aws / aws-nitro-enclaves-sdk-c

This repo provides a C API for AWS Nitro Enclaves, including a KMS SDK that integrates it with attestation.
Apache License 2.0
99 stars 74 forks source link

stumped - can't run kmstool_enclave_cli in Docker container #97

Closed aceeric closed 1 year ago

aceeric commented 1 year ago

I'm experimenting with Enclaves. I have a Python HTTP server and I'm trying to modify it to exec kmstool_enclave_cli to perform attestation as a precursor to serving an API from an Enclave. I build the CLI per this guidance. Then I build my Python image with this Dockerfile:

FROM python:3.7.9-alpine3.12

COPY http-server.py .
COPY libnsm.so /usr/lib64/
COPY kmstool_enclave_cli .

CMD ["/usr/local/bin/python3", "http-server.py", "VSOCK", "42"]

I follow the steps to build an enclave etc. The Python HTTP server execs the CLI per the guidance with subprocess.Popen and fails: /kmstool_enclave_cli: not found

If I run the image directly outside of the Enclave I get the same thing:

docker run --rm -it http-server sh

Inside the container:

/ # ls -l /kmstool_enclave_cli
-rwxr-xr-x    1 root     root       6962656 Jan  3 18:16 /kmstool_enclave_cli
/ # /kmstool_enclave_cli
sh: /kmstool_enclave_cli: not found

Almost certainly it has to do with the Alpine Python base image but - I'm so far stumped as to how to resolve. Any help is appreciated. Thanks.

aceeric commented 1 year ago

Indeed it is Alpine. What's initially confusing is the message indicates the inability to find a required shared library, as evidenced by the ldd command. Possibly with the proper apk add statements, Alpine could be made to work but I'm abandoning it in favor of another base image.