Skip to content

Commit ceb3ef8

Browse files
AlyaGomaaAlyaGomaa
authored
Merge pull request #1434 from stratosphereips/alya/immune/make_dockerfile_compatible_with_rpi
immune: make dockerfile compatible with rpi
2 parents 389eba8 + 430d21c commit ceb3ef8

4 files changed

Lines changed: 112 additions & 71 deletions

File tree

‎.github/workflows/install-slips-dependencies.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,7 @@
11
name: Install Slips Dependencies
22

33
on:
4-
# workflow_call make this workflow re-usable
54
workflow_call:
6-
# these are like variables to make the workflow more clean
7-
# we can pass these variable from another workflows if we want
85
inputs:
96
zeek-repo-url:
107
description: 'Zeek repository URL'
@@ -25,6 +22,8 @@ on:
2522
jobs:
2623
install-dependencies:
2724
runs-on: ubuntu-22.04
25+
outputs:
26+
dependencies_installed: ${{ steps.mark_installed.outputs.installed }}
2827
steps:
2928
- uses: actions/checkout@v4
3029
with:
@@ -62,3 +61,7 @@ jobs:
6261
curl -fsSL ${{ inputs.zeek-key-url }} | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/security_zeek.gpg
6362
sudo apt update && sudo apt install -y --no-install-recommends zeek
6463
sudo ln -s /opt/zeek/bin/zeek /usr/local/bin/bro
64+
65+
- name: Mark dependencies as installed
66+
id: mark_installed
67+
run: echo "installed=true" >> $GITHUB_OUTPUT

‎.github/workflows/publish-slips-images.yml‎

Lines changed: 71 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -3,64 +3,85 @@ name: CI-production-publishing-slips-images
33
on:
44
push:
55
branches:
6-
- 'master'
7-
- '!develop'
6+
- 'master'
7+
- '!develop'
88

99
jobs:
10-
publish_slips_docker_image:
11-
# runs the tests in a docker(built by this job) on stop of a GH VM
12-
runs-on: ubuntu-20.04
10+
setup:
11+
runs-on: ubuntu-22.04
1312
# 2 hours timeout
14-
timeout-minutes: 7200
13+
timeout-minutes: 120
14+
outputs:
15+
slips_version: ${{ steps.get_version.outputs.slips_version }}
16+
builder_name: ${{ steps.create_builder.outputs.name }}
1517

1618
steps:
17-
- name: Get slips version
18-
run: |
19-
VER=$(curl -s https://raw.githubusercontent.com/stratosphereips/StratosphereLinuxIPS/develop/VERSION)
20-
echo "SLIPS_VERSION=$VER" >> $GITHUB_ENV
19+
- name: Get slips version
20+
id: get_version
21+
run: |
22+
ver=$(curl -s https://raw.githubusercontent.com/stratosphereips/StratosphereLinuxIPS/develop/VERSION)
23+
echo "slips_version=$ver" >> $GITHUB_OUTPUT
2124
22-
# clone slips and checkout branch
23-
# By default it checks out only one commit
24-
- uses: actions/checkout@v4
25-
with:
26-
ref: 'master'
27-
# Fetch all history for all tags and branches
28-
fetch-depth: ''
29-
# submodules are needed for local and global p2p
30-
submodules: true
25+
# should come before buildx action
26+
- name: Set up QEMU
27+
uses: docker/setup-qemu-action@v3
3128

29+
# Set up Docker Buildx with docker-container driver is required
30+
# at the moment to be able to use a subdirectory with Git context
31+
- name: Create and use Buildx builder
32+
id: create_builder
33+
uses: docker/setup-buildx-action@v3
34+
with:
35+
driver: docker-container # allows multi-platform builds
36+
# allows you to enable special permissions for the build environment that are normally considered insecure,
37+
# such as:network.host
38+
buildkitd-flags: --allow-insecure-entitlement network.host
39+
name: slips_multi_arch_builder
40+
use: true
3241

33-
- name: Login to DockerHub
34-
uses: docker/login-action@v3
35-
with:
36-
username: stratosphereips
37-
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
42+
publish_images:
43+
needs: setup
44+
runs-on: ubuntu-22.04
45+
strategy:
46+
matrix:
47+
image_type:
48+
- name: slips
49+
dockerfile: ./docker/Dockerfile
50+
- name: slips_light
51+
dockerfile: ./docker/light/Dockerfile
3852

39-
# Set up Docker Buildx with docker-container driver is required
40-
# at the moment to be able to use a subdirectory with Git context
41-
- name: Set up Docker Buildx
42-
uses: docker/setup-buildx-action@v3
53+
steps:
54+
- name: Use existing Buildx builder
55+
uses: docker/setup-buildx-action@v3
56+
with:
57+
name: slips_multi_arch_builder
58+
install: true
59+
use: true
60+
61+
# clone slips and checkout branch
62+
# By default it checks out only one commit
63+
- uses: actions/checkout@v4
64+
with:
65+
ref: 'master'
66+
# Fetch all history for all tags and branches
67+
fetch-depth: 0
68+
# submodules are needed for local and global p2p
69+
submodules: true
4370

44-
- name: Build and push the main Slips image
45-
id: docker_build_slips
46-
uses: docker/build-push-action@v6
47-
with:
48-
allow: network.host
49-
context: ./
50-
file: ./docker/Dockerfile
51-
tags: |
52-
stratosphereips/slips:latest
53-
stratosphereips/slips:${{ env.SLIPS_VERSION }}
54-
push: true
71+
- name: Login to DockerHub
72+
uses: docker/login-action@v3
73+
with:
74+
username: stratosphereips
75+
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
5576

56-
- name: Build and push the light Slips image
57-
id: docker_build_light_slips
58-
uses: docker/build-push-action@v6
59-
with:
60-
allow: network.host
61-
context: ./
62-
file: ./docker/light/Dockerfile
63-
tags: |
64-
stratosphereips/slips_light:latest
65-
stratosphereips/slips_light:${{ env.SLIPS_VERSION }}
66-
push: true
77+
- name: Build and push ${{ matrix.image_type.name }} image
78+
uses: docker/build-push-action@v6
79+
with:
80+
allow: network.host
81+
context: ./
82+
file: ${{ matrix.image_type.dockerfile }}
83+
platforms: linux/amd64,linux/arm64
84+
tags: |
85+
stratosphereips/${{ matrix.image_type.name }}:latest
86+
stratosphereips/${{ matrix.image_type.name }}:${{ needs.setup.outputs.slips_version }}
87+
push: true

‎.github/workflows/unit-tests.yml‎

Lines changed: 22 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,19 +6,16 @@ on:
66
- 'master'
77
- 'develop'
88

9-
109
jobs:
1110
# uses the common workflow that builds slips
1211
install-dependencies-using-reusable-workflow:
1312
uses: ./.github/workflows/install-slips-dependencies.yml
1413

1514
unit-tests:
1615
runs-on: ubuntu-22.04
17-
timeout-minutes: 1800
18-
# make this job depend on the first job
16+
timeout-minutes: 120
1917
needs: install-dependencies-using-reusable-workflow
2018

21-
# suppress tensorflow warnings
2219
env:
2320
TF_CPP_MIN_LOG_LEVEL: 3
2421
TF_ENABLE_ONEDNN_OPTS: 0
@@ -93,8 +90,12 @@ jobs:
9390
- uses: actions/checkout@v4
9491
with:
9592
ref: ${{ github.ref }}
96-
fetch-depth: ''
93+
fetch-depth: 0
9794

95+
- name: Set up Python
96+
uses: actions/setup-python@v5
97+
with:
98+
python-version: 3.10.12
9899

99100
- name: Restore APT cache
100101
id: apt-cache
@@ -106,20 +107,29 @@ jobs:
106107
key: apt-cache
107108

108109
- if: ${{ steps.apt-cache.outputs.cache-hit == 'true' }}
109-
name: Echo restored from cache
110+
name: Echo restored APT cache
110111
continue-on-error: true
111112
run: echo "Restored APT dependencies from cache successfully"
112113

113-
- name: Install Python dependencies (from cache if possible)
114-
run: |
115-
python3 -m pip install --upgrade pip
116-
python3 -m pip install -r install/requirements.txt
117-
118-
- name: Install apt dependencies (from cache if possible)
114+
- name: Install apt dependencies
119115
run: |
120116
sudo apt-get update
121117
sudo apt-get install -y $(cat install/apt_dependencies.txt)
122118
119+
- name: Restore Python dependencies
120+
id: python-cache
121+
uses: actions/cache@v4
122+
with:
123+
path: ~/.cache/pip
124+
key: ${{ runner.os }}-pip-${{ hashFiles('install/requirements.txt') }}
125+
126+
- if: ${{ steps.python-cache.outputs.cache-hit == 'true' }}
127+
name: Echo restored Python cache
128+
continue-on-error: true
129+
run: echo "Restored Python dependencies from cache successfully"
130+
131+
- name: Install Python dependencies
132+
run: python3 -m pip install -r install/requirements.txt
123133

124134
- name: Start redis server
125135
run: redis-server --daemonize yes

‎docker/Dockerfile‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -56,14 +56,14 @@ RUN apt update && apt install -y --no-install-recommends \
5656
python3-dev \
5757
python3-tzlocal \
5858
python3-pip \
59+
nano \
60+
tree \
61+
tmux \
5962
&& echo 'deb http://download.opensuse.org/repositories/security:/zeek/xUbuntu_22.04/ /' | tee /etc/apt/sources.list.d/security:zeek.list \
6063
&& curl -fsSL https://download.opensuse.org/repositories/security:zeek/xUbuntu_22.04/Release.key | gpg --dearmor | tee /etc/apt/trusted.gpg.d/security_zeek.gpg > /dev/null \
61-
&& curl -fsSL https://packages.redis.io/gpg | gpg --dearmor -o /usr/share/keyrings/redis-archive-keyring.gpg \
62-
&& echo "deb [signed-by=/usr/share/keyrings/redis-archive-keyring.gpg] https://packages.redis.io/deb $(lsb_release -cs) main" > /etc/apt/sources.list.d/redis.list \
6364
&& apt update \
6465
&& apt install -y --no-install-recommends --fix-missing \
6566
zeek \
66-
redis \
6767
npm \
6868
&& ln -s /opt/zeek/bin/zeek /usr/local/bin/bro \
6969
&& apt clean \
@@ -73,8 +73,16 @@ RUN apt update && apt install -y --no-install-recommends \
7373
&& [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" \
7474
&& nvm install 22
7575

76+
# why are we compiling redis instead od just using apt?
77+
# to support running slips on the rpi (arm64). the rpi uses jemmalloc by default, which expects a different page size
78+
# than the default on x86_64
79+
RUN pip3 install --no-cache-dir --upgrade pip \
80+
&& git clone https://github.com/redis/redis \
81+
&& cd redis \
82+
&& make distclean \
83+
&& make MALLOC=libc \
84+
&& ENV PATH="$PATH:/redis/src"
7685

77-
RUN pip3 install --no-cache-dir --upgrade pip
7886

7987
# Switch to Slips installation dir on login.
8088
WORKDIR ${SLIPS_DIR}
@@ -96,8 +104,7 @@ RUN pip install --ignore-installed --no-cache-dir -r install/requirements.txt \
96104
# build the pigeon and add pigeon to path
97105
RUN cd p2p4slips \
98106
&& go build \
99-
&& export PATH="{$PATH}:/StratosphereLinuxIPS/p2p4slips/";
100-
107+
&& ENV PATH="$PATH:/StratosphereLinuxIPS/p2p4slips/"
101108

102109

103110
WORKDIR ${SLIPS_DIR}

0 commit comments

Comments
 (0)