aws / aws/aws-nitro-enclaves-cli

Concurrent EIF builds result in multiple EIFs with the same content

Open
#515 2 comments 4 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
156
Forks
99
PR merge metrics
No merged PRs in 30d

Description

Hello,

We are setting up a dedicated VM that will create our EIF files as a step in our CI / CD pipelines.
Sometimes we have 2 builds that are triggered at the same time and when such a thing happens, 2 EIF files are getting created with the expected naming, however they are in fact the same EIF!

I have not seen anywhere in the doc that the `nitro-cli build-enclave` couldn't be used concurrently.

I have created this script to reproduce the issue:

```bash
#!/usr/bin/env bash

set -Cue -o pipefail

nitro-cli build-enclave \
--docker-uri nginx:1.25.1 \
--output-file nginx.eif &

nitro-cli build-enclave \
--docker-uri strm/helloworld-http:latest \
--output-file http.eif &

wait

echo "Done"
```

If you run the second EIF, like this: `sudo nitro-cli run-enclave --enclave-name http --memory 3072 --cpu-count 2 --debug-mode --eif-path http.eif`
You will see that it is in fact NGINX running after checking in the logs (`nitro-cli console`).

Is there any way to prevent this, other than preventing any concurrent runs?

Contributor guide

Open the contributing guide

Research direction

Start by running the supplied Bash script with the two `nitro-cli build-enclave` commands concurrently, then inspect the `build-enclave` implementation and related tests. Done means concurrent builds produce EIF files containing their respective Docker images, or the CLI clearly prevents unsupported concurrent execution.

Written by the indexing model from the issue text.

Assessment

Tech stack
bash, rust
Domain
build-system, cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.