aws / aws/aws-nitro-enclaves-cli
Build enclave image without Docker daemon from local docker archive
- Dominant language
- Rust
- Stars
- 156
- Forks
- 99
- PR merge metrics
- No merged PRs in 30d
Description
### What
Right now, you need a running Docker daemon to build an enclave image. The LinuxKit version currently included attempts to pull the image using the Docker daemon. https://github.com/linuxkit/linuxkit/pull/3573 now lets LinuxKit pull the images directly without the need for a Docker daemon.
### Why
As part of our enclave support, we ([M10 Networks](https://m10.io)) want to be able to build enclave images entirely in a Dockerfile. We distribute all of our services through Docker images, and all of the builds are entirely performed inside of Dockerfiles. While possible to change this for Nitro, I don't think it should be necessary with a simple change.
### How
To supply this functionality, more or less out of the box, all that would be required would be to update the included LinuxKit to one of the latest builds. This would then allow users to use [skopeo](https://github.com/containers/skopeo), or a similar tool, to transfer their local image into LinuxKit's cache located at `~/.linuxkit/cache` themselves.
A more user-friendly follow on would be to allow the users to simply pass in a path to their own Docker image archive. At that point, the CLI would need to copy the image into the LinuxKit cache.
As a temporary workaround for our use case, I can simply replace the LinuxKit binary in `/usr/share/nitro_enclaves/blobs` with my own. I think this use case is common enough that it should either be supported through easier means or documented in some way
Contributor guide
Assessment
This issue has not been assessed yet.