Dockerfile.full-service-with-build

# syntax=docker/dockerfile:1.2
# Copyright (c) 2018-2022 The MobileCoin Foundation
#
# full-service application docker container.
#
# Full Build - This container will do a full compile and create a minimal runtime image.

# This build requires BuildKit

# To build testnet
#   DOCKER_BUILDKIT=1 docker build -t mobilecoin/full-service:0.0.0-testnet \
#   --progress=plain --build-arg NAMESPACE=test --build-arg BUILD_OPTS=--no-default-features .

# To build mainnet
#   DOCKER_BUILDKIT=1 docker build -t mobilecoin/full-service:0.0.0 \
#   --progress=plain --build-arg NAMESPACE=prod .

# Build Args:
# BUILD_OPTS: - '--no-default-features' - Additonal options to cargo build command
# NAMESPACE: - test|prod - specifies enclave.css files to download.
# SGX_MODE: - HW|SW - See README
# IAS_MODE: - PROD|DEV - See README
# RUSTFLAGS: - '-C target-cpu=penryn' - RUSTFLAGS Environment Variable
# SIGNED_ENCLAVE_BASE: - enclave-distribution.${NAMESPACE}.mobilecoin.com - base domain for CSS files.
# SIGSTRUCT_JSON_LOCATION: - production.json - Json file where CSS file paths are located.

# IMPORTANT: Do not add or update OS packages or components in the builder section.
# In order to create a consistent and verifiable the build environment, only add
# or update in the mobilecoin/rust-sgx-base image and refer to the image by its hash.

FROM mobilecoin/rust-sgx-base:v0.0.23 as builder

ARG NAMESPACE=test
ARG SIGNED_ENCLAVE_BASE=enclave-distribution.${NAMESPACE}.mobilecoin.com
ARG SIGSTRUCT_JSON_LOCATION=production.json

ENV INGEST_ENCLAVE_CSS=/app/ingest-enclave.css
ENV CONSENSUS_ENCLAVE_CSS=/app/consensus-enclave.css

WORKDIR /app

ADD https://${SIGNED_ENCLAVE_BASE}/${SIGSTRUCT_JSON_LOCATION} /app/${SIGSTRUCT_JSON_LOCATION}

# Get enclave sigstruct
RUN  export CONSENSUS_CSS_URL=$(cat /app/${SIGSTRUCT_JSON_LOCATION} | jq -r .consensus.sigstruct) \
  && export INGEST_CSS_URL=$(cat /app/${SIGSTRUCT_JSON_LOCATION} | jq -r .ingest.sigstruct) \
  && curl https://${SIGNED_ENCLAVE_BASE}/${CONSENSUS_CSS_URL} -o ${CONSENSUS_ENCLAVE_CSS} \
  && curl https://${SIGNED_ENCLAVE_BASE}/${INGEST_CSS_URL} -o ${INGEST_ENCLAVE_CSS}

COPY . /app/

ARG BUILD_OPTS
ARG SGX_MODE=HW
ARG IAS_MODE=PROD
ARG RUSTFLAGS

# Build full-service
RUN  --mount=type=cache,target=/opt/cargo/git \
     --mount=type=cache,target=/opt/cargo/registry/index \
     --mount=type=cache,target=/opt/cargo/registry/cache \
     --mount=type=cache,target=/app/target \
     cargo build --locked --release ${BUILD_OPTS}

RUN cp /app/target/release/full-service /usr/local/bin/
RUN cp /app/target/release/transaction-signer /usr/local/bin/
RUN cp /app/target/release/validator-service /usr/local/bin/
RUN cp /app/target/release/wallet-service-mirror-private /usr/local/bin/
RUN cp /app/target/release/wallet-service-mirror-public /usr/local/bin/
RUN cp /app/target/release/generate-rsa-keypair /usr/local/bin/

# This is the runtime container.
# Adding/updating OS will not affect the ability to verify the build environment.
FROM ubuntu:focal-20221019

RUN  addgroup --system --gid 1000 app \
  && adduser --system --ingroup app --uid 1000 app \
  && mkdir -p /data/ledger \
  && mkdir -p /data/wallet \
  && chown -R app:app /data

RUN  apt-get update \
  && apt-get upgrade -y \
  && apt-get install -y ca-certificates \
  && apt-get clean \
  && rm -r /var/lib/apt/lists \
  && mkdir -p /usr/share/grpc \
  && ln -s /etc/ssl/certs/ca-certificates.crt /usr/share/grpc/roots.pem

COPY --from=builder /usr/local/bin/full-service /usr/local/bin/
COPY --from=builder /usr/local/bin/transaction-signer /usr/local/bin/
COPY --from=builder /usr/local/bin/validator-service /usr/local/bin/
COPY --from=builder /usr/local/bin/wallet-service-mirror-private /usr/local/bin/
COPY --from=builder /usr/local/bin/wallet-service-mirror-public /usr/local/bin/
COPY --from=builder /usr/local/bin/generate-rsa-keypair /usr/local/bin/
COPY --from=builder /app/*.css /usr/local/bin/
COPY .internal-ci/docker/entrypoints/full-service.sh /usr/local/bin/entrypoint.sh

USER app
VOLUME /data
EXPOSE 9090

ENV RUST_LOG=info,rustls=warn,hyper=warn,tokio_reactor=warn,mio=warn,want=warn,rusoto_core=error,h2=error,reqwest=error,rocket=error,<unknown>=error
ENV MC_LEDGER_DB=/data/ledger
ENV MC_WALLET_DB=/data/wallet/wallet.db
ENV MC_FOG_INGEST_ENCLAVE_CSS=/usr/local/bin/ingest-enclave.css
ENV MC_LISTEN_HOST=0.0.0.0
ENV MC_LISTEN_PORT=9090

ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

CMD [ "/usr/local/bin/full-service" ]