daocloud / daochain

Docker image verification system based on Ethereum

DaoChain

DaoChain is a decentralized application (Dapp) based on Ethereum, dedicated to solving the trust issues during sharing and trading of the digital assets (including Docker images) on the Internet.

Why

The open Internet allows us to share data online so freely that it is unclear whether the data we got is maliciously tampered during data transmission. Although we could use RSA and PGP to guarantee the data credibility and security in peer-to-peer transmission on the internet, for most of time data is stored on public clouds. How to publish data and verify the data acquired in a convenient way become a problem.

Docker image distribution is a typical example of data dissemination via repository. The publisher builds an image on local machine, pushes the image to the remote repository，where other users can then pull the image. In this process, how to make sure that the image pulled is the original version released by publisher? How to make sure that there is no revision from hosting provider or in dissemination? How to mark the ownership of property?

Repository being hacked by hacker：

DaoChain is developed as a solution to these problems. By storing the information on a decentralized blockchain network, we can eliminate the possibility of the data being easily tampered in a centralized network. The offline signature and verification makes the data publishing and acquisition more convenient and secure.

How

Now you know the image is hacked：

The image publisher calculates the hash of the image on the local machine and then writes the message into the blockchain. The cryptography on the blockchain guarantees no forgery in this process, so publisher can safely share the image on public registry.

Image users can calculate the hash of the image they pulled from the public registry, and compare it with the hash that publisher stored in the blockchain. This can verify whether the image is identical to the original version from publisher.

Project Structure

We choose Ethereum among so many blockchain implements to build the DaoChain. The Ethereum is a public blockchain-based distributed computing platform that supports Smart Contract. It provides a decentralized virtual machine called Ethereum Virtual Machine (EVM) that can execute peer-to-peer contracts.

DaoChain consists of four parts:

• Smart Contract
• Ethereum Client
• Local Server & Client
• WebUI

Project Structure:

Smart Contract

DaoChain’s Smart Contract is written in solidity using truffle framework.

In the directory of contract/contracts, there are two smart contracts (Migrations.sol is for deploying contracts). Currently we are using DaoHubVerify.sol. The contract defines a data structure:

mapping(address => mapping(bytes => Image)) ownerIdImageMap;

Verification process：

The other smart contract, DaoHubAccount.sol, features functionality of mapping the account of Ethereum and image hosting provider. DaoChain will support this contract in the future version, to fully support the complete decentralization and the image offline verification.

Ethereum Client

DaoChain uses the official Ethereum client go-ethereum, and eth-net-intelligence-api for metrics collection.

Local Server

The Local server is written in Python and includes two parts:

• Local Server：running in the local container, communicating with Docker and Ethereum Client via Docker API and JSONRPC respectively, and providing the REST API to WebUI and CLI.
• Command-line tool：A CLI tool to use DaoChain（WIP）.

When the Docker image is pushed to Registry, a hash will be generated but the value will not change with image content. We calculate SHA256 hash of the tar file content saved with docker save, which only represents the certain image.

Note: the current algorithm is relatively low efficiency and will be improved in the future.

WebUI

DaoChain’s WebUI uses AngularJS and DaoStyle – a Angular component library by DaoCloud.

Goals

• Content Trust Verification
• Support Third-party Registry
• Image Trade
• Decentralized Registry

QuickStart

1. Clone the repo and run with docker-compose

   git clone https://github.com/DaoCloud/daochain.git
   cd daochain
   docker-compose up -d
   

2. Open WebUI (http://127.0.0.1:8000)

TODO

• Tests and Documentation
• Command-Line Tool
• Better Image Hashing
• Peer Discovery
• Offline Verifying

Contribution (Chinese)

Please refer to CONTRIBUTION.md

License

Apache License 2.0

daochain's Issues

What is the Roadmap of project dao-chain?

Hi, All,

I found that this project combines the most popular technology of the world, docker and blockchain.

Can you give us more details of the Roadmap of this Project?

Thanks a lot.

claim about image sha256 not true from docker v1.12

1.我的运行场景:

2.我的需求的具体情况（feature request || bug）:

3.重现该问题的步骤:
1.
2.
3.

4.描述您获得的实际情况:

The README.md states:

When the Docker image is pushed to Registry, a hash will be generated but the value will not change with image content. We calculate SHA256 hash of the tar file content saved with docker save, which only represents the certain image.

I think this statement is not true anymore for docker version from 1.12.

Since docker v1.12 the sha256 returned is the sha256 sum over the configuration object which contains the sha256 sums of each layer.
Layers are validated with downloaded.

5.描述您预期的情况:

Only the sha256 digest of the images needs to be linked to the image tag on the block chain.
Further more only a sha256 digest over the image digest and the address and the image tag need to be stored on the block chain.
If a verifier then wants to verify if the image is ok he can take the publisher address, image tag and the image digest and calculate the sha256 over that and look on the blockchain if it exists.

6.您认为的其他有价值的信息:

初始化输入钱包密码出现问题

Error: open /root/.ethereum/keystore/.UTC--2018-09-25T01-41-23.898028495Z--c6f52ae049c7c4b508d9d8eaef5bdc4202d6a5b5.tmp395584559: permission denied

Version plan and changelog request

Hi, All,

Does this project have a version plan and changelog release plan. I think both of two things make users know more details about project itself.

Thanks

初始化钱包后还是会经常弹出选择组织

钱包已经初始化了，也可以挖矿，如下图：

但是经常弹出下图：

这样是已经工作正常了，只是页面有bug，还是我初始化和加入组织的方法有问题？

Probably leaks too much metadata (who publishes images how often) to be acceptable.

Reddit 里面的问题
https://www.reddit.com/r/programming/comments/5jbfzx/make_docker_image_trustable_with_blockchain/

Unsupported config option for services service: 'geth'

Run:
$:docker-compose up -d

Question:
Unsupported config option for services service: 'geth'

INFO:
system:CoreOS
docker:version 1.11.2

Request:
是否还需要安装geth才能正常启动