aws / aws/aws-nitro-enclaves-cli
build-enclave ignores Dockerfile ENTRYPOINT when CMD is present
- Dominant language
- Rust
- Stars
- 156
- Forks
- 99
- PR merge metrics
- No merged PRs in 30d
Description
In the following snippet:
https://github.com/aws/aws-nitro-enclaves-cli/blob/9758997756bb2fce060da7cb3b801f4698efb24c/enclave_build/src/docker.rs#L273-L282
The `nitro-cli` utility extracts the entrypoint of the resulting image being built.
It does so by:
1. Checking if a `CMD` command is present.
2. If not (and only in that case) it uses the `ENTRYPOINT` command.
This is incompatible with the Dockerfile reference (see [CMD](https://docs.docker.com/reference/dockerfile/#cmd) and [ENTRYPOINT](https://docs.docker.com/reference/dockerfile/#entrypoint) reference).
In particular it is stated that when an `ENTRYPOINT` is present, the `CMD` is merely set as a default set of arguments to the `ENTRYPOINT`.
For example:
> If the user specifies arguments to docker run then they will override the default specified in CMD, but still use the default ENTRYPOINT.
I think an expected behavior would be the equivalent of running `docker run` which is the concatenation of `ENTRYPOINT` (if present) with `CMD` (if present). If none exists, one should probably just run the default login shell.
Contributor guide
Research direction
Start in enclave_build/src/docker.rs at lines 273-282 and trace how nitro-cli extracts the resulting image command during build-enclave. Compare the behavior with the Dockerfile CMD and ENTRYPOINT references; done means ENTRYPOINT and CMD are combined as docker run would, with a defined fallback when neither is present.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cli, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100