-
Notifications
You must be signed in to change notification settings - Fork 10
Make enclave application build reproducibly. #57
Conversation
This commit makes the example application build reproducibly on different platforms, i.e., a build on Linux and macOS will result in an identical image. To accomplish this, the following was necessary: * Used new flags and environment variables to build the nitriding executable. The use of -ldflags="-s -w" reduces the binary size. * Don't use "apk add". Instead, use a python base image and take advantage of the built-in urllib.request module. * Add the flag "--custom-platform linux/amd64" to kaniko, which is necessary on non-Linux, non-amd64 platforms like macOS. * Revise the Dockerfile so that inconsistent file permissions on the host don't affect the Docker image. Unrelated to the above, this commit also refactors the Makefile and adds a script that starts gvproxy.
46f37a0
to
d6c32ad
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for tracking down the problem here!
COPY service.py / | ||
COPY start.sh / | ||
# Clone the repository and build the stand-alone nitriding executable. | ||
RUN git clone https://github.com/brave/nitriding.git |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Doesn't this make it harder to test local changes?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
It does but I'm fine with that considering that this is just an example application.
import requests | ||
import urllib.request |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Using the standard library for a smaller footprint, good. The built-in client is ok for this minimal usage. from urllib.request import urlopen
would be more idiomatic.
Make enclave application build reproducibly.
This commit makes the example application build reproducibly on different platforms, i.e., a build on Linux and macOS will result in an identical image. To accomplish this, the following was necessary:
Used new flags and environment variables to build the nitriding executable. The use of -ldflags="-s -w" reduces the binary size.
Don't use "apk add". Instead, use a python base image and take advantage of the built-in urllib.request module.
Add the flag "--custom-platform linux/amd64" to kaniko, which is necessary on non-Linux, non-amd64 platforms like macOS.
Revise the Dockerfile so that inconsistent file permissions on the host don't affect the Docker image.
Unrelated to the above, this commit also refactors the Makefile and adds a script that starts gvproxy.