Open abhinit opened 2 years ago
We set a working directory for CMD
execution to a rootfs
root folder (https://github.com/aws/aws-nitro-enclaves-sdk-bootstrap/blob/main/init/init.c#L428). That basically means root of the enclave file system. In this case your relative path should be valid from /
.
WORKDIR
dockerfile directive is unfortunately not yet handled when building enclaves. But it sounds like a good proposal, we will add it to our TODO list!
@abhinit What was the OS (which release of Ubuntu/Amazon Linux? or something else?) of the instance on which you were building the enclave docker image? I see that bionic is used as the base for the enclave.
The issue I am facing is that I can only run an enclave image (eif) on Ubuntu 18.04 ec2 instance when I use Alpine linux as the base for the enclave docker file. I was wondering if I could use Ubuntu bionic as the base for the enclave docker file as you did (FROM ubuntu:bionic
).
@shamiek I used ubuntu bionic. You can find the docker template here. But I moved to Amazon Linux 2 later to support KMS (and other) libraries.
Thanks a ton. This is helpful. It is promising to know that bionic ec2 parent instances can run nitro docker images based on bionic. I will double check the nitro installation/configuration on my bionic ec2 instance which for some reason (maybe kernel version or something in my Dockerfile like you experienced with WORKDIR
) can only ever run nitro docker images based on Alpine linux. I will then run your example.
Hello, I am facing the same issue, I am using the Amazon Linux 2 and mentioning the full path in the Dockerfile, yet it still does not seem to work
I have a dockerfile with a relative path in the CMD:
or
An enclave created using
enclave-run
command is created and terminated immediately due to (a possible) missing socket connection./run/nitro_enclaves/
has no.sock
file.The complete log is as follows:
It succeeds if I use an absolute path in the dockerfile CMD:
Recreating the error:
Dockerfile:
server.py:
Build image
docker build ./ -t d3_error
Build enclave imagenitro-cli build-enclave --docker-uri d3_error:latest --output-file ./d3_error.eif
Run enclave:nitro-cli run-enclave --cpu-count 2 --memory 1024 --eif-path ./d3_error.eif --debug-mode --enclave-cid 17
Describe enclavesnitro-cli describe-enclaves
returns[]
Just to add, docker run succeeds
docker run -i -t --name d3_error_c d3_error:latest