Feature: Move from static binaries

[SammyOina]

Is your feature request related to a problem? Please describe.

Python compiled binaries are quite large and tedious to compile

Describe the feature you are requesting, as well as the possible use case(s) for it.

Allow users to bring their dependencies through a requirements file, install the requirements before running the algorithm.

Indicate the importance of this feature to you.

Must-have

Anything else?

No response

[SammyOina]

The requirements can be part of the algo request on grpc to agent and will be optional and I don't think we need to declare them on manifest

[SammyOina]

Non-python dependencies will need to be either pre-installed on the EOS image or we'll need a package manager in EOS. What do you think @danko-miladinovic

[SammyOina]

Manager could also theoretically have multiple images and allow user to select which image to use to run the given computations and each image can have it's preinstalled dependencies

[danko-miladinovic]

I agree. We can have multiple images, taylored for different purposes. I will look if there is a Buildroot package manager.

[SammyOina]

Another proposal is to use containers and have a container runtime in the vm. We can a conainer runtime like docker. The data can be still sent back via unix socket and we'll need to mount the volume to the container. typical flow can be:

• container pulled by agent or sent to agent
• agent starts unix socket
• agent starts container and mounts socket path
• results returned on socket
• agent reports results

[SammyOina]

for the lin_reg example I wrote this docker script

# Use the official Python image as the base image
FROM python:3.9-slim

# Set the working directory in the container
WORKDIR /app

# Copy the Python script to the container
COPY lin_reg.py .

# Install required Python packages
RUN pip install joblib pandas scikit-learn

# Set the entry point to start a shell
CMD ["sh"]

the resulting image is 540 mb which is a bit large

docker images |grep iris                                                      ✔ 
iris-classifier                                       latest          13497ca01bad   3 minutes ago   540MB

[SammyOina]

with multistage builds and using alpine the image goes down to 409mb which is larger than compiled binary (86mb)

docker images |grep iris                                               ✔  13m 13s  
iris-classifier                                       latest          b0a0a6d6106e   2 minutes ago   409MB

# Use the official Python image as the base image
FROM python:3.9-alpine as base

FROM python:3.9-slim as builder

# Set the working directory in the container
WORKDIR /app

# Install required Python packages
RUN pip install joblib pandas scikit-learn

FROM base

COPY --from=builder /app /usr/local

WORKDIR /app

# Copy the Python script to the container
COPY lin_reg.py .

# Set the entry point to start a shell
CMD ["sh"]

[dborovcanin]

Dropping support for static binaries will not benefit us. We should put this on hold and explore confidential containers first - since we are already treating our VM more like a container than the VM.

[danko-miladinovic]

I like the idea with Docker. The computation manifest will need to have the hash of the Docker image so that the Agent can confirm that the image that is being loaded is the expected one. Also, the host_data field of the Attestation report needs to be hold the hash of the computation manifest so it the users can verfy the image that is being used during remote attestation.

I also like the ide for us to use confidential containers. I would like to look into them.