aws / aws/aws-nitro-enclaves-cli

Build enclave image without Docker daemon from local docker archive

Open
#235 22 comments 8 reactions 1 assignee Claimed by @eugkoira View on GitHub
enhancement
Dominant language
Rust
Stars
156
Forks
99
PR merge metrics
No merged PRs in 30d

Description

### What
Right now, you need a running Docker daemon to build an enclave image. The LinuxKit version currently included attempts to pull the image using the Docker daemon. https://github.com/linuxkit/linuxkit/pull/3573 now lets LinuxKit pull the images directly without the need for a Docker daemon.

### Why
As part of our enclave support, we ([M10 Networks](https://m10.io)) want to be able to build enclave images entirely in a Dockerfile. We distribute all of our services through Docker images, and all of the builds are entirely performed inside of Dockerfiles. While possible to change this for Nitro, I don't think it should be necessary with a simple change.

### How
To supply this functionality, more or less out of the box, all that would be required would be to update the included LinuxKit to one of the latest builds. This would then allow users to use [skopeo](https://github.com/containers/skopeo), or a similar tool, to transfer their local image into LinuxKit's cache located at `~/.linuxkit/cache` themselves.

A more user-friendly follow on would be to allow the users to simply pass in a path to their own Docker image archive. At that point, the CLI would need to copy the image into the LinuxKit cache.

As a temporary workaround for our use case, I can simply replace the LinuxKit binary in `/usr/share/nitro_enclaves/blobs` with my own. I think this use case is common enough that it should either be supported through easier means or documented in some way

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.