Skip to content

Commit b63ddad

Browse files
PierreJeanjacquotPierreJeanjacquot
committed
fix: get closer to Scone option
1 parent 6520eea commit b63ddad

File tree

2 files changed

+113
-84
lines changed

2 files changed

+113
-84
lines changed

‎.github/workflows/sconify.yml‎

Lines changed: 86 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -3,61 +3,69 @@ name: Build, Test and Push Docker Image
33
on:
44
workflow_call:
55
inputs:
6+
docker-registry:
7+
description: "Docker registry of docker image to sconify"
8+
default: "docker.io"
9+
type: string
10+
docker-username:
11+
description: "Docker registry username"
12+
type: string
13+
required: true
614
image-name:
7-
description: "Name of Docker Image to Sconify"
15+
description: "Name of docker image to sconify"
816
type: string
917
required: true
1018
image-tag:
11-
description: "Tag of Docker Image to Sconify"
19+
description: "Tag of docker image to sconify "
1220
type: string
1321
required: true
14-
docker-registry:
15-
description: "Docker Registry of Docker Image to Sconify"
16-
default: "docker.io"
17-
type: string
18-
sconify-version:
19-
description: "Version of the Sconify Image to use"
22+
scontain-username:
23+
description: "Scontain registry username"
2024
type: string
2125
required: true
22-
fs-dir:
26+
sconify-version:
27+
description: "Version of the sconify image to use"
2328
type: string
24-
description: "File System Directory to Protect"
2529
required: true
2630
binary:
31+
description: "Path of the binary to use"
2732
type: string
28-
description: "Path to the Binary to Protect"
2933
required: true
3034
command:
35+
description: "Command to execute (default: ENTRYPOINT + CMD of native image)"
36+
type: string
37+
binary-fs:
38+
description: "Embed the file system into the binary via Scone binary file system (default: false)"
39+
type: boolean
40+
default: false
41+
fs-dir:
42+
description: "Path of directories to add to the binary file system (use multiline to add multiple directories)"
43+
type: string
44+
fs-file:
45+
description: "Path of files to add to the binary file system (use multiline to add multiple files)"
46+
type: string
47+
host-path:
48+
description: "Host path, served directly from the host file system (use multiline to add multiple path)"
3149
type: string
32-
description: "Command to Protect"
33-
required: true
3450
heap:
51+
description: "Enclave heap size (default 1G)"
3552
type: string
3653
default: "1G"
37-
description: "Enclave Heap size (default 1G)"
3854
dlopen:
55+
description: "Scoen dlopen mode (default 1)"
3956
type: number
4057
default: 1
41-
description: "dlopen mode (default 1)"
4258
sconify-debug:
43-
description: "Create Scone Debug image (default true)"
44-
default: true
59+
description: "Create Scone debug image (default true)"
4560
type: boolean
46-
sconify-prod:
47-
description: "Create Scone Production image (default true)"
4861
default: true
62+
sconify-prod:
63+
description: "Create Scone production image (default true)"
4964
type: boolean
50-
docker-username:
51-
type: string
52-
description: "Docker Registry Username"
53-
required: true
54-
scontain-username:
55-
type: string
56-
description: "Scontain Registry Username"
57-
required: true
65+
default: true
5866
runner:
59-
type: string
6067
description: "Runner to use (overrides `runs-on`) ⚠️ the specified runner must feature Ubuntu OS and docker CE"
68+
type: string
6169
default: "ubuntu-latest"
6270
secrets:
6371
docker-password:
@@ -92,10 +100,6 @@ on:
92100
jobs:
93101
build:
94102
runs-on: ${{ inputs.runner }}
95-
env:
96-
FROM_IMAGE: ${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }}
97-
DEBUG_IMAGE: ${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }}-scone-debug-${{ inputs.sconify-version }}
98-
PROD_IMAGE: ${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }}-scone-prod-${{ inputs.sconify-version }}
99103
outputs:
100104
debug-image: ${{ steps.push-debug.outputs.image }}
101105
debug-mrenclave: ${{ steps.push-debug.outputs.mrenclave }}
@@ -107,6 +111,44 @@ jobs:
107111
- name: Create Temporary Directory
108112
run: mkdir -p ${{github.workspace}}/tmp
109113

114+
- name: Prepare Sconify Command
115+
id: prepare-command
116+
run: |
117+
FROM_IMAGE=${{ inputs.docker-registry }}/${{ inputs.image-name }}:${{ inputs.image-tag }}
118+
DEBUG_IMAGE=$FROM_IMAGE-scone-debug-${{ inputs.sconify-version }}
119+
echo "debug-image=$DEBUG_IMAGE" >> "$GITHUB_OUTPUT"
120+
PROD_IMAGE=$FROM_IMAGE-scone-prod-${{ inputs.sconify-version }}
121+
echo "prod-image=$PROD_IMAGE" >> "$GITHUB_OUTPUT"
122+
SCONIFY_CMD="sconify_iexec"
123+
# REQUIRED:
124+
# --from
125+
SCONIFY_CMD+=" --from=$FROM_IMAGE"
126+
# --to will be added later on
127+
# --binary
128+
SCONIFY_CMD+=" --binary=${{ inputs.binary }}"
129+
# OPTIONAL:
130+
# --command option
131+
[[ -n '${{ inputs.command }}' ]] && SCONIFY_CMD+=" --command=${{ inputs.command }}"
132+
# --host-path variadic option
133+
while IFS= read -r line; do [[ -n "$line" ]] && SCONIFY_CMD+=` --host-path=$line` ; done <<< ${{ inputs.host-path }}
134+
# BINARY FILE SYSTEM (binary fs):
135+
# --binary-fs option
136+
if ${{ inputs.binary-fs }}; then SCONIFY_CMD+=" --binary-fs"; fi
137+
# --fs-dir variadic option
138+
while IFS= read -r line; do [[ -n "$line" ]] && SCONIFY_CMD+=` --fs-dir=$line` ; done <<< ${{ inputs.fs-dir }}
139+
# --fs-file variadic option
140+
while IFS= read -r line; do [[ -n "$line" ]] && SCONIFY_CMD+=` --file=$line` ; done <<< ${{ inputs.fs-file }}
141+
# SCONE ENV VARS:
142+
# --heap option
143+
[[ -n '${{ inputs.heap }}' ]] && SCONIFY_CMD+=" --heap=${{ inputs.heap }}"
144+
# --dlopen option
145+
[[ -n '${{ inputs.dlopen }}' ]] && SCONIFY_CMD+=" --dlopen=${{ inputs.dlopen }}"
146+
# DEBUG
147+
# --verbose --no-color options
148+
SCONIFY_CMD+=" --verbose --no-color"
149+
echo "sconify-base-command: $SCONIFY_CMD"
150+
echo "sconify-base-command=$SCONIFY_CMD" >> "$GITHUB_OUTPUT"
151+
110152
- name: Login to Docker Registry
111153
uses: docker/login-action@v3
112154
with:
@@ -134,28 +176,17 @@ jobs:
134176
--rm \
135177
-v /var/run/docker.sock:/var/run/docker.sock \
136178
registry.scontain.com/scone-production/iexec-sconify-image:${{ inputs.sconify-version }} \
137-
sconify_iexec \
138-
--from=$FROM_IMAGE \
139-
--to=$DEBUG_IMAGE \
140-
--binary-fs \
141-
--fs-dir=${{ inputs.fs-dir }} \
142-
--host-path=/etc/hosts \
143-
--host-path=/etc/resolv.conf \
144-
--binary=${{ inputs.binary }} \
145-
--heap=${{ inputs.heap }} \
146-
--dlopen=${{ inputs.dlopen }} \
147-
--no-color \
148-
--verbose \
149-
--command="${{ inputs.command }}"
179+
${{ steps.prepare-command.outputs.sconify-base-command }} \
180+
--to=${{ steps.prepare-command.outputs.debug-image }}
150181
151182
- name: Push Debug Image
152183
if: ${{ inputs.sconify-debug }}
153184
id: push-debug
154185
run: |
155-
docker push $DEBUG_IMAGE
156-
echo "image=$DEBUG_IMAGE" >> "$GITHUB_OUTPUT"
157-
echo "checksum=0x$(docker image inspect $DEBUG_IMAGE | jq .[0].RepoDigests[0] | sed 's/"//g' | awk -F '@sha256:' '{print $2}')" >> "$GITHUB_OUTPUT"
158-
echo "mrenclave=$(docker run --rm -e SCONE_HASH=1 $DEBUG_IMAGE)" >> "$GITHUB_OUTPUT"
186+
docker push ${{ steps.prepare-command.outputs.debug-image }}
187+
echo "image=${{ steps.prepare-command.outputs.debug-image }}" >> "$GITHUB_OUTPUT"
188+
echo "checksum=0x$(docker image inspect ${{ steps.prepare-command.outputs.debug-image }} | jq .[0].RepoDigests[0] | sed 's/"//g' | awk -F '@sha256:' '{print $2}')" >> "$GITHUB_OUTPUT"
189+
echo "mrenclave=$(docker run --rm -e SCONE_HASH=1 ${{ steps.prepare-command.outputs.debug-image }})" >> "$GITHUB_OUTPUT"
159190
160191
- name: Sconify Image Prod
161192
if: ${{ inputs.sconify-prod }}
@@ -167,29 +198,18 @@ jobs:
167198
-v /var/run/docker.sock:/var/run/docker.sock \
168199
-v ${{github.workspace}}/tmp/sig/enclave-key.pem:/sig/enclave-key.pem \
169200
registry.scontain.com/scone-production/iexec-sconify-image:${{ inputs.sconify-version }} \
170-
sconify_iexec \
171-
--from=$FROM_IMAGE \
172-
--to=$PROD_IMAGE \
173-
--binary-fs \
174-
--fs-dir=${{ inputs.fs-dir }} \
175-
--host-path=/etc/hosts \
176-
--host-path=/etc/resolv.conf \
177-
--binary=${{ inputs.binary }} \
178-
--heap=${{ inputs.heap }} \
179-
--dlopen=${{ inputs.dlopen }} \
180-
--no-color \
181-
--verbose \
182-
--command="${{ inputs.command }}" \
201+
${{ steps.prepare-command.outputs.sconify-base-command }} \
202+
--to=${{ steps.prepare-command.outputs.prod-image }} \
183203
--scone-signer=/sig/enclave-key.pem
184204
185205
- name: Push Prod Image
186206
if: ${{ inputs.sconify-prod }}
187207
id: push-prod
188208
run: |
189-
docker push $PROD_IMAGE
190-
echo "image=$PROD_IMAGE" >> "$GITHUB_OUTPUT"
191-
echo "checksum=0x$(docker image inspect $PROD_IMAGE | jq .[0].RepoDigests[0] | sed 's/"//g' | awk -F '@sha256:' '{print $2}')" >> "$GITHUB_OUTPUT"
192-
echo "mrenclave=$(docker run --rm -e SCONE_HASH=1 $PROD_IMAGE)" >> "$GITHUB_OUTPUT"
209+
docker push ${{ steps.prepare-command.outputs.prod-image }}
210+
echo "image=${{ steps.prepare-command.outputs.prod-image }}" >> "$GITHUB_OUTPUT"
211+
echo "checksum=0x$(docker image inspect ${{ steps.prepare-command.outputs.prod-image }} | jq .[0].RepoDigests[0] | sed 's/"//g' | awk -F '@sha256:' '{print $2}')" >> "$GITHUB_OUTPUT"
212+
echo "mrenclave=$(docker run --rm -e SCONE_HASH=1 ${{ steps.prepare-command.outputs.prod-image }})" >> "$GITHUB_OUTPUT"
193213
194214
- name: Clean Temporary Directory
195215
if: always()

‎sconify/README.md‎

Lines changed: 27 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -21,22 +21,27 @@ The workflow performs the following actions:
2121

2222
## Workflow Inputs 🛠️
2323

24-
| **Input** | **Description** | **Required** | **Default** |
25-
| --------------------- | ------------------------------------------------------------------------------------------------ | ------------ | ------------- |
26-
| **docker-username** | Docker Registry Username | Yes | - |
27-
| **scontain-username** | Scontain Registry Username | Yes | - |
28-
| **image-name** | Name of Docker Image to Sconify | Yes | - |
29-
| **image-tag** | Tag of Docker Image to Sconify | Yes | - |
30-
| **docker-registry** | Docker Registry of Docker Image to Sconify | No | docker.io |
31-
| **sconify-version** | Version of the Sconify Image to use | Yes | - |
32-
| **fs-dir** | File System Directory to Protect | Yes | - |
33-
| **binary** | Path to the Binary to Protect | Yes | - |
34-
| **command** | Command to Protect | Yes | - |
35-
| **heap** | Enclave Heap size | No | 1G |
36-
| **dlopen** | dlopen mode | No | 1 |
37-
| **sconify-debug** | Create Scone Debug image | No | true |
38-
| **sconify-prod** | Create Scone Production image | No | true |
39-
| **runner** | Runner to use (overrides `runs-on`) ⚠️ the specified runner must feature Ubuntu OS and docker CE | No | ubuntu-latest |
24+
| **Input** | **Description** | **Required** | **Default** |
25+
| --------------------- | -------------------------------------------------------------------------------------------------------- | ------------ | -------------------------------- |
26+
| **docker-registry** | Docker registry of docker image to sconify | No | docker.io |
27+
| **docker-username** | Docker registry username | Yes | - |
28+
| **image-name** | Name of docker image to sconify | Yes | - |
29+
| **image-tag** | Tag of docker image to sconify | Yes | - |
30+
| **scontain-username** | Scontain registry username | Yes | - |
31+
| **sconify-version** | Version of the sconify image to use | Yes | - |
32+
| **binary** | [SCONE] Path of the binary to use | Yes | - |
33+
| **command** | [SCONE] Command to execute | No | ENTRYPOINT + CMD of native image |
34+
| **binary-fs** | [SCONE] Embed the file system into the binary via Scone binary file system | No | false |
35+
| **fs-dir** | [SCONE] Path of directories to add to the binary file system (use multiline to add multiple directories) | No | - |
36+
| **fs-file** | [SCONE] Path of files to add to the binary file system (use multiline to add multiple files) | No | - |
37+
| **host-path** | [SCONE] Host path, served directly from the host file system (use multiline to add multiple path) | No | - |
38+
| **heap** | [SCONE] Enclave heap size | No | 1G |
39+
| **dlopen** | [SCONE] Scone dlopen mode (0:disable; 1:enable and require authentication; 2:debug only) | No | 1 |
40+
| **sconify-debug** | Create Scone debug image | No | true |
41+
| **sconify-prod** | Create Scone production image | No | true |
42+
| **runner** | Runner to use (overrides `runs-on`) ⚠️ the specified runner must feature Ubuntu OS and docker CE | No | ubuntu-latest |
43+
44+
> ℹ️ for more details about [SCONE] options see [Scone's documentation](https://sconedocs.github.io/ee_sconify_image/#all-supported-options)
4045
4146
### Secrets 🔐
4247

@@ -86,7 +91,7 @@ on:
8691

8792
jobs:
8893
sconify:
89-
uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/sconify.yml@sconify-v1.0.0
94+
uses: iExecBlockchainComputing/github-actions-workflows/.github/workflows/sconify.yml@feat/sconify
9095
with:
9196
# runner: your-runner-here ⚠️ control the runner used in the workflow to match your requirements
9297
image-name: ${{ inputs.image-name }}
@@ -95,9 +100,13 @@ jobs:
95100
sconify-prod: ${{ inputs.sconify-prod }}
96101
docker-registry: docker.io
97102
sconify-version: 5.9.0-v15
98-
fs-dir: /app
99103
binary: /usr/local/bin/node
100104
command: node /app/src/app.js
105+
host-path: |
106+
/etc/hosts
107+
/etc/resolv.conf
108+
binary-fs: true
109+
fs-dir: /app
101110
heap: 1G
102111
dlopen: 1
103112
docker-username: ${{ vars.DOCKER_USERNAME }}

0 commit comments

Comments
 (0)