Skip to content

Commit 97d4a86

Browse files
zenshzensh
committed
feat: support building enclave image
1 parent 622ad7b commit 97d4a86

File tree

8 files changed

+205
-5
lines changed

8 files changed

+205
-5
lines changed

‎.env‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,5 @@ URL_HTTPBIN="https://httpbin.org/get?api-key=abc123"
1818
# URL_DOGE_TEST="http://192.168.1.80:44555/"
1919
# URL_XXX=...
2020

21-
HEADER_API_TOKEN="Basic SUNQYW5kYTpJVEZDNlJjam56RkdEQnd0SzByYV9kS0swR29lSElqVUl3V2lEb3VrRWU0"
21+
# HEADER_API_TOKEN="Basic SUNQYW5kYTpJVEZDNlJjam56RkdEQnd0SzByYV9kS0swR29lSElqVUl3V2lEb3VrRWU0"
2222
# HEADER_XXX=...

‎Cargo.lock‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ strip = true
1515
opt-level = 's'
1616

1717
[workspace.package]
18-
version = "1.1.0"
18+
version = "1.1.1"
1919
edition = "2021"
2020
repository = "https://github.com/ldclabs/idempotent-proxy"
2121
keywords = ["idempotent", "reverse", "proxy", "icp"]

‎README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,14 @@ docker run --name redis -d -p 6379:6379 redis:latest
6464
cargo run -p idempotent-proxy-server
6565
```
6666

67+
### Building enclave image
68+
69+
https://docs.marlin.org/user-guides/oyster/instances/quickstart/build
70+
71+
```bash
72+
docker build -f enclave/arm64.Dockerfile -t enclave:latest .
73+
```
74+
6775
### Running as Cloudflare Worker
6876

6977
Idempotent Proxy can be running as a Cloudflare Worker. In order to use Durable Objects, you must switch to a paid plan.

‎enclave/amd64.Dockerfile‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# base image
2+
FROM --platform=arm64 rust:slim-bookworm AS builder
3+
4+
RUN apt-get update \
5+
&& apt-get install -y gcc g++ libc6-dev pkg-config libssl-dev
6+
7+
WORKDIR /src
8+
COPY src ./src
9+
COPY examples ./examples
10+
COPY Cargo.toml Cargo.lock .env ./
11+
RUN cargo build --release --locked -p idempotent-proxy-server
12+
13+
FROM debian:bookworm-slim AS runtime
14+
15+
# install dependency tools
16+
RUN apt-get update \
17+
&& apt-get install -y net-tools iptables iproute2 wget ca-certificates tzdata curl openssl \
18+
&& update-ca-certificates \
19+
&& rm -rf /var/lib/apt/lists/*
20+
21+
# working directory
22+
WORKDIR /app
23+
24+
# supervisord to manage programs
25+
RUN wget -O supervisord http://public.artifacts.marlin.pro/projects/enclaves/supervisord_master_linux_amd64
26+
RUN chmod +x supervisord
27+
28+
# transparent proxy component inside the enclave to enable outgoing connections
29+
RUN wget -O ip-to-vsock-transparent http://public.artifacts.marlin.pro/projects/enclaves/ip-to-vsock-transparent_v1.0.0_linux_amd64
30+
RUN chmod +x ip-to-vsock-transparent
31+
32+
# key generator to generate static keys
33+
RUN wget -O keygen http://public.artifacts.marlin.pro/projects/enclaves/keygen_v1.0.0_linux_amd64
34+
RUN chmod +x keygen
35+
36+
# attestation server inside the enclave that generates attestations
37+
RUN wget -O attestation-server http://public.artifacts.marlin.pro/projects/enclaves/attestation-server_v1.0.0_linux_amd64
38+
RUN chmod +x attestation-server
39+
40+
# proxy to expose attestation server outside the enclave
41+
RUN wget -O vsock-to-ip http://public.artifacts.marlin.pro/projects/enclaves/vsock-to-ip_v1.0.0_linux_amd64
42+
RUN chmod +x vsock-to-ip
43+
44+
# dnsproxy to provide DNS services inside the enclave
45+
RUN wget -O dnsproxy http://public.artifacts.marlin.pro/projects/enclaves/dnsproxy_v0.46.5_linux_amd64
46+
RUN chmod +x dnsproxy
47+
48+
# supervisord config
49+
COPY enclave/supervisord.conf /etc/supervisord.conf
50+
51+
# setup.sh script that will act as entrypoint
52+
COPY enclave/setup.sh ./
53+
RUN chmod +x setup.sh
54+
55+
# your custom setup goes here
56+
COPY --from=builder /src/.env ./.env
57+
COPY --from=builder /src/target/release/idempotent-proxy-server ./idempotent-proxy-server
58+
59+
# entry point
60+
ENTRYPOINT [ "/app/setup.sh" ]

‎enclave/arm64.Dockerfile‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# base image
2+
FROM --platform=arm64 rust:slim-bookworm AS builder
3+
4+
RUN apt-get update \
5+
&& apt-get install -y gcc g++ libc6-dev pkg-config libssl-dev
6+
7+
WORKDIR /src
8+
COPY src ./src
9+
COPY examples ./examples
10+
COPY Cargo.toml Cargo.lock .env ./
11+
RUN cargo build --release --locked -p idempotent-proxy-server
12+
13+
FROM debian:bookworm-slim AS runtime
14+
15+
# install dependency tools
16+
RUN apt-get update \
17+
&& apt-get install -y net-tools iptables iproute2 wget ca-certificates tzdata curl openssl \
18+
&& update-ca-certificates \
19+
&& rm -rf /var/lib/apt/lists/*
20+
21+
# working directory
22+
WORKDIR /app
23+
24+
# supervisord to manage programs
25+
RUN wget -O supervisord http://public.artifacts.marlin.pro/projects/enclaves/supervisord_master_linux_arm64
26+
RUN chmod +x supervisord
27+
28+
# transparent proxy component inside the enclave to enable outgoing connections
29+
RUN wget -O ip-to-vsock-transparent http://public.artifacts.marlin.pro/projects/enclaves/ip-to-vsock-transparent_v1.0.0_linux_arm64
30+
RUN chmod +x ip-to-vsock-transparent
31+
32+
# key generator to generate static keys
33+
RUN wget -O keygen http://public.artifacts.marlin.pro/projects/enclaves/keygen_v1.0.0_linux_arm64
34+
RUN chmod +x keygen
35+
36+
# attestation server inside the enclave that generates attestations
37+
RUN wget -O attestation-server http://public.artifacts.marlin.pro/projects/enclaves/attestation-server_v1.0.0_linux_arm64
38+
RUN chmod +x attestation-server
39+
40+
# proxy to expose attestation server outside the enclave
41+
RUN wget -O vsock-to-ip http://public.artifacts.marlin.pro/projects/enclaves/vsock-to-ip_v1.0.0_linux_arm64
42+
RUN chmod +x vsock-to-ip
43+
44+
# dnsproxy to provide DNS services inside the enclave
45+
RUN wget -O dnsproxy http://public.artifacts.marlin.pro/projects/enclaves/dnsproxy_v0.46.5_linux_arm64
46+
RUN chmod +x dnsproxy
47+
48+
# supervisord config
49+
COPY enclave/supervisord.conf /etc/supervisord.conf
50+
51+
# setup.sh script that will act as entrypoint
52+
COPY enclave/setup.sh ./
53+
RUN chmod +x setup.sh
54+
55+
# your custom setup goes here
56+
COPY --from=builder /src/.env ./.env
57+
COPY --from=builder /src/target/release/idempotent-proxy-server ./idempotent-proxy-server
58+
59+
# entry point
60+
ENTRYPOINT [ "/app/setup.sh" ]

‎enclave/setup.sh‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/bin/sh
2+
3+
# setting an address for loopback
4+
ifconfig lo 127.0.0.1
5+
ifconfig
6+
7+
# adding a default route
8+
ip route add default via 127.0.0.1 dev lo
9+
route -n
10+
11+
# iptables rules to route traffic to transparent proxy
12+
iptables -A OUTPUT -t nat -p tcp --dport 1:65535 ! -d 127.0.0.1 -j DNAT --to-destination 127.0.0.1:1200
13+
iptables -t nat -A POSTROUTING -o lo -s 0.0.0.0 -j SNAT --to-source 127.0.0.1
14+
iptables -L -t nat
15+
16+
# generate identity key
17+
/app/keygen --secret /app/id.sec --public /app/id.pub
18+
19+
# your custom setup goes here
20+
21+
# starting supervisord
22+
cat /etc/supervisord.conf
23+
/app/supervisord

‎enclave/supervisord.conf‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
[supervisord]
2+
loglevel=debug
3+
logfile=/dev/stdout
4+
logfile_maxbytes=0
5+
6+
# attestation server
7+
[program:attestation-server]
8+
command=/app/attestation-server --ip-addr 127.0.0.1:1300 --pub-key /app/id.pub
9+
autorestart=true
10+
stdout_logfile=/dev/stdout
11+
stdout_logfile_maxbytes=0
12+
stderr_logfile=/dev/stdout
13+
stderr_logfile_maxbytes=0
14+
15+
# attestation server proxy
16+
[program:attestation-proxy]
17+
command=/app/vsock-to-ip --vsock-addr 88:1300 --ip-addr 127.0.0.1:1300
18+
autorestart=true
19+
stdout_logfile=/dev/stdout
20+
stdout_logfile_maxbytes=0
21+
stderr_logfile=/dev/stdout
22+
stderr_logfile_maxbytes=0
23+
24+
# transparent proxy component inside enclave
25+
[program:ip-to-vsock-transparent]
26+
command=/app/ip-to-vsock-transparent --vsock-addr 3:1200 --ip-addr 127.0.0.1:1200
27+
autorestart=true
28+
stdout_logfile=/dev/stdout
29+
stdout_logfile_maxbytes=0
30+
stderr_logfile=/dev/stdout
31+
stderr_logfile_maxbytes=0
32+
33+
# DNS-over-HTTPS provider
34+
[program:dnsproxy]
35+
command=/app/dnsproxy -u https://1.1.1.1/dns-query -v
36+
autorestart=true
37+
stdout_logfile=/dev/stdout
38+
stdout_logfile_maxbytes=0
39+
stderr_logfile=/dev/stdout
40+
stderr_logfile_maxbytes=0
41+
42+
# your custom programs go here
43+
[program:idempotent-proxy-server]
44+
command=/app/idempotent-proxy-server
45+
autorestart=true
46+
stdout_logfile=/dev/stdout
47+
stdout_logfile_maxbytes=0
48+
stderr_logfile=/dev/stdout
49+
stderr_logfile_maxbytes=0

0 commit comments

Comments
 (0)