search

aws / aws-nitro-enclaves-cli

Tooling for Nitro Enclave Management
Apache License 2.0
121 stars 81 forks source link

Sample command executor fails to build enclave #364

Closed xparticle closed 2 years ago

xparticle commented 2 years ago

Running this command from the readme:

nitro-cli build-enclave --docker-dir "./resources" --docker-uri mytag --output-file command-executer.eif

throws an error

Docker error: BuildError
[ E49 ] Docker image build error. Such error appears when trying to build and EIF file, but building the corresponding docker image fails. In this case, the error backtrace provides detailed information on the failure reason.

Looking at the Docker file, it expects the command-executor file in current directory for the COPY command, but from the cargo build it is available in the target/release folder? Is this step assuming both Docker file and command-executor binary are moved to the same folder and then the build-enclave command issued?

FROM ubuntu:latest
  COPY command-executer .
  RUN apt-get update && apt-get install -y \
      apt-utils
  CMD ./command-executer listen --port 5005
eugkoira commented 2 years ago

Even when command-executer is coppied to resources directory it fails:

[nitro-cli:21296][ERROR][2022-03-23T16:57:54.404Z][enclave_build/src/docker.rs:259] IO(Custom { kind: Other, error: "paths in archives must be relative when setting path for " })

This is related to recent changes in blobs folder: https://github.com/aws/aws-nitro-enclaves-cli/pull/361 All the blobs are replaced with symlinks to the root blobs and shiplift fails to build an image from location with symlinks. Potentially it's an issue with shiplift's dependency - tarball crate - https://github.com/softprops/shiplift/blob/e883152bb3b6873f4666c468194730ebbf3dac72/src/image.rs#L123.

We need to change the documentation to use predefined make target instead to build command-executer - https://github.com/aws/aws-nitro-enclaves-cli/blob/main/Makefile#L202

eugkoira commented 2 years ago

Documentation is adjusted to use root Makefile instead.