Docker related changes

* enable containers (and related scripts) to be optionally SGX_MODE aware and run in HW mode iff SGX_MODE=HW
* also some dockerfile cleanup

Signed-off-by: michael steiner <[email protected]>

Author: g2flyer

.travis.yml

@@ -23,7 +23,7 @@ env:
     - SGX_MODE=SIM
     - SGX_SDK=/opt/intel/sgxsdk
     # SGX SSL
-    - OPENSSL=1.1.0j
+    - OPENSSL_VERSION=1.1.0j
     - SGXSSL_VERSION=v2.4.1
     - SGXSSL=/opt/intel/sgxssl
     # NANOPB
@@ -51,8 +51,8 @@ before_install:
   - chmod +x ${SGX_SDK_BIN}
   - sudo sh -c "echo 'yes' | ./${SGX_SDK_BIN}"; popd
   # SGX SSL
-  - pushd $HOME; git clone --branch $SGXSSL_VERSION https://github.com/intel/intel-sgx-ssl.git
-  - wget https://www.openssl.org/source/openssl-$OPENSSL.tar.gz; mv openssl-$OPENSSL.tar.gz intel-sgx-ssl/openssl_source
+  - pushd $HOME; git clone --branch ${SGXSSL_VERSION} https://github.com/intel/intel-sgx-ssl.git
+  - wget https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz; mv openssl-${OPENSSL_VERSION}.tar.gz intel-sgx-ssl/openssl_source
   - cd intel-sgx-ssl/Linux; make SGX_MODE=SIM DESTDIR=$SGXSSL all test
   - cd intel-sgx-ssl/Linux; make install; popd
   # NANOPB

demo/README.md

@@ -53,15 +53,20 @@ Below is the script's help text.
 ```
 startFPCAuctionNetwork.sh [options]
 
-   This script, by default, will teardown possible previous iterations of this demo, generate new
-   crypto material for the network, start an FPC network as defined in $FPC_PATH/utils/docker-compose,
-   install the mock golang auction chaincode($FPC_PATH/demo/chaincode/golang), install the FPC
-   compliant auction chaincode($FPC_PATH/demo/chaincode/fpc), register auction users, and bring up
-   both the fabric-gatway & frontend UI. If the fabric-gateway and frontend UI docker images have
-   not previously been built it will build them, otherwise the script will reuse the images already
-   existing. The FPC chaincode will not be built unless specified by the flag --build-cc.  
-   By calling the script with both build options, you will be able to run the demo without having
-   to build the whole FPC project (e.g., by calling `make` in $FPC_PATH).
+   This script, by default, will teardown possible previous iterations of this
+   demo, generate new crypto material for the network, start an FPC network as
+   defined in \$FPC_PATH/utils/docker-compose, install the mock golang auction
+   chaincode(\$FPC_PATH/demo/chaincode/golang), install the FPC compliant
+   auction chaincode(\$FPC_PATH/demo/chaincode/fpc), register auction users,
+   and bring up both the fabric-gatway & frontend UI.
+
+   If the fabric-gateway and frontend UI docker images have not previously been
+   built it will build them, otherwise the script will reuse the images already
+   existing.  You can force a rebuild, though, by specifying the flag
+   --build-client.  The FPC chaincode will not be built unless specified by the
+   flag --build-cc.  By calling the script with both build options, you will be
+   able to run the demo without having to build the whole FPC project (e.g., by
+   calling `make` in $FPC_PATH).
 
    options:
        --build-cc:
@@ -95,8 +100,10 @@ will delete all the unused volumes and chaincode images.
 
 ### Scripting
 
-To facilitate  demonstrations and also to help in testing, you can specify a scenario script defining the
-actions of the different parties and execute it using the command [scenario-run.sh](client/scripting/scenario-run.sh).  
+To facilitate demonstrations and also to help in testing, you can specify with a simple
+[DSL](client/scripting/lib/dsl.sh) a scenario script defining the
+actions of the different parties and execute it using the command
+[scenario-run.sh](client/scripting/scenario-run.sh).  
 Below is the script's help text.
 ```
 scenario-run.sh [--help|-h|-?] [--bootstrap|-b] [--dry-run|-d] [--non-interactive|-n] [--skip-delay|-s] [--mock-reset|-r] <script-file>

demo/chaincode/fpc/Makefile

@@ -28,9 +28,21 @@ build: $(BUILD_DIR)
 clean:
 	-rm -rf $(BUILD_DIR)
 
+
+HW_EXTENSION=$(shell if [ "${SGX_MODE}" = "HW" ]; then echo "-hw"; fi)
+
+FPC_DOCKER_NAMESPACE := hyperledger/fabric-private-chaincode
+FPC_DOCKER_CC_BUILDER_NAME = $(FPC_DOCKER_NAMESPACE)-cc-builder$(HW_EXTENSION)
+
 docker-build: clean
-	$(DOCKER) image inspect hyperledger/fabric-private-chaincode-cc-builder > /dev/null 2>&1 || { cd $(TOP)/utils/docker && make cc-builder; }
-	$(DOCKER) run -u $$(id -u):$$(id -g) -v ${PWD}:/project/src/github.com/hyperledger-labs/fabric-private-chaincode/demo/chaincode/fpc -w /project/src/github.com/hyperledger-labs/fabric-private-chaincode/demo/chaincode/fpc hyperledger/fabric-private-chaincode-cc-builder sh -c 'make build'
+	$(DOCKER) image inspect $(FPC_DOCKER_CC_BUILDER_NAME) > /dev/null 2>&1 \
+		|| { cd $(TOP)/utils/docker && make cc-builder; }
+	$(DOCKER) run \
+		-u $$(id -u):$$(id -g)\
+		-v ${PWD}:/project/src/github.com/hyperledger-labs/fabric-private-chaincode/demo/chaincode/fpc\
+		-w /project/src/github.com/hyperledger-labs/fabric-private-chaincode/demo/chaincode/fpc\
+		$(FPC_DOCKER_CC_BUILDER_NAME)\
+		sh -c 'make build'
 
 test: build
 	./test.sh

demo/client/frontend/Makefile

@@ -66,7 +66,9 @@ public/img/users/c-mobile.svg:
 
 
 clobber:
+	RUNNING_IMAGE=$$(${DOCKER} ps -q --filter ancestor=${DOCKER_IMAGE}); \
+	if [ ! -z "$${RUNNING_IMAGE}" ]; then ${DOCKER} kill $${RUNNING_IMAGE}; fi
 	IMAGE=$$(${DOCKER} images ${DOCKER_IMAGE} -q); \
-	if [ ! -z "$${IMAGE}" ]; then ${DOCKER} rmi ${IMAGE}; fi
+	if [ ! -z "$${IMAGE}" ]; then ${DOCKER} rmi -f $${IMAGE}; fi
 	# make clobber in demo/ also would take care but better safe than sorry
 	-$(RM) $(AVATAR_FILES)

demo/client/scripting/Makefile

@@ -14,7 +14,7 @@ ${GO_CMDS}: ${GO_CMDS:=.go}
 	$(GO) build $@.go
 
 test: build
-	./scenario-run.sh	--bootstrap --non-interactive ../../scenario/script
+	./scenario-run.sh --bootstrap --non-interactive ../../scenario/script
 
 clean: 
 	$(GO) $@

demo/scripts/startFPCAuctionNetwork.sh

@@ -11,24 +11,32 @@ set -e
 help(){
    echo "$(basename $0) [options]
 
-   This script, by default, will teardown possible previous iterations of this demo, generate new
-   crypto material for the network, start an FPC network as defined in \$FPC_PATH/utils/docker-compose,
-   install the mock golang auction chaincode(\$FPC_PATH/demo/chaincode/golang), install the FPC
-   compliant auction chaincode(\$FPC_PATH/demo/chaincode/fpc), register auction users, and bring up
-   both the fabric-gatway & frontend UI. If the fabric-gateway and frontend UI docker images have
-   not previously been built it will build them, otherwise the script will reuse the images already
-   existing. The FPC chaincode will not be built unless specified by the flag --build-cc.
+   This script, by default, will teardown possible previous iterations of this
+   demo, generate new crypto material for the network, start an FPC network as
+   defined in \$FPC_PATH/utils/docker-compose, install the mock golang auction
+   chaincode(\$FPC_PATH/demo/chaincode/golang), install the FPC compliant
+   auction chaincode(\$FPC_PATH/demo/chaincode/fpc), register auction users,
+   and bring up both the fabric-gatway & frontend UI.
+
+   If the fabric-gateway and frontend UI docker images have not previously been
+   built it will build them, otherwise the script will reuse the images already
+   existing.  You can force a rebuild, though, by specifying the flag
+   --build-client.  The FPC chaincode will not be built unless specified by the
+   flag --build-cc.  By calling the script with both build options, you will be
+   able to run the demo without having to build the whole FPC project (e.g., by
+   calling 'make' in \$FPC_PATH).
 
    options:
        --build-cc:
-           As part of bringing up the demo components, the auction cc in demo/chaincode/fpc will
-           be rebuilt using the docker-build make target.
+           As part of bringing up the demo components, the auction cc in
+           demo/chaincode/fpc will be rebuilt using the docker-build make target.
        --build-client:
-           As part of bringing up the demo components, the Fabric Gateway and the UI docker images
-           will be built or rebuilt using current source code.
+           As part of bringing up the demo components, the Fabric Gateway and
+           the UI docker images will be built or rebuilt using current source
+           code.
        --help,-h:
            Print this help screen.
-    "
+"
 }
 
 
@@ -75,7 +83,7 @@ if $BUILD_CHAINCODE; then
     echo ""
     echo "Building FPC Auction Chaincode"
     pushd ${DEMO_ROOT}/chaincode/fpc
-        make docker-build
+        make SGX_MODE=${SGX_MODE} docker-build
     popd
 fi
 

ecc/Dockerfile.boilerplate-ecc

@@ -8,6 +8,14 @@ ARG CC_NAME="ecc"
 ARG CC_PATH="/usr/local/bin"
 ARG CC_LIB_PATH=${CC_PATH}"/enclave/lib"
 
+ARG SGX_MODE
+ENV SGX_MODE=${SGX_MODE}
+# Note: the library copied below is SGX_MODE dependent, so we
+# define here a env which makes it easy recognizable which mode
+# the container is. No default, though, as we do not control
+# the build and rely on a proper value provided from outside.
+
+
 RUN mkdir -p ${CC_LIB_PATH}
 
 ENV SGX_SDK=/opt/intel/sgxsdk

ecc/Dockerfile.fpc-app

@@ -2,7 +2,9 @@
 #
 # SPDX-License-Identifier: Apache-2.0
 
-FROM hyperledger/fabric-private-chaincode-boilerplate-ecc
+ARG BOILERPLATE_EXTENSION
+
+FROM hyperledger/fabric-private-chaincode-boilerplate-ecc${BOILERPLATE_EXTENSION}
 
 ARG enclave_so_path
 ARG CC_PATH="/usr/local/bin"

ecc/Makefile

@@ -16,7 +16,8 @@ VSCC_OUT = ecc-vscc.so
 DOCKER_CONTAINER_ID?=$$(docker ps | grep -- ${NET_ID}-${PEER_ID}-$(CC_NAME)- | awk '{print $$1;}')
 # the following are the required docker build parameters
 DOCKER_IMAGE ?= $$(docker images | grep -- ${NET_ID}-${PEER_ID}-$(CC_NAME)- | awk '{print $$1;}')
-DOCKER_BOILERPLATE_ECC_IMAGE ?= hyperledger/$(PROJECT_NAME)-boilerplate-ecc
+BOILERPLATE_EXTENSION=$(shell if [ "${SGX_MODE}" = "HW" ]; then echo "-hw"; fi)
+DOCKER_BOILERPLATE_ECC_IMAGE ?= hyperledger/$(PROJECT_NAME)-boilerplate-ecc$(BOILERPLATE_EXTENSION)
 INSTALLED_DOCKER_BOILERPLATE_ECC_IMAGE ?= $$(docker images | grep -- ${DOCKER_BOILERPLATE_ECC_IMAGE} | awk '{print $$1;}')
 DOCKER_ENCLAVE_SO_PATH ?= $(ENCLAVE_SO_PATH)
 
@@ -71,21 +72,29 @@ ifdef FORCE_REBUILD
 endif
 
 docker-boilerplate-ecc: ecc
-	$(DOCKER) build $(DOCKER_BUILD_OPTS) -t $(DOCKER_BOILERPLATE_ECC_IMAGE) -f Dockerfile.boilerplate-ecc ..
+	$(DOCKER) build $(DOCKER_BUILD_OPTS) -t $(DOCKER_BOILERPLATE_ECC_IMAGE) -f Dockerfile.boilerplate-ecc\
+		--build-arg SGX_MODE=$(SGX_MODE)\
+		..
 
 docker-fpc-app: docker-boilerplate-ecc
 	if [ -z "$(DOCKER_IMAGE)" ]; then\
 		echo "\033[0;31mERROR: cannot override $(CC_NAME) docker image - not found\033[0m";\
 		exit 1;\
 	fi
 	echo "\033[1;33mWARNING: overriding $(DOCKER_IMAGE) docker image\033[0m"
-	$(DOCKER) build $(DOCKER_BUILD_OPTS) -t $(DOCKER_IMAGE) -f Dockerfile.fpc-app --build-arg enclave_so_path=$(DOCKER_ENCLAVE_SO_PATH) ..
+	$(DOCKER) build $(DOCKER_BUILD_OPTS) -t $(DOCKER_IMAGE) -f Dockerfile.fpc-app \
+		--build-arg BOILERPLATE_EXTENSION=$(BOILERPLATE_EXTENSION)\
+		--build-arg enclave_so_path=$(DOCKER_ENCLAVE_SO_PATH)\
+		..
 
 docker-run:
+	if [ "$(SGX_MODE)" = "HW" ]; then \
+		SGX_DEVICE_PATH=$(if [ -e "/dev/isgx" ]; then echo "/dev/isgx"; elif [ -e "/dev/sgx" ]; then echo "/dev/sgx"; else echo "ERROR: NO SGX DEVICE FOUND"; fi);\
+		DOCKER_SGX_ARGS="--device $${SGX_DEVICE_PATH} -v /var/run/aesmd:/var/run/aesmd";\
+	fi;\
 	$(DOCKER) run \
 		-it \
-		--device /dev/isgx \
-		-v /var/run/aesmd:/var/run/aesmd \
+		$${DOCKER_SGX_ARGS} \	
 		--name $(CC_NAME) \
 		-e "CORE_CHAINCODE_LOGGING_LEVEL=DEBUG" \
 		-e "CORE_CHAINCODE_LOGGING_SHIM=INFO" \

fabric/bin/peer.sh

@@ -10,6 +10,7 @@ FPC_TOP_DIR="${SCRIPTDIR}/../../"
 FABRIC_SCRIPTDIR="${FPC_TOP_DIR}/fabric/bin/"
 
 : ${FABRIC_CFG_PATH:=$(pwd)}
+: ${SGX_MODE:=SIM}
 
 . ${FABRIC_SCRIPTDIR}/lib/common_utils.sh
 . ${FABRIC_SCRIPTDIR}/lib/common_ledger.sh
@@ -69,7 +70,7 @@ handle_chaincode_install() {
 	DOCKER_IMAGE_NAME=$(${FPC_DOCKER_NAME_CMD} --cc-name ${FPC_NAME} --cc-version ${CC_VERSION} --net-id ${NET_ID} --peer-id ${PEER_ID}) || die "could not get docker image name"
 
 	# install docker
-	try make ENCLAVE_SO_PATH=${CC_ENCLAVESOPATH} DOCKER_IMAGE=${DOCKER_IMAGE_NAME} -C ${FPC_TOP_DIR}/ecc docker-fpc-app
+	try make SGX_MODE=${SGX_MODE} ENCLAVE_SO_PATH=${CC_ENCLAVESOPATH} DOCKER_IMAGE=${DOCKER_IMAGE_NAME} -C ${FPC_TOP_DIR}/ecc docker-fpc-app
 
 	# eplace path and lang arg with dummy go chaincode
 	ARGS_EXEC=( 'chaincode' 'install' '-n' "${FPC_NAME}" '-v' "${CC_VERSION}" '-p' 'github.com/hyperledger/fabric/examples/chaincode/go/example02/cmd' "${OTHER_ARGS[@]}" )