Skip to content

Commit f6b575a

Browse files
AmozPayAmozPay
AmozPay
authored and
AmozPay
committed
work in progress: No native runtime for docker
1 parent 9cfe03f commit f6b575a

File tree

9 files changed

+906
-0
lines changed

9 files changed

+906
-0
lines changed

‎.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ __pycache__
1313
/pydantic/
1414
node_modules
1515
*.squashfs
16+
.vscode
17+
rootfs/
1618
/examples/example_http_rust/target/
1719
/examples/example_django/static/admin/
1820
/runtimes/aleph-debian-11-python/rootfs/

‎docker/vm_supervisor-dev-docker.dockerfile

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# This is mainly a copy of the installation instructions from [vm_supervisor/README.md]
2+
3+
FROM debian:bullseye
4+
5+
RUN apt-get update && apt-get -y upgrade && apt-get install -y \
6+
sudo acl curl squashfs-tools git \
7+
python3 python3-aiohttp python3-msgpack python3-pip python3-aiodns python3-aioredis \
8+
python3-psutil python3-setproctitle python3-sqlalchemy python3-packaging \
9+
&& rm -rf /var/lib/apt/lists/*
10+
11+
RUN useradd jailman
12+
13+
RUN mkdir /opt/firecracker
14+
RUN chown $(whoami) /opt/firecracker
15+
RUN curl -fsSL https://github.com/firecracker-microvm/firecracker/releases/download/v1.0.0/firecracker-v1.0.0-x86_64.tgz | tar -xz --directory /opt/firecracker
16+
RUN curl -fsSL -o /opt/firecracker/vmlinux.bin https://github.com/aleph-im/aleph-vm/releases/download/0.1.0/vmlinux.bin
17+
18+
# Link binaries on version-agnostic paths:
19+
RUN ln /opt/firecracker/release-*/firecracker-v* /opt/firecracker/firecracker
20+
RUN ln /opt/firecracker/release-*/jailer-v* /opt/firecracker/jailer
21+
22+
RUN pip3 install typing-extensions 'aleph-message>=0.1.19'
23+
24+
RUN mkdir -p /var/lib/aleph/vm/jailer
25+
26+
ENV PYTHONPATH /mnt
27+
28+
# Networking only works in privileged containers
29+
ENV ALEPH_VM_ALLOW_VM_NETWORKING False
30+
ENV ALEPH_VM_NETWORK_INTERFACE "tap0"
31+
# Jailer does not work in Docker containers
32+
ENV ALEPH_VM_USE_JAILER False
33+
# Use fake test data
34+
ENV ALEPH_VM_FAKE_DATA True
35+
# Allow connections from host
36+
ENV ALEPH_VM_SUPERVISOR_HOST "0.0.0.0"
37+
38+
# Make it easy to enter this command from a shell script
39+
RUN echo "python3 -m vm_supervisor --print-settings --very-verbose --system-logs --profile -f ./examples/example_docker_container > log.txt 2>&1" >> /root/.bash_history
40+
41+
RUN mkdir /opt/aleph-vm/
42+
COPY ./vm_supervisor /opt/aleph-vm/vm_supervisor
43+
COPY ./firecracker /opt/aleph-vm/firecracker
44+
COPY ./guest_api /opt/aleph-vm/guest_api
45+
COPY ./examples /opt/aleph-vm/examples
46+
COPY ./runtimes /opt/aleph-vm/runtimes
47+
48+
WORKDIR /opt/aleph-vm
49+
50+
CMD "bash"

‎examples/example_docker_container/entrypoint.sh

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
#!/bin/sh
2+
docker image ls
3+
docker run --rm -p 8080:8080 amozpay/hello_node

‎examples/message_from_aleph_docker_runtime.json

+94
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
{
2+
"_id": {
3+
"$oid": "6080402d7f44efefd611dc1e"
4+
},
5+
"chain": "ETH",
6+
"item_hash": "fake-hash-fake-hash-fake-hash-fake-hash-fake-hash-fake-hash-hash",
7+
"sender": "0x9319Ad3B7A8E0eE24f2E639c40D8eD124C5520Ba",
8+
"type": "PROGRAM",
9+
"channel": "Fun-dApps",
10+
"confirmed": true,
11+
"content": {
12+
"type": "vm-function",
13+
"address": "0x9319Ad3B7A8E0eE24f2E639c40D8eD124C5520Ba",
14+
"allow_amend": false,
15+
"code": {
16+
"encoding": "squashfs",
17+
"entrypoint": "entrypoint.sh",
18+
"ref": "7eb2eca2378ea8855336ed76c8b26219f1cb90234d04441de9cf8cb1c649d003",
19+
"use_latest": false
20+
},
21+
"variables": {
22+
"VM_CUSTOM_NUMBER": "32",
23+
"DOCKER_MOUNTPOINT": "/opt/docker"
24+
},
25+
"on": {
26+
"http": true,
27+
"message": [
28+
{
29+
"sender": "0xb5F010860b0964090d5414406273E6b3A8726E96",
30+
"channel": "TEST"
31+
},
32+
{
33+
"content": {
34+
"ref": "4d4db19afca380fdf06ba7f916153d0f740db9de9eee23ad26ba96a90d8a2920"
35+
}
36+
}
37+
]
38+
},
39+
"environment": {
40+
"reproducible": true,
41+
"internet": true,
42+
"aleph_api": true,
43+
"shared_cache": true
44+
},
45+
"resources": {
46+
"vcpus": 1,
47+
"memory": 512,
48+
"seconds": 30
49+
},
50+
"runtime": {
51+
"ref": "5f31b0706f59404fad3d0bff97ef89ddf24da4761608ea0646329362c662ba51",
52+
"use_latest": false,
53+
"comment": "Aleph Alpine Linux with Python 3.8"
54+
},
55+
"volumes": [
56+
{
57+
"mount": "/opt/docker",
58+
"ref": "5f31b0706f59404fad3d0bff97ef89ddf24da4761608ea0646329362c662ba51",
59+
"use_latest": false
60+
},
61+
{
62+
"comment": "Working data persisted on the VM supervisor, not available on other nodes",
63+
"mount": "/var/lib/example",
64+
"name": "data",
65+
"persistence": "host",
66+
"size_mib": 5
67+
}
68+
],
69+
"data": {
70+
"encoding": "zip",
71+
"mount": "/data",
72+
"ref": "7eb2eca2378ea8855336ed76c8b26219f1cb90234d04441de9cf8cb1c649d003",
73+
"use_latest": false
74+
},
75+
"export": {
76+
"encoding": "zip",
77+
"mount": "/data"
78+
},
79+
"replaces": "0x9319Ad3B7A8E0eE24f2E639c40D8eD124C5520Ba",
80+
"time": 1619017773.8950517
81+
},
82+
"item_content": "{\"type\": \"vm-function\", \"address\": \"0x9319Ad3B7A8E0eE24f2E639c40D8eD124C5520Ba\", \"allow_amend\": false, \"code\": {\"encoding\": \"squashfs\", \"entrypoint\": \"main:app\", \"ref\": \"7eb2eca2378ea8855336ed76c8b26219f1cb90234d04441de9cf8cb1c649d003\", \"use_latest\": false}, \"on\": {\"http\": true, \"message\": [{\"sender\": \"0xB31B787AdA86c6067701d4C0A250c89C7f1f29A5\", \"channel\": \"TEST\"}, {\"content\": {\"ref\": \"4d4db19afca380fdf06ba7f916153d0f740db9de9eee23ad26ba96a90d8a2920\"}}]}, \"environment\": {\"reproducible\": true, \"internet\": true, \"aleph_api\": true, \"shared_cache\": false}, \"resources\": {\"vcpus\": 1, \"memory\": 128, \"seconds\": 30}, \"runtime\": {\"ref\": \"5f31b0706f59404fad3d0bff97ef89ddf24da4761608ea0646329362c662ba51\", \"use_latest\": false, \"comment\": \"Aleph Alpine Linux with Python 3.8\"}, \"volumes\": [{\"mount\": \"/opt/venv\", \"ref\": \"5f31b0706f59404fad3d0bff97ef89ddf24da4761608ea0646329362c662ba51\", \"use_latest\": false}, {\"comment\": \"Working data persisted on the VM supervisor, not available on other nodes\", \"mount\": \"/var/lib/sqlite\", \"name\": \"database\", \"persistence\": \"host\", \"size_mib\": 5}], \"data\": {\"encoding\": \"zip\", \"mount\": \"/data\", \"ref\": \"7eb2eca2378ea8855336ed76c8b26219f1cb90234d04441de9cf8cb1c649d003\", \"use_latest\": false}, \"export\": {\"encoding\": \"zip\", \"mount\": \"/data\"}, \"replaces\": \"0x9319Ad3B7A8E0eE24f2E639c40D8eD124C5520Ba\", \"time\": 1619017773.8950517}",
83+
"item_type": "inline",
84+
"signature": "0x372da8230552b8c3e65c05b31a0ff3a24666d66c575f8e11019f62579bf48c2b7fe2f0bbe907a2a5bf8050989cdaf8a59ff8a1cbcafcdef0656c54279b4aa0c71b",
85+
"size": 749,
86+
"time": 1619017773.8950577,
87+
"confirmations": [
88+
{
89+
"chain": "ETH",
90+
"height": 12284734,
91+
"hash": "0x67f2f3cde5e94e70615c92629c70d22dc959a118f46e9411b29659c2fce87cdc"
92+
}
93+
]
94+
}

‎runtimes/aleph-docker/create_disk_image.sh

+103
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
#!/bin/sh
2+
3+
rm -f ./rootfs.squashfs
4+
5+
set -euf
6+
7+
rm -fr ./rootfs
8+
mkdir ./rootfs
9+
10+
debootstrap --variant=minbase bullseye ./rootfs http://deb.debian.org/debian/
11+
12+
chroot ./rootfs /bin/sh <<EOT
13+
14+
set -euf
15+
16+
apt-get install -y --no-install-recommends --no-install-suggests \
17+
python3-minimal \
18+
openssh-server \
19+
socat libsecp256k1-0 \
20+
\
21+
python3-aiohttp python3-msgpack \
22+
python3-setuptools \
23+
python3-pip python3-cytoolz python3-pydantic \
24+
iproute2 unzip \
25+
curl\
26+
docker.io\
27+
cgroupfs-mount \
28+
build-essential python3-dev
29+
pip3 install 'fastapi~=0.71.0'
30+
31+
32+
echo "Pip installing aleph-client"
33+
pip3 install 'aleph-client>=0.4.6' 'coincurve==15.0.0'
34+
35+
# Compile all Python bytecode
36+
python3 -m compileall -f /usr/local/lib/python3.9
37+
38+
echo "root:toor" | /usr/sbin/chpasswd
39+
40+
mkdir -p /overlay
41+
42+
# Set up a login terminal on the serial console (ttyS0):
43+
ln -s agetty /etc/init.d/agetty.ttyS0
44+
echo ttyS0 > /etc/securetty
45+
46+
update-alternatives --set iptables /usr/sbin/iptables-legacy
47+
EOT
48+
# The docker service starts automatically on Debian based distributions. https://docs.docker.com/engine/install/debian/
49+
50+
51+
echo "PermitRootLogin yes" >> ./rootfs/etc/ssh/sshd_config
52+
53+
echo -ne '{\n"storage-driver": "vfs"\n}\n' > ./rootfs/etc/docker/daemon.json
54+
rm -fr ./rootfs/var/lib/docker
55+
mkdir ./rootfs/var/lib/docker
56+
57+
# Generate SSH host keys
58+
#systemd-nspawn -D ./rootfs/ ssh-keygen -q -N "" -t dsa -f /etc/ssh/ssh_host_dsa_key
59+
#systemd-nspawn -D ./rootfs/ ssh-keygen -q -N "" -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key
60+
#systemd-nspawn -D ./rootfs/ ssh-keygen -q -N "" -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key
61+
#systemd-nspawn -D ./rootfs/ ssh-keygen -q -N "" -t ed25519 -f /etc/ssh/ssh_host_ed25519_key
62+
63+
cat <<EOT > ./rootfs/etc/inittab
64+
# /etc/inittab
65+
66+
::sysinit:/sbin/init sysinit
67+
::sysinit:/sbin/init boot
68+
::wait:/sbin/init default
69+
70+
# Set up a couple of getty's
71+
tty1::respawn:/sbin/getty 38400 tty1
72+
tty2::respawn:/sbin/getty 38400 tty2
73+
tty3::respawn:/sbin/getty 38400 tty3
74+
tty4::respawn:/sbin/getty 38400 tty4
75+
tty5::respawn:/sbin/getty 38400 tty5
76+
tty6::respawn:/sbin/getty 38400 tty6
77+
78+
# Put a getty on the serial port
79+
ttyS0::respawn:/sbin/getty -L ttyS0 115200 vt100
80+
81+
# Stuff to do for the 3-finger salute
82+
::ctrlaltdel:/sbin/reboot
83+
84+
# Stuff to do before rebooting
85+
::shutdown:/sbin/init shutdown
86+
EOT
87+
88+
# Reduce size
89+
rm -fr ./rootfs/root/.cache
90+
rm -fr ./rootfs/var/cache
91+
mkdir -p ./rootfs/var/cache/apt/archives/partial
92+
rm -fr ./rootfs/usr/share/doc
93+
rm -fr ./rootfs/usr/share/man
94+
rm -fr ./rootfs/var/lib/apt/lists/
95+
96+
# Custom init
97+
rm -f ./rootfs/sbin/init
98+
cp ./init0.sh ./rootfs/sbin/init
99+
cp ./init1.py ./rootfs/root/init1.py
100+
chmod +x ./rootfs/sbin/init
101+
chmod +x ./rootfs/root/init1.py
102+
103+
mksquashfs ./rootfs/ ./rootfs.squashfs

‎runtimes/aleph-docker/init0.sh

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
#!/bin/sh
2+
3+
set -euf
4+
5+
mount -t proc proc /proc -o nosuid,noexec,nodev
6+
7+
log() {
8+
echo "$(cat /proc/uptime | awk '{printf $1}')" '|S' "$@"
9+
}
10+
log "init0.sh is launching"
11+
12+
# Switch root from read-only ext4 to to read-write overlay
13+
mkdir -p /overlay
14+
/bin/mount -t tmpfs -o noatime,mode=0755 tmpfs /overlay
15+
mkdir -p /overlay/root/rw /overlay/root/work
16+
/bin/mount -o noatime,lowerdir=/,upperdir=/overlay/root/rw,workdir=/overlay/root/work -t overlay "overlayfs:/overlay/root/rw" /mnt
17+
18+
echo HERE
19+
stat -f -c %T /overlay/
20+
21+
# Same for /var/lib/docker
22+
# /data
23+
24+
# mkdir -p /overlay/docker/ro /overlay/docker/rw /overlay/docker/work
25+
# /bin/mount -o lowerdir=/opt/docker/ro,upperdir=/overlay/docker/rw,workdir=/overlay/docker/work -t overlay "overlayfs:/overlay/docker/rw" /var/lib
26+
27+
28+
mkdir -p /mnt/rom
29+
pivot_root /mnt /mnt/rom
30+
31+
mount --move /rom/proc /proc
32+
mount --move /rom/dev /dev
33+
34+
mkdir -p /dev/pts
35+
mkdir -p /dev/shm
36+
37+
mount -t sysfs sys /sys -o nosuid,noexec,nodev
38+
mount -t tmpfs run /run -o mode=0755,nosuid,nodev
39+
#mount -t devtmpfs dev /dev -o mode=0755,nosuid
40+
mount -t devpts devpts /dev/pts -o mode=0620,gid=5,nosuid,noexec
41+
mount -t tmpfs shm /dev/shm -omode=1777,nosuid,nodev
42+
43+
cgroupfs-mount
44+
# List block devices
45+
lsblk
46+
47+
#cat /proc/sys/kernel/random/entropy_avail
48+
49+
# TODO: Move in init1
50+
mkdir -p /run/sshd
51+
/usr/sbin/sshd &
52+
log "SSH UP"
53+
54+
log "Setup socat"
55+
socat UNIX-LISTEN:/tmp/socat-socket,fork,reuseaddr VSOCK-CONNECT:2:53 &
56+
log "Socat ready"
57+
58+
log "INIT 0 DONE"
59+
# Replace this script with the manager
60+
exec /root/init1.py

0 commit comments

Comments
 (0)