Skip to content

Commit 6315d04

Browse files
ZaptossZaptoss
committed
Modify run script to create and use encrypted container for store chain data. Add script for gracefully close encrypted container
1 parent 33eb6c2 commit 6315d04

File tree

5 files changed

+128
-19
lines changed

5 files changed

+128
-19
lines changed

‎Dockerfile‎

Lines changed: 25 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -381,29 +381,45 @@ RUN tar -xzf socat-1.7.4.4.tar.gz && \
381381
make && \
382382
make install
383383

384+
FROM golang:1.23.1-bookworm AS nitro-attestation-cli-builder
385+
WORKDIR /workspace
386+
COPY --from=nsmlib-export / target/
387+
RUN export DEBIAN_FRONTEND=noninteractive && \
388+
apt-get update && \
389+
apt-get install -y git && \
390+
git clone https://github.com/distributed-lab/enclave-extras.git && \
391+
cd enclave-extras && \
392+
git checkout v0.1.1
393+
RUN mkdir -p /workspace/target && \
394+
cp -R /workspace/enclave-extras/nitro-attestation-cli/* /workspace && \
395+
cp -R /workspace/pkgconfig /workspace/target/
396+
RUN for file in /workspace/target/pkgconfig/*.pc; do \
397+
sed -i 's/\/path\/to\/lib/\/workspace\/target\/lib/g' "$file"; \
398+
done
399+
RUN go mod download
400+
RUN mkdir -p target/bin
401+
RUN PKG_CONFIG_PATH=/workspace/target/pkgconfig go build -o target/bin/nitro-attestation-cli .
402+
384403
FROM nitro-node AS nitro-node-enclave
385404
USER root
386405
COPY --from=socat-builder /usr/local/bin/socat /usr/local/bin/
406+
COPY --from=nitro-attestation-cli-builder /workspace/target/bin/nitro-attestation-cli /usr/local/bin/
387407
RUN export DEBIAN_FRONTEND=noninteractive && \
388408
apt-get update && \
389409
apt-get install -y \
390410
iproute2 \
391411
nfs-common \
412+
cryptsetup \
413+
xxd \
392414
supervisor &&\
393-
mkdir -p /home/user/export/.arbitrum && \
394-
mkdir -p /home/user/export/.aws && \
395-
mkdir -p /home/user/export/config && \
396-
rm -fr /home/user/.arbitrum && \
397-
ln -fs /home/user/export/.arbitrum /home/user/.arbitrum && \
398-
ln -fs /home/user/export/.aws /home/user/.aws && \
399-
ln -fs /home/user/export/config /home/user/config && \
400-
chown -R user:user /home/user && \
401415
apt-get clean && \
402416
rm -rf /var/lib/apt/lists/* /usr/share/doc/* /var/cache/ldconfig/aux-cache /usr/lib/python3.9/__pycache__/ /usr/lib/python3.9/*/__pycache__/ /var/log/*
403417
COPY ./supervisord.conf /etc/supervisor/supervisord.conf
404418
WORKDIR /home/user/
405419
COPY ./runeif.sh .
406-
RUN chmod 700 runeif.sh
420+
COPY ./close_chain.sh .
421+
RUN chmod 700 runeif.sh && \
422+
chmod 700 close_chain.sh
407423
ENTRYPOINT [ "/home/user/runeif.sh" ]
408424

409425
FROM nitro-node AS nitro-node-default

‎close_chain.sh‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
#!/bin/sh
2+
3+
umount /chain
4+
cryptsetup luksClose chain

‎run.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,10 @@ socat TCP-LISTEN:$RPC_HTTP_PORT,fork,reuseaddr,keepalive VSOCK-CONNECT:$ENCLAVE_
2222
# RPC WS
2323
socat TCP-LISTEN:$RPC_WS_PORT,fork,reuseaddr,keepalive VSOCK-CONNECT:$ENCLAVE_CID:10001,keepalive &
2424

25-
nitro-cli run-enclave --eif-path /home/nitro.eif --enclave-cid $ENCLAVE_CID --cpu-count $CPU_COUNT --memory $MEMORY_MIB
25+
nitro-cli run-enclave --eif-path /home/nitro.eif --enclave-cid $ENCLAVE_CID --cpu-count $CPU_COUNT --memory $MEMORY_MIB $EXTRA_OPTIONS
2626
enclave_id=$(nitro-cli describe-enclaves | jq -r ".[0].EnclaveID")
2727
echo "-------------------------------"
2828
echo "Enclave ID is $enclave_id"
2929
echo "-------------------------------"
3030

31-
nitro-cli console --enclave-id $enclave_id # blocking call.
31+
nitro-cli console --enclave-id $enclave_id || true && tail -f /dev/null

‎runeif.sh‎

Lines changed: 85 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,23 @@
11
#!/bin/sh
22
set -e
33

4+
SHARED_DIR="/shared"
5+
AWS_CONFIG_FILE="$SHARED_DIR/config/aws_config"
6+
AWS_SHARED_CREDENTIALS_FILE="$SHARED_DIR/config/aws_credentials"
7+
AWS_PARAMS="AWS_CONFIG_FILE=$AWS_CONFIG_FILE AWS_SHARED_CREDENTIALS_FILE=$AWS_SHARED_CREDENTIALS_FILE"
8+
49
echo "Starting"
10+
echo "Some sleep..."
511
sleep 5
612

713
echo "Up loopback interface"
814
ip link set lo up || true
15+
echo "Some sleep..."
916
sleep 5
1017

1118
echo "Setup /etc/hosts"
1219
echo "127.0.0.2 kms.us-east-1.amazonaws.com kms.us-east-2.amazonaws.com kms.us-west-1.amazonaws.com kms.us-west-2.amazonaws.com kms.ap-south-1.amazonaws.com kms.ap-northeast-1.amazonaws.com kms.ap-northeast-2.amazonaws.com kms.ap-northeast-3.amazonaws.com kms.ap-southeast-1.amazonaws.com kms.ap-southeast-2.amazonaws.com kms.ca-central-1.amazonaws.com kms.eu-central-1.amazonaws.com kms.eu-west-1.amazonaws.com kms.eu-west-2.amazonaws.com kms.eu-west-3.amazonaws.com kms.eu-north-1.amazonaws.com kms.sa-east-1.amazonaws.com" >>/etc/hosts
1320
echo "127.0.0.3 sts.us-east-1.amazonaws.com sts.us-east-2.amazonaws.com sts.us-west-1.amazonaws.com sts.us-west-2.amazonaws.com sts.ap-south-1.amazonaws.com sts.ap-northeast-1.amazonaws.com sts.ap-northeast-2.amazonaws.com sts.ap-northeast-3.amazonaws.com sts.ap-southeast-1.amazonaws.com sts.ap-southeast-2.amazonaws.com sts.ca-central-1.amazonaws.com sts.eu-central-1.amazonaws.com sts.eu-west-1.amazonaws.com sts.eu-west-2.amazonaws.com sts.eu-west-3.amazonaws.com sts.eu-north-1.amazonaws.com sts.sa-east-1.amazonaws.com" >>/etc/hosts
14-
echo "127.0.0.4 l1-node" >>/etc/hosts
15-
echo "127.0.0.5 l1-beacon-node" >>/etc/hosts
1621

1722
echo "Ensure loopback addresses exist"
1823
# AWS KMS
@@ -40,25 +45,99 @@ if ! ip addr show dev lo | grep -q "127.0.0.200"; then
4045
ip addr add 127.0.0.200/32 dev lo:0
4146
ip link set dev lo:0 up
4247
fi
48+
echo "Some sleep..."
4349
sleep 5
4450

45-
echo "Start vsock proxies"
51+
echo "Start AWS KMS egress vsock proxy"
4652
socat TCP-LISTEN:443,bind=127.0.0.2,fork,reuseaddr,keepalive VSOCK-CONNECT:3:8002,keepalive &
53+
echo "Start AWS STS egress vsock proxy"
4754
socat TCP-LISTEN:443,bind=127.0.0.3,fork,reuseaddr,keepalive VSOCK-CONNECT:3:8003,keepalive &
55+
echo "Start L1 node egress vsock proxy"
4856
socat TCP-LISTEN:8546,bind=127.0.0.4,fork,reuseaddr,keepalive VSOCK-CONNECT:3:8004,keepalive &
57+
echo "Start L1 beacon node egress vsock proxy"
4958
socat TCP-LISTEN:3500,bind=127.0.0.5,fork,reuseaddr,keepalive VSOCK-CONNECT:3:8005,keepalive &
5059
# NFS
60+
echo "Start NFSv4 egress vsock proxy"
5161
socat TCP-LISTEN:2049,bind=127.0.0.200,fork,reuseaddr,keepalive VSOCK-CONNECT:3:20000,keepalive &
5262
# Supervisor
63+
echo "Start supervisor ingress vsock proxy"
5364
socat VSOCK-LISTEN:9001,fork,keepalive TCP:127.0.0.1:9001,keepalive &
65+
echo "Start L2 HTTP ingress vsock proxy"
5466
socat VSOCK-LISTEN:10000,fork,keepalive TCP:127.0.0.1:8547,keepalive &
67+
echo "Start L2 WS ingress vsock proxy"
5568
socat VSOCK-LISTEN:10001,fork,keepalive TCP:127.0.0.1:8548,keepalive &
69+
echo "Some sleep..."
5670
sleep 5
5771

58-
echo "Mounting persistent volume to /home/user/export"
59-
su user -c 'mkdir -p /home/user/export'
60-
mount -t nfs4 127.0.0.200:/ /home/user/export
72+
echo "Create $SHARED_DIR dir"
73+
mkdir -p $SHARED_DIR
74+
chown -R user:user $SHARED_DIR
75+
echo "Mounting persistent volume to $SHARED_DIR"
76+
mount -t nfs4 127.0.0.200:/ $SHARED_DIR
77+
echo "Some sleep..."
6178
sleep 5
6279

80+
echo "Extend /etc/hosts"
81+
cat $SHARED_DIR/config/hosts >> /etc/hosts
82+
83+
if [ -f $SHARED_DIR/config/storage_kms_key_id.coses1 ]; then
84+
echo "storage_kms_key_id.coses1 exist, try to read key ID"
85+
su user -c "nitro-attestation-cli document read --verify-pcr0 --user-data --input $SHARED_DIR/config/storage_kms_key_id.coses1 > /home/user/kms-key-id"
86+
else
87+
if [ -f $SHARED_DIR/config/storage_encrypted_data_key.coses1 ]; then
88+
echo "kms-key-id not exist, but encrypted-data-key exist, can't decrypt data-key"
89+
exit 1
90+
fi
91+
echo "storage_kms_key_id.coses1 don't exist, try to create key ID"
92+
su user -c "$AWS_PARAMS nitro-attestation-cli kms create-key --pcr0 > /home/user/kms-key-id"
93+
echo "Ensure that key created. Some sleep..."
94+
sleep 1
95+
echo "Create attestation document with KMS Key ID in $SHARED_DIR/config/storage_kms_key_id.coses1"
96+
su user -c "nitro-attestation-cli document create --user-data $(cat /home/user/kms-key-id | xxd -p -c 0) > $SHARED_DIR/config/storage_kms_key_id.coses1"
97+
fi
98+
99+
if [ -f $SHARED_DIR/config/storage_encrypted_data_key.coses1 ]; then
100+
echo "storage_encrypted_data_key.coses1 exist, try to read encrypted data key"
101+
su user -c "nitro-attestation-cli document read --verify-pcr0 --user-data --input $SHARED_DIR/config/storage_encrypted_data_key.coses1 > /home/user/encrypted-data-key"
102+
else
103+
echo "storage_encrypted_data_key.coses1 don't exist, try to encrypted data key"
104+
su user -c "$AWS_PARAMS nitro-attestation-cli kms generate-data-key --key-id $(cat /home/user/kms-key-id) --number-of-bytes 32 > /home/user/encrypted-data-key"
105+
echo "Create attestation document with encryped data key in $SHARED_DIR/config/storage_encrypted_data_key.coses1"
106+
su user -c "nitro-attestation-cli document create --user-data $(cat /home/user/encrypted-data-key | xxd -p -c 0) > $SHARED_DIR/config/storage_encrypted_data_key.coses1"
107+
fi
108+
109+
echo "Decrypte data key"
110+
su user -c "$AWS_PARAMS nitro-attestation-cli kms decrypt --key-id $(cat /home/user/kms-key-id) --input /home/user/encrypted-data-key > /home/user/data-key"
111+
112+
echo "Create chain directory: /chain"
113+
mkdir -p /chain
114+
if [ ! -f $SHARED_DIR/chain.img ]; then
115+
echo "chain.img don't exist, exit..."
116+
exit 1
117+
fi
118+
119+
if cryptsetup isLuks $SHARED_DIR/chain.img >/dev/null 2>&1; then
120+
echo "chain.img is LUKS container, open..."
121+
cryptsetup luksOpen $SHARED_DIR/chain.img chain --key-file=/home/user/data-key
122+
else
123+
echo "chain.img is not LUKS container, format..."
124+
cryptsetup luksFormat $SHARED_DIR/chain.img --key-file=/home/user/data-key --batch-mode
125+
echo "Open encrypted container"
126+
cryptsetup luksOpen $SHARED_DIR/chain.img chain --key-file=/home/user/data-key
127+
echo "Make ext4 filesystem in encrypted container"
128+
mkfs.ext4 /dev/mapper/chain
129+
fi
130+
131+
echo "Mount chain to /chain"
132+
mount /dev/mapper/chain /chain
133+
chmod 777 /chain
134+
chown -R user:user /chain
135+
136+
echo "Some sleep..."
137+
sleep 5
138+
139+
echo "Create $SHARED_DIR/.arbitrum/local/nitro"
140+
su user -c "mkdir -p $SHARED_DIR/.arbitrum/local/nitro"
141+
63142
echo "Start supervisor"
64143
supervisord -c /etc/supervisor/supervisord.conf

‎supervisord.conf‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,8 +13,8 @@ serverurl=http://127.0.0.1:9001
1313
[program:nitro]
1414
user=user
1515
directory=/home/user
16-
environment=HOME="/home/user"
17-
command=nitro --node.block-validator.validation-server.url "self-auth" --execution.parent-chain-reader.enable true --node.staker.data-poster.external-signer.url "" --node.staker.dangerous.without-block-validator false --node.staker.dangerous.ignore-rollup-wasm-module-root false --validation.wasm.allowed-wasm-module-roots "/home/user/nitro-legacy/machines,/home/user/target/machines" --conf.file /home/user/config/validator_config.json
16+
environment=HOME="/home/user",AWS_CONFIG_FILE="/shared/config/aws_config",AWS_SHARED_CREDENTIALS_FILE="/shared/config/aws_credentials"
17+
command=nitro --persistent.chain="/chain" --persistent.global-config="/shared/.arbitrum" --node.block-validator.validation-server.url="self-auth" --execution.parent-chain-reader.enable=true --node.staker.data-poster.external-signer.url="" --node.staker.dangerous.without-block-validator=false --node.staker.dangerous.ignore-rollup-wasm-module-root=false --validation.wasm.allowed-wasm-module-roots="/home/user/nitro-legacy/machines,/home/user/target/machines" --validation.wasm.root-path="/home/user/target/machines" --conf.file="/shared/config/validator_config.json"
1818
autostart=true
1919
autorestart=true
2020
stopwaitsecs=120
@@ -23,5 +23,15 @@ stdout_logfile_maxbytes=0
2323
stderr_logfile=/dev/stderr
2424
stderr_logfile_maxbytes=0
2525

26+
[program:close-chain]
27+
command=/home/user/close_chain.sh
28+
startsecs=0
29+
autostart=false
30+
autorestart=false
31+
stdout_logfile=/dev/stdout
32+
stdout_logfile_maxbytes=0
33+
stderr_logfile=/dev/stderr
34+
stderr_logfile_maxbytes=0
35+
2636
[rpcinterface:supervisor]
2737
supervisor.rpcinterface_factory=supervisor.rpcinterface:make_main_rpcinterface

0 commit comments

Comments
 (0)