit 1
61+
fi
62+
63+
rm .GIT_REV

‎kms/dstack-app/builder/entrypoint.sh‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#!/bin/sh
2+
set -e
3+
4+
cat <<EOF > ./kms.toml
5+
[rpc]
6+
address = "0.0.0.0"
7+
port = 8000
8+
9+
[rpc.tls]
10+
key = "/kms/certs/rpc.key"
11+
certs = "/kms/certs/rpc.crt"
12+
13+
[rpc.tls.mutual]
14+
ca_certs = "/kms/certs/tmp-ca.crt"
15+
mandatory = false
16+
17+
[core]
18+
cert_dir = "/kms/certs"
19+
admin_token_hash = ""
20+
21+
[core.image]
22+
verify = true
23+
cache_dir = "/kms/images"
24+
download_url = "${IMAGE_DOWNLOAD_URL}"
25+
download_timeout = "2m"
26+
27+
[core.auth_api]
28+
type = "${AUTH_TYPE}"
29+
30+
[core.auth_api.webhook]
31+
url = "${AUTH_RPC_URL}"
32+
33+
[core.auth_api.dev]
34+
gateway_app_id = "any"
35+
36+
[core.onboard]
37+
enabled = true
38+
auto_bootstrap_domain = "${DEV_DOMAIN}"
39+
quote_enabled = ${QUOTE_ENABLED}
40+
address = "0.0.0.0"
41+
port = 8000
42+
EOF
43+
44+
exec "$@"

‎kms/dstack-app/builder/shared/config-qemu.sh‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/bash
2+
3+
BUILD_DIR="$1"
4+
PREFIX="$2"
5+
if [ -z "$BUILD_DIR" ]; then
6+
echo "Usage: $0 <build-directory>"
7+
exit 1
8+
fi
9+
10+
mkdir -p "$BUILD_DIR"
11+
cd "$BUILD_DIR"
12+
13+
export SOURCE_DATE_EPOCH=$(git -C .. log -1 --pretty=%ct)
14+
export CFLAGS="-DDUMP_ACPI_TABLES -Wno-builtin-macro-redefined -D__DATE__=\"\" -D__TIME__=\"\" -D__TIMESTAMP__=\"\""
15+
export LDFLAGS="-Wl,--build-id=none"
16+
17+
../configure \
18+
--prefix="$PREFIX" \
19+
--target-list=x86_64-softmmu \
20+
--disable-werror
21+
22+
echo ""
23+
echo "Build configured for reproducibility in $BUILD_DIR"
24+
echo "To build, run: cd $BUILD_DIR && make"

0 commit comments

Comments
 (0)