4. July 2022

[dimakuv]

[ People located in US were missing because of the Independence Day ]

Agenda

(please write your proposed agenda items in comments under this discussion)

• @vans163's proposal to send a machine for CI: 27. June 2022 #687 (reply in thread)
• Işıl Öz wrote to the mailing list and asks about working on device communication. Email: https://groups.google.com/d/msgid/gramine-users/5f4e58aa-be20-3a13-302e-133db4bdfa96%40iyte.edu.tr
• Sanitization of etc/ files, see RFC: Sanitization of /etc/ files #689
• GSC and the problem of "prepare the environment" ENTRYPOINT scripts. Case in point: Redis Docker image with its docker-entrypoint.sh.
• What to do about our website redesign (and how to avoid Wordpress). (Wasn't discussed)

@vans163's proposal to send a machine for CI

• Woju: we need to host this machine ourselves and thus need to ship it to either North Carolina or to Warsaw.
  • Regarding North Carolina placement: need to ask Don.
  • Regarding Warsaw placement: ITL could host this machine.
• No decision yet, waiting for opinions from @monavij and @donporter.

Mentoring new, potential contributors

• Noone from the people on today's call has a capacity (free time) to mentor new contributors.
• "Mentoring" is considered an additional task that takes a lot of time and energy, and will inevitably lead to de-prioritizing / revising existing, current tasks.
• Maybe people not on today's call would like to be mentors, in particular @donporter and @chiache.

Sanitization of etc/ runtime files

All discussion is reproduced here: #689 (comment)

GSC and "preparing the environment" ENTRYPOINT scripts

Problem: many Docker images have a special "prepare the environment then start the actual binary" scripts as the Docker-container ENTRYPOINT. Case in point: docker-entrypoint.sh of Redis.

If this Redis image is taken as the base, and GSC is used to build a "graminized" Docker image, then the final Docker image will try to start Gramine on this docker-entrypoint.sh script. Which will mean that Gramine will try to execute several admin tools, including find, chown, gosu and umask. Gramine was never designed for such administrative tasks, and some of these tasks are meaningless and have no side effects when executed by Gramine (leading to hard-to-diagnose failures afterwards), and some of these tasks simply terminate Gramine with an explicit error.

Two solutions proposed:

1. Dmitrii's solution: introduce a new command-line argument to GSC.
   • Something like gsc build --entrypoint=<gramine-overriding-entrypoint-script>.
   • This entrypoint replaces the original entrypoint. The user is responsible for providing a meaningful entrypoint script.
   • After discussion with maintainers, this solution is found unacceptably complicated and ad-hoc.
2. Borys's solution: write a Dockerfile to create an "intermediate" Docker image with a correct entrypoint.
   • Something like FROM redis; ENTRYPOINT ["./gramine-overriding-entrypoint.sh"].
   • The Docker build flow will have a new intermediate step (docker build --file intermediate-redis.dockerfile).
   • Nothing changes in the GSC build flow; only the original Docker image should be specified as the intermediate one.

Updates on GitHub development

6. Update on PRs, issues and tasks for a previous week:
   • (no time for this during the meeting, but my take on this is below)
   • Reorganization of the core repo is finished. Get used to the new file and function names.
   • Left-over PRs and small fixes are being merged after the "Big Sockets Rewrite", in particular:
     • [LibOS] Add support for SO_BROADCAST socket option #686
     • [PAL/Linux-SGX] Add ECONNRESET to errors allowed from ocall_recv #709
     • Support MSG_DONTWAIT flag in send syscall #723
   • Dummy implementation of the fadvise system call: [LibOS] Add fadvise64 syscall implementation #699
   • Discussion on the sanitization of /etc/ files: RFC: Sanitization of /etc/ files #689

[mkow]

• What to do about our website redesign (and how to avoid Wordpress)