gitbook docker demos fail

[brenzi]

gitbook instructions to build teeracle docker demo fail:

https://docs.integritee.network/4-development/4.6-demos/4.6.3-teeracle-demo

COMPOSE_DOCKER_CLI_BUILD=1 DOCKER_BUILDKIT=1 docker-compose -f docker-compose.yml -f demo-teeracle.yml build --build-arg WORKER_MODE_ARG=teeracle

fails with

ERROR: The Compose file './docker-compose.yml' is invalid because:
Invalid service name 'integritee-node-${VERSION}' - only [a-zA-Z0-9\._\-] characters are allowed

Instructions in the README at https://github.com/integritee-network/worker/blob/fd78d5c4939130f2d08a4947c419ef590f50a63f/docker/README.md

work for the build.

but then, even the instructions in the readme fail:
docker compose -f <(envsubst < docker-compose.yml) -f <(envsubst < demo-teeracle.yml) up demo-teeracle --exit-code-from demo-teeracle
yields

[+] Running 4/4
 ⠿ Network fd_integritee-test-network          Created                                                                                                0.1s
 ⠿ Container fd-integritee-node--1             Created                                                                                                0.0s
 ⠿ Container fd-integritee-teeracle-worker--1  Created                                                                                                0.0s
 ⠿ Container fd-demo-teeracle-1                Created                                                                                                0.1s
Attaching to fd-demo-teeracle-1
dependency failed to start: container fd-integritee-teeracle-worker--1 is unhealthy

please check all instructions in gitbook and adjust accordingly

[OverOrion]

Just a brief summary of why the teeracle with DCAP could fail:

• The teeracle needs the TEERACLE_INTERVAL_SECONDS environment variable specified.
• The dcap feature needs to be passed to the makefile via docker --build-arg
• LD_LIBRARY_PATH must NOT contain the urts library of the aesmd_service, it will override the default one, which will result in a weird SGX enclave initialization errors.

I will be addressing the last two issues in a PR, because they will be required soon anyhow.

---

This command should be used for building a teeracle with DCAP:

COMPOSE_DOCKER_CLI_BUILD=1 DOCKER_BUILDKIT=1 docker compose -f <(envsubst < docker-compose.yml) -f <(envsubst < demo-teeracle.yml) build --build-arg WORKER_MODE_ARG=teeracle --build-arg WORKER_FEATURES_ARG=dcap --build-arg SGX_MODE=HW 

Running it is a bit more challenging and needs some networking adjustments for the containers to reach the specified PCCS server (if the server is on the host). I believe @mosonyi will be able to help with that part.

[OverOrion]

There are still some rough edges, but it works:

SGX_PROVISION=/dev/sgx/provision SGX_ENCLAVE=/dev/sgx/enclave AESMD=/var/run/aesmd TEERACLE_INTERVAL_SECONDS=600 docker compose -f <(envsubst < docker-compose.yml) -f <(envsubst < demo-teeracle.yml) up demo-teeracle --exit-code-from demo-teeracle

And make sure /etc/sgx_default_qcnl.conf is in the container as well (or just mount the one from the host):

git diff ./demo-teeracle.yml
diff --git a/docker/demo-teeracle.yml b/docker/demo-teeracle.yml
index be003c61..d2526fbd 100644
--- a/docker/demo-teeracle.yml
+++ b/docker/demo-teeracle.yml
@@ -15,6 +15,7 @@ services:
       - "${SGX_ENCLAVE:-/dev/null}:/dev/sgx/enclave"
     volumes:
       - "${AESMD:-/dev/null}:/var/run/aesmd"
+      - "/etc/sgx_default_qcnl.conf:/etc/sgx_default_qcnl.conf"
     build:
       context: ${PWD}/..
       dockerfile: build.Dockerfile

[brenzi]

reproducing on :node-2.cluster.securitee.tech

SGX_PROVISION=/dev/sgx/provision SGX_ENCLAVE=/dev/sgx/enclave AESMD=/var/run/aesmd TEERACLE_INTERVAL_SECONDS=600 docker compose -f <(envsubst < docker-compose.yml) -f <(envsubst < demo-teeracle.yml) up demo-teeracle --exit-code-from demo-teeracle
...
 ✔ Container fd-integritee-node--1             Running                                                                                      0.0s 
 ✔ Container fd-integritee-teeracle-worker--1  Running                                                                                      0.0s 
Attaching to fd-demo-teeracle-1

in another terminal

docker logs fd-integritee-teeracle-worker--1 -f

this seems to work, but logs are misleading: see integritee-network/worker#1311

[brenzi]

fixed in docs