Skip to content

fix(kms): ship CA certificates in the KMS image #1128

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kvinwang merged 2 commits into from
Aug 25, 2026
Merged

fix(kms): ship CA certificates in the KMS image #1128

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bc6e443
fix(kms): ship CA certificates in the KMS image
kvinwang Aug 25, 2026
9887ff3
chore: register the KMS runtime package list with REUSE
kvinwang Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .github/workflows/docker-build-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,11 @@ jobs:
DSTACK_REV=${{ env.DSTACK_REV }}
DSTACK_SRC_URL=${{ env.DSTACK_SRC_URL }}

- name: Verify pinned packages
run: |
dstack/build/shared/verify-pinned-packages.sh dstack-kms-check:latest \
dstack/kms/dstack-app/builder/shared/pinned-packages.txt

- name: Build kms-builder target
run: |
docker buildx build \
Expand Down
13 changes: 13 additions & 0 deletions dstack/kms/dstack-app/builder/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,19 @@ RUN cd repo/dstack && cargo build --release -p dstack-kms --target x86_64-unknow
RUN echo "${DSTACK_REV}" > /build/.GIT_REV

FROM debian:bookworm@sha256:0d8498a0e9e6a60011df39aab78534cfe940785e7c59d19dfae1eb53ea59babe
COPY --from=build-shared /pin-packages.sh /build/
COPY ./shared/pinned-packages.txt /build/
WORKDIR /build
# reqwest is built against rustls-platform-verifier, which reads the system
# trust store and errors out when it finds none. The KMS builds its collateral
# and AMD KDS clients eagerly at startup, so a base image without CA
# certificates fails to boot before it serves anything.
RUN ./pin-packages.sh ./pinned-packages.txt && \
apt-get update && \
apt-get install -y --no-install-recommends \
ca-certificates \
&& rm -rf /var/lib/apt/lists/* /var/log/* /var/cache/ldconfig/aux-cache
WORKDIR /
COPY --from=kms-builder /build/repo/dstack/target/x86_64-unknown-linux-musl/release/dstack-kms /usr/local/bin/dstack-kms
COPY --from=kms-builder /build/.GIT_REV /etc/
CMD ["dstack-kms"]
3 changes: 2 additions & 1 deletion dstack/kms/dstack-app/builder/build-image.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,8 +30,9 @@ DSTACK_SRC_URL=${DSTACK_SRC_URL:-https://github.com/Dstack-TEE/dstack.git}
ensure_buildkit

touch "$SHARED_DIR/builder-pinned-packages.txt"
touch "$SHARED_DIR/pinned-packages.txt"

docker_build "$NAME" ""
docker_build "$NAME" "" "$SHARED_DIR/pinned-packages.txt"
docker_build "kms-builder-temp" "kms-builder" "$SHARED_DIR/builder-pinned-packages.txt"

check_clean_tree "$SHARED_DIR"
91 changes: 91 additions & 0 deletions dstack/kms/dstack-app/builder/shared/pinned-packages.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,91 @@
adduser=3.134
apt=2.6.1
base-files=12.4+deb12u11
base-passwd=3.6.1
bash=5.2.15-2+b8
bsdutils=1:2.38.1-5+deb12u3
ca-certificates=20230311+deb12u1
coreutils=9.1-1
dash=0.5.12-2
debconf=1.5.82
debian-archive-keyring=2023.3+deb12u2
debianutils=5.7-0.5~deb12u1
diffutils=1:3.8-4
dpkg=1.21.22
e2fsprogs=1.47.0-2
findutils=4.9.0-4
gcc-12-base:amd64=12.2.0-14+deb12u1
gpgv=2.2.40-1.1
grep=3.8-5
gzip=1.12-1
hostname=3.23+nmu1
init-system-helpers=1.65.2
libacl1:amd64=2.3.1-3
libapt-pkg6.0:amd64=2.6.1
libattr1:amd64=1:2.5.1-4
libaudit-common=1:3.0.9-1
libaudit1:amd64=1:3.0.9-1
libblkid1:amd64=2.38.1-5+deb12u3
libbz2-1.0:amd64=1.0.8-5+b1
libc-bin=2.36-9+deb12u10
libc6:amd64=2.36-9+deb12u10
libcap-ng0:amd64=0.8.3-1+b3
libcap2:amd64=1:2.66-4+deb12u1
libcom-err2:amd64=1.47.0-2
libcrypt1:amd64=1:4.4.33-2
libdb5.3:amd64=5.3.28+dfsg2-1
libdebconfclient0:amd64=0.270
libext2fs2:amd64=1.47.0-2
libffi8:amd64=3.4.4-1
libgcc-s1:amd64=12.2.0-14+deb12u1
libgcrypt20:amd64=1.10.1-3
libgmp10:amd64=2:6.2.1+dfsg1-1.1
libgnutls30:amd64=3.7.9-2+deb12u4
libgpg-error0:amd64=1.46-1
libhogweed6:amd64=3.8.1-2
libidn2-0:amd64=2.3.3-1+b1
liblz4-1:amd64=1.9.4-1
liblzma5:amd64=5.4.1-1
libmd0:amd64=1.0.4-2
libmount1:amd64=2.38.1-5+deb12u3
libnettle8:amd64=3.8.1-2
libp11-kit0:amd64=0.24.1-2
libpam-modules-bin=1.5.2-6+deb12u1
libpam-modules:amd64=1.5.2-6+deb12u1
libpam-runtime=1.5.2-6+deb12u1
libpam0g:amd64=1.5.2-6+deb12u1
libpcre2-8-0:amd64=10.42-1
libseccomp2:amd64=2.5.4-1+deb12u1
libselinux1:amd64=3.4-1+b6
libsemanage-common=3.4-1
libsemanage2:amd64=3.4-1+b5
libsepol2:amd64=3.4-2.1
libsmartcols1:amd64=2.38.1-5+deb12u3
libss2:amd64=1.47.0-2
libssl3:amd64=3.0.18-1~deb12u2
libstdc++6:amd64=12.2.0-14+deb12u1
libsystemd0:amd64=252.38-1~deb12u1
libtasn1-6:amd64=4.19.0-2+deb12u1
libtinfo6:amd64=6.4-4
libudev1:amd64=252.38-1~deb12u1
libunistring2:amd64=1.0-2
libuuid1:amd64=2.38.1-5+deb12u3
libxxhash0:amd64=0.8.1-1
libzstd1:amd64=1.5.4+dfsg2-5
login=1:4.13+dfsg1-1+deb12u1
logsave=1.47.0-2
mawk=1.3.4.20200120-3.1
mount=2.38.1-5+deb12u3
ncurses-base=6.4-4
ncurses-bin=6.4-4
openssl=3.0.18-1~deb12u2
passwd=1:4.13+dfsg1-1+deb12u1
perl-base=5.36.0-7+deb12u2
sed=4.9-1
sysvinit-utils=3.06-4
tar=1.34+dfsg-1.2+deb12u1
tzdata=2025b-0+deb12u1
usr-is-merged=37~deb12u1
util-linux-extra=2.38.1-5+deb12u3
util-linux=2.38.1-5+deb12u3
zlib1g:amd64=1:1.2.13.dfsg-1
Loading