intel / intel/confidential-computing.sgx
Allow to skip AESM service install
- Dominant language
- C++
- Stars
- 1.5k
- Forks
- 565
- PR merge metrics
- No merged PRs in 30d
Description
My goal is to build a Docker image where the following libraries get installed during the build: libsgx_urts.so, libsgx_enclave_common.so, libsgx_dcap_ql.so.
This is prevented by the following checks:
https://github.com/intel/linux-sgx/blob/734513886f83caff1d7e93263ba4c946fa5aa927/linux/installer/common/libsgx-enclave-common/install.sh#L95-L99
https://github.com/intel/linux-sgx/blob/734513886f83caff1d7e93263ba4c946fa5aa927/linux/installer/common/psw/install.sh#L96-L100
Docker does not have systemctl/initctl, and in fact I do not want to run aesm as a service inside the Docker container. Forwarding /dev/sgx and /var/run/aesmd/aesm.socket from the host when launching (not building!) the container should be enough (right?) .
During the Docker build, I cannot use the published Debian packages because of this. Therefore, I need to build from source and also patch the files above by removing the `exit 5` statement so that the build continues.
It would be great if Docker images are supported as an official install destination. Turning hard exits into warnings would be a good start. Ideally, separating packages more, so that it's possible to install just the runtime libraries without aesm would be even better.
Contributor guide
Assessment
This issue has not been assessed yet.