A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from https://github.com/alibaba/inclavare-containers below:

inclavare-containers/inclavare-containers: A novel container runtime, aka confidential container, for cloud-native confidential computing and enclave runtime ecosystem.

Inclavare, pronounced as [ˈinklɑveə], is the Latin etymology of the word enclave, which means to isolate the user's sensitive workload from the untrusted and uncontrollable infrastructure in order to meet the protection requirement for the data in use.

Inclavare Containers is an innovation of container runtime with the novel approach for launching protected containers in hardware-assisted Trusted Execution Environment (TEE) technology, aka Enclave, which can prevent the untrusted entity, such as Cloud Service Provider (CSP), from accessing the sensitive and confidential assets in use.

Inclavare Containers has the following salient features:

Please refer to Terminology for more technical expressions used in Inclavare Containers.

Inclavare Containers is a sandbox project of the Cloud Native Computing Foundation (CNCF). If you are an organization that wants to help shape the evolution of technologies that are container-packaged, dynamically-scheduled and microservices-oriented, consider joining the CNCF.

Inclavare Containers is helping to keep tenants' confidential data secure so they feel confident that their data is not being exposed to CSP or their own insiders, and they can easily move their trusted applications to the cloud.

Inclavare Containers follows the classic container runtime design. It takes the adaption to containerd as first class, and uses dedicated shim-rune to interface with OCI Runtime rune. In the downstrem, init-runelet employs a novel approach of launching enclave runtime and trusted application in hardware-enforced enclave.

The major components of Inclavare Containers are:

Inclavare Containers implements Enclave Attestation Architecture (EAA), a universal and cross-platform remote attestation infrastructure. EAA can prove that sensitive workloads are running on a genuine and trusted hardware TEE based on confidential computing technology. The formal design of EAA will be published for RFC.

The major components of EAA are:

Please refer to Inclavare Containers Roadmap for the details. This document outlines the development roadmap for the Inclavare Containers project.

It's recommended to use Inclavare Containers development docker image to build Inclavare Containers from scratch.

Note that the environment of launching Inclavare Containers development docker image must be capable of hardware TEE and install the corresponding software stack, e.g, Intel SGX and Intel SGX SDK & PSW for Linux.

The exact command to run the docker image requires to be specified explicitly according to the type of SGX device driver.

docker run -it -v /var/run/aesmd:/var/run/aesmd \
  -device /dev/isgx \
  inclavarecontainers/dev:$version-$os
docker run -it -v /var/run/aesmd:/var/run/aesmd \
  -v /dev/sgx_enclave:/dev/sgx/enclave -v /dev/sgx_provision:/dev/sgx/provision \
  inclavarecontainers/dev:$version-$os

where:

Please be aware of running the commands listed below in the development container launched by Inclavare Containers development docker image.

  1. Download the latest source code of Inclavare Containers
mkdir -p "$WORKSPACE"
cd "$WORKSPACE"
git clone https://github.com/alibaba/inclavare-containers
  1. Build Inclavare Containers
cd inclavare-containers
# build rune, shim-rune, epm, sgx-tools, enclave-tls, shelter and inclavared
make

After build Inclavare Containers on your system, you can use the following command to install Inclavare Containers on your system.

{rune,shim-rune,epm,sgx-tools,shelter,inclavared} will be installed to /usr/local/bin/{rune,containerd-shim-rune-v2,epm,sgx-tools,shelter,inclavared} on your system. Enclave-TLS SDK will be installed to /opt/enclave-tls. {enclave-tls-server,enclave-tls-client} will be installed to /usr/share/enclave-tls/samples.

If you don't want to build and install Inclavare Containers from latest source code. We also provide RPM/DEB repository to help you install Inclavare Containers quickly. Please see the steps about how to configure repository firstly. Then you can run the following command to install Inclavare Containers on your system.

sudo apt-get install rune shim-rune epm sgx-tools enclave-tls shelter inclavared

Inclavare Containers can be integrated with dockerd, containerd, and pouchd.

The former targets using docker to deploy Inclavare Containers. Specifically, you need to install the preferred enclave runtime when building container images, and then launch the enclave runtime through rune and enclave runtime specific PAL.

The latter targets using K8s to deploy Inclavare Containers. In this scenario, shim-rune and rune can compose an enclave containerization stack, so enclave runtime is not required and installed when building container images, providing with the same experience as ordinary containers.

Add the assocated configurations for rune in dockerd config file, e.g, /etc/docker/daemon.json, on your system.

{
        "runtimes": {
                "rune": {
                        "path": "/usr/local/bin/rune",
                        "runtimeArgs": []
                }
        }
}

then restart dockerd on your system.

You can check whether rune is correctly enabled or not with:

Note that the systemd is not installed by default, so please manually start up dockerd:

dockerd -b docker0 --storage-driver=vfs &

Inclavare Containers is added to the adopters list of containerd. Besides, shim-rune supports containerd shim v2 API. So you can add the assocated configurations for shim-rune in the containerd config file, e.g, /etc/containerd/config.toml, on your system.

        [plugins.cri.containerd]
          ...
          [plugins.cri.containerd.runtimes.rune]
            runtime_type = "io.containerd.rune.v2"

then restart containerd on your system.

Add the assocated configurations in pouchd config file, e.g, /etc/pouch/config.json, on your system.

	"add-runtime": {
		"rune": {
            		"path": "/usr/local/bin/rune",
            		"runtimeArgs": null,
            		"type": "io.containerd.rune.v2"
        	},
		...
	}

where:

then restart pouchd on your system.

You can check whether rune is correctly enabled or not with:

Inclavare Containers can be deployed with Occlum LibOS and WebAssembly Micro Runtime (WAMR).

Please refer to this guide to run Occlum with rune and docker.

Please refer to this guide to deploy an enclave container in a Kubernetes cluster. Currently, Hello-world application image and web application images based on OpenJDK 11, Dragonwell, and Golang are provided. These images don't contain enclave runtime. They are only used for the deployment with containerd.

Please refer to this guide to run inclavare-containers with pouchd.

WebAssembly Micro Runtime (WAMR)

Please refer to this guide to run WAMR with rune.

WebAssembly Micro Runtime (WAMR) application image is provided. WAMR image contains enclave runtime, because it doesn't adapt to shim-rune and use off-cloud signing. It is only used for the deployment with dockerd.

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4