Dockerfile.as-grpc

# syntax=docker/dockerfile:1.3

# Copyright (c) 2023 by Alibaba.
# Licensed under the Apache License, Version 2.0, see LICENSE for details.
# SPDX-License-Identifier: Apache-2.0

FROM trustee-registry.cn-hangzhou.cr.aliyuncs.com/daily/ubuntu:24.04 as builder
ARG ARCH=x86_64

WORKDIR /usr/src/attestation-service
COPY . .

# Install TPM Build Dependencies
RUN apt-get update && apt-get install -y git openssh-client protobuf-compiler curl gnupg openssl clang libtss2-dev python3 python3-pip python3-dev && \
rm -rf /var/lib/apt/lists/{apt,dpkg,cache,log} /tmp/* /var/tmp/*

# Install Rust
RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
ENV PATH="/root/.cargo/bin:${PATH}"

# Install NV Attestation SDK
RUN python3.12 -m pip install attestation-service/docker/nv_local_gpu_verifier-1.4.0-py3-none-any.whl --break-system-packages
RUN python3.12 -m pip install attestation-service/docker/nv_attestation_sdk-1.4.0-py3-none-any.whl --break-system-packages

# Install TDX Build Dependencies
RUN if [ "${ARCH}" = "x86_64" ]; then curl -L https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | tee intel-sgx-deb.key | apt-key add - && \
    echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu jammy main' | tee /etc/apt/sources.list.d/intel-sgx.list && \
    apt-get update && apt-get install -y libsgx-dcap-quote-verify-dev; fi

# Build and Install gRPC attestation-service
RUN cargo install --path attestation-service --bin grpc-as --features grpc-bin --locked


FROM trustee-registry.cn-hangzhou.cr.aliyuncs.com/daily/ubuntu:24.04
ARG ARCH=x86_64

# Install TDX Runtime Dependencies
RUN apt-get update && apt-get install curl gnupg openssl python3 python3-pip python3-dev -y && \
    rm -rf /var/lib/apt/lists/{apt,dpkg,cache,log} /tmp/* /var/tmp/*

# Install NV Attestation SDK
COPY --from=builder /usr/src/attestation-service/attestation-service/docker/nv_local_gpu_verifier-1.4.0-py3-none-any.whl /usr
COPY --from=builder /usr/src/attestation-service/attestation-service/docker/nv_attestation_sdk-1.4.0-py3-none-any.whl /usr
RUN python3.12 -m pip install /usr/nv_local_gpu_verifier-1.4.0-py3-none-any.whl --break-system-packages
RUN python3.12 -m pip install /usr/nv_attestation_sdk-1.4.0-py3-none-any.whl --break-system-packages

RUN pip3 install --upgrade setuptools==70.0.0 --break-system-packages
RUN pip3 install --upgrade requests==2.32.0 --break-system-packages

# Install NV Attestation Default Token validation policy
COPY --from=builder /usr/src/attestation-service/deps/verifier/test_data/NVGPULocalPolicyDefault.json /usr/

RUN if [ "${ARCH}" = "x86_64" ]; then curl -L https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | tee intel-sgx-deb.key | apt-key add - && \
    echo 'deb [arch=amd64] https://download.01.org/intel-sgx/sgx_repo/ubuntu jammy main' | tee /etc/apt/sources.list.d/intel-sgx.list && \
    apt-get update && \
    apt-get install -y libsgx-dcap-default-qpl libsgx-dcap-quote-verify && \
    rm -rf /var/lib/apt/lists/{apt,dpkg,cache,log} /tmp/* /var/tmp/*; fi

# Copy TPM Runtime Dependencies
COPY --from=builder /usr/lib/${ARCH}-linux-gnu/libtss* /usr/lib/${ARCH}-linux-gnu

COPY --from=builder /root/.cargo/bin/grpc-as /usr/local/bin/grpc-as

VOLUME /opt/confidential-containers/attestation-service

CMD ["grpc-as", "--socket", "0.0.0.0:50004"]

EXPOSE 50004