aws / aws/aws-nitro-enclaves-cli
Concurrent EIF builds result in multiple EIFs with the same content
- Dominant language
- Rust
- Stars
- 156
- Forks
- 99
- PR merge metrics
- No merged PRs in 30d
Description
Hello,
We are setting up a dedicated VM that will create our EIF files as a step in our CI / CD pipelines.
Sometimes we have 2 builds that are triggered at the same time and when such a thing happens, 2 EIF files are getting created with the expected naming, however they are in fact the same EIF!
I have not seen anywhere in the doc that the `nitro-cli build-enclave` couldn't be used concurrently.
I have created this script to reproduce the issue:
```bash
#!/usr/bin/env bash
set -Cue -o pipefail
nitro-cli build-enclave \
--docker-uri nginx:1.25.1 \
--output-file nginx.eif &
nitro-cli build-enclave \
--docker-uri strm/helloworld-http:latest \
--output-file http.eif &
wait
echo "Done"
```
If you run the second EIF, like this: `sudo nitro-cli run-enclave --enclave-name http --memory 3072 --cpu-count 2 --debug-mode --eif-path http.eif`
You will see that it is in fact NGINX running after checking in the logs (`nitro-cli console`).
Is there any way to prevent this, other than preventing any concurrent runs?
Contributor guide
Research direction
Start by running the supplied Bash script with the two `nitro-cli build-enclave` commands concurrently, then inspect the `build-enclave` implementation and related tests. Done means concurrent builds produce EIF files containing their respective Docker images, or the CLI clearly prevents unsupported concurrent execution.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- bash, rust
- Domain
- build-system, cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100