aws / aws/aws-nitro-enclaves-cli

build-enclave ignores Dockerfile ENTRYPOINT when CMD is present

Open
#714 0 comments 3 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
156
Forks
99
PR merge metrics
No merged PRs in 30d

Description

In the following snippet:
https://github.com/aws/aws-nitro-enclaves-cli/blob/9758997756bb2fce060da7cb3b801f4698efb24c/enclave_build/src/docker.rs#L273-L282

The `nitro-cli` utility extracts the entrypoint of the resulting image being built.
It does so by:
1. Checking if a `CMD` command is present.
2. If not (and only in that case) it uses the `ENTRYPOINT` command.

This is incompatible with the Dockerfile reference (see [CMD](https://docs.docker.com/reference/dockerfile/#cmd) and [ENTRYPOINT](https://docs.docker.com/reference/dockerfile/#entrypoint) reference).

In particular it is stated that when an `ENTRYPOINT` is present, the `CMD` is merely set as a default set of arguments to the `ENTRYPOINT`.
For example:
> If the user specifies arguments to docker run then they will override the default specified in CMD, but still use the default ENTRYPOINT.

I think an expected behavior would be the equivalent of running `docker run` which is the concatenation of `ENTRYPOINT` (if present) with `CMD` (if present). If none exists, one should probably just run the default login shell.

Contributor guide

Open the contributing guide

Research direction

Start in enclave_build/src/docker.rs at lines 273-282 and trace how nitro-cli extracts the resulting image command during build-enclave. Compare the behavior with the Dockerfile CMD and ENTRYPOINT references; done means ENTRYPOINT and CMD are combined as docker run would, with a defined fallback when neither is present.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
cli, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.