How to run verify-build in a containerized application

Smart Contracts
1

I’m working on extending smart contract functionality in ccdexplorer.io to include module verification and have this working on a dev machine (M1 Mac).
However, packaging up the application to run containerized, leads to issues.

I’m verifying module c14efbca1dcf314c73cc294cbbf1bd63e3906b20d35442943eb92f52e383fc38 (the election contract), which I know is verifiable.

The cargo concordium verify-build command apparently starts a docker container (for this contract its docker.io/concordium/verifiable-sc:1.70.0) and tries to build the contract.

Again, this works locally (result can be seen in the explorer here: CCDExplorer.io: The most comprehensive explorer for the Concordium blockchain.). Scroll down to see verification results and source code.

I’m running the containerized version using:

...
privileged: true
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock

And this enables the container to start a container in the container.
However, this leads to the following error:
/artifacts/archive.tar: Cannot open: No such file or directory

I believe here the archive gets built, and here is mention of archive.tar, but I’m entirely unsure what is happening here.

Any pointers on getting verify-build running in a containerized application?

2

I think the problem is that the verify-build command is starting a docker container and mounting the directory that should contain the archive.tar. (Specifically, it’s calling docker run -v /some/temp/dir:/artifacts ...) I think what happens is that it will mount /some/temp/dir from the host, rather than from container that verify-build is running in. (This is based on my reading of this.)

Given this, here is a way I think you could get it to work:

  1. On the host, set up a directory that we’re going to use for the verify-build container’s temporary directory. Let’s say it’s /vbtmp.
  2. When running the verify-build container, mount /vbtmp:/vbtmp. It is important that the path is the same for both the host and the container.
  3. Also for the verify-build container, set the environment variable TMPDIR to /vbtmp.

The idea is that now the verify-build command will call docker run -v /vbtmp/tmpdir:/artifacts ..., and because /vbtmp inside the container is mapped to /vbtmp on the host, this will actually correctly mount the volume and it should be able to find archive.tar.

I haven’t tried this myself, so your mileage may vary.

1 Like
3

That…

Worked?

Wow…thank you.

For posterity:

privileged: true
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /vbtmp:/vbtmp
    env_file:
    - stack.env
    environment:
    - TMPDIR=/vbtmp
1 Like