Installing Xilinx ISE inside a Docker Container
Xilinx ISE WebPACK is a proprietary IDE that can be used for synthesis and analysis of VHDL designs.
This is a follow-up post from Sandboxing proprietary applications with Docker, so you might want to read this first.
ISE WebPACK can be downloaded at no charge from the URL below after you have signed up on the Xilinx website.
I have chosen to download ISE Design Suite - 14.7 Full Product Installation, Full Installer for Linux (TAR/GZIP - 6.09 GB). It’s quite a huge file so its a good idea to use some download manager like wget.
Instead of installing it directly on your host system we will install it into a Docker container that we have already prepared in the previous post.
To launch it just use the dockapp script with the -u option to make sure that the container has no network access:
[chris@thinkpad ~]$ dockapp run -u [chris@thinkpad ~]$ dockapp view
The dockapp script will mount /home/$USER/share/docker/ automatically as /share inside the docker container so that we can easily access the installation tarball Xilinx_ISE_DS_Lin_14.7_1015_1.tar:
root@58f422d5ae63:/# ls -l share/ total 6385388 -rw-rw-r--. 1 app app 5 Sep 4 15:40 Text File -rw-------. 1 app app 6538618880 Oct 18 2013 Xilinx_ISE_DS_Lin_14.7_1015_1.tar -rwxrwxr-x. 1 app app 1405 Sep 9 15:05 dockapp-start -rw-r--r--. 1 root root 5 Sep 7 14:19 test.txt root@58f422d5ae63:/#
Now we have two possibilities, install Xilinx ISE as root:
- The setup will make changes to the root file system and we should commit them to a new Docker image, see here how this works.
- The setup will be able to install Xilinx cable drivers
or install it it as unprivileged user:
From a security standpoint it should not make a huge difference since everything is running inside a container (at least in the future):
Recent improvements in Linux namespaces will soon allow to run full-featured containers without root privileges, thanks to the new user namespace. This is covered in detail here. Moreover, this will solve the problem caused by sharing filesystems between host and guest, since the user namespace allows users within containers (including the root user) to be mapped to other users in the host system. –https://docs.docker.com/articles/security/
Installing Xilinx cable drivers will fail, but probably I don’t need them and you can install them later or rerun the setup.
I will start with installing it as unprivileged user app:
root@58f422d5ae63:/# su app app@58f422d5ae63:/$ cd share/ app@58f422d5ae63:/share$ tar -xf Xilinx_ISE_DS_Lin_14.7_1015_1.tar app@58f422d5ae63:/share$ cd Xilinx_ISE_DS_Lin_14.7_1015_1 app@58f422d5ae63:/share/Xilinx_ISE_DS_Lin_14.7_1015_1$ ./xsetup
It’s not possible to disable Xilinx’s WebTalk feature during installation... But luckily for us we have already disabled the network connection for the Docker container^^
Enables WebTalk to send software, IP and device usage statistics to Xilinx. For more information on WebTalk, please see Section 13 of the Xilinx End-User License Agreement and the WebTalk FAQ at: http://www.xilinx.com/vivado/webtalk.
During the next steps be careful to install it under /share/Xilinx:
You can either rerun the setup as root or follow this article to manually install the Xilinx Programming Cable drivers: http://www.xilinx.com/support/answers/54381.htm.
So the installation is complete, just have a look at the install size, you don’t want to have something inside a virtual machine:
app@58f422d5ae63:/share/Xilinx_ISE_DS_Lin_14.7_1015_1$ du -hs /share 30G /share app@58f422d5ae63:/share/Xilinx_ISE_DS_Lin_14.7_1015_1$ du -hs /share/Xilinx 18G /share/Xilinx app@58f422d5ae63:/share/Xilinx_ISE_DS_Lin_14.7_1015_1$
Now we can test our new IDE, to start it you have to source the /share/Xilinx/14.7/ISE_DS/settings64.sh script and then run ise.
root@58f422d5ae63:/# vim share/ise root@58f422d5ae63:/# cat share/ise #!/bin/bash su app -c "source /share/Xilinx/14.7/ISE_DS/settings64.sh && ise" root@58f422d5ae63:/# ./share/ise
I was pleasantly surprised that everything went well and ISE launched successfully.
Get a license file
The first time you start Xilinx ISE it will greet you with a message “A license was not found for the ISE feature.”, lets get a license:
And save the file under /share/Xilinx_Connect_Later.html
Now open this file on the host, login to the Xilinx website and generate a license file.
You will get an email with a Xilinx.lic, save it under $HOME/share/docker and import it into ISE:
Now you should be able so safely close the VNC window and start it again with dockapp.
Since the home directory of the user app is a symlink to /share/home/app which is a shared folder you can also delete the Docker container dockapp and maybe start a new one with a higher resolution:
[chris@thinkpad ~]$ docker rm dockapp dockapp [chris@thinkpad ~]$ dockapp run -u -r 1280x1000x24 dockapp: creating the container and starting it -u '' -r '1280x1000x24' ddfe65051be1140b7de9bbd410cfded275f029e190d940317ba24573f1ee187c [chris@thinkpad ~]$ dockapp view &  12043 [chris@thinkpad ~]$ dockapp: running vncviewer Proto: RFB 003.008 Connected to RFB server, using protocol version 3.8 SelectSecurityType: sec-type 1 (rfbSecTypeNone) Security-Type: 1 (rfbSecTypeNone) Latency: 0.20 ms No VNC authentication needed VNC authentication succeeded (0) for rfbSecTypeNone (RFB 3.8) Desktop name "ddfe65051be1:1" VNC server default format: 32 bits per pixel. Least significant byte first in each pixel. True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0 Warning: Cannot convert string "-*-helvetica-medium-r-*-*-12-*-*-*-*-*-*-*" to type FontStruct Using default colormap which is TrueColor. Pixel format: 32 bits per pixel. Least significant byte first in each pixel. True colour: max red 255 green 255 blue 255, shift red 16 green 8 blue 0 geometry: 1280x1000+318+28 ycrop: 0 create_image() try_create_image: shm image create fail: image == NULL try_create_image: created *non-shm* image: 1280x1000 try_create_image: image->bytes_per_line: 5120 guessed: -compresslevel 1 guessed: -qualitylevel 9 enabling 'delay_sync' mode for faster local drawing, disable via env SSVNC_DELAY_SYNC=0 if there are painting errors. [chris@thinkpad ~]$
Now it’s time for a new project.