intel / intel/confidential-computing.sgx

Allow to skip AESM service install

Open
#395 9 comments 4 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
1.5k
Forks
565
PR merge metrics
No merged PRs in 30d

Description

My goal is to build a Docker image where the following libraries get installed during the build: libsgx_urts.so, libsgx_enclave_common.so, libsgx_dcap_ql.so.

This is prevented by the following checks:
https://github.com/intel/linux-sgx/blob/734513886f83caff1d7e93263ba4c946fa5aa927/linux/installer/common/libsgx-enclave-common/install.sh#L95-L99

https://github.com/intel/linux-sgx/blob/734513886f83caff1d7e93263ba4c946fa5aa927/linux/installer/common/psw/install.sh#L96-L100

Docker does not have systemctl/initctl, and in fact I do not want to run aesm as a service inside the Docker container. Forwarding /dev/sgx and /var/run/aesmd/aesm.socket from the host when launching (not building!) the container should be enough (right?) .

During the Docker build, I cannot use the published Debian packages because of this. Therefore, I need to build from source and also patch the files above by removing the `exit 5` statement so that the build continues.

It would be great if Docker images are supported as an official install destination. Turning hard exits into warnings would be a good start. Ideally, separating packages more, so that it's possible to install just the runtime libraries without aesm would be even better.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.