aws / aws/aws-nitro-enclaves-cli

Multiple run-enclave calls fail when called simultaneously

Open
#516 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
156
Forks
99
PR merge metrics
No merged PRs in 30d

Description

When trying to make multiple `nitro-cli run-enclave` commands simultaneously, I've found only one will succeed.

To reproduce, run the following command, substituting your EIF path:

```
nitro-cli run-enclave --cpu-count 2 --memory 2048 --eif-path "/path/to/your/app.eif" & nitro-cli run-enclave --cpu-count 2 --memory 2048 --eif-path "/path/to/your/app.eif"
```

The result is only one of the enclaves running, while any additional ones fail with E36/E39 errors:

```
Start allocating memory...
Start allocating memory...
[ E36 ] Enclave boot failure. Such error appears when attempting to receive the `ready` signal from a freshly booted enclave. It arises in several contexts, for instance, when the enclave is booted from an invalid EIF file and the enclave process immediately exits, failing to submit the `ready` signal. In this case, the error backtrace provides detailed information on what specifically failed during the enclave boot process.

For more details, please visit https://docs.aws.amazon.com/enclaves/latest/user/cli-errors.html#E36

If you open a support ticket, please provide the error log found at "/var/log/nitro_enclaves/err2023-07-25T17:09:51.827350506+00:00.log"
Failed connections: 1
[ E39 ] Enclave process connection failure. Such error appears when the enclave manager fails to connect to at least one enclave process for retrieving the description information.

For more details, please visit https://docs.aws.amazon.com/enclaves/latest/user/cli-errors.html#E39

If you open a support ticket, please provide the error log found at "/var/log/nitro_enclaves/err2023-07-25T17:09:51.827768135+00:00.log"
Started enclave with enclave-cid: 109, memory: 2048 MiB, cpu-ids: [1, 9]
{
"EnclaveName": "app",
"EnclaveID": "i-04f29a3d3b079a4b8-enc1898e075143e130",
"ProcessID": 499098,
"EnclaveCID": 109,
"NumberOfCPUs": 2,
"CPUIDs": [
1,
9
],
"MemoryMiB": 2048
}
```

Is this expected behaviour? I wasn't able to find any mention of this limitation in the [documentation](https://docs.aws.amazon.com/enclaves/latest/user/cmd-nitro-run-enclave.html).

The real use-case where I'm running into simultaneous enclave runs is via a `docker compose up` command which results in multiple Docker containers trying to start an enclave.

Contributor guide

Open the contributing guide

Research direction

The reported entry point is `nitro-cli run-enclave`; reproduce the concurrent command and trace how simultaneous enclave startup produces the E36/E39 output. Done means the supported behavior is established and the CLI or documentation reflects the result, with the Docker Compose case covered if it is in scope.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, docker-compose, rust
Domain
cli, devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.