[{"_1":2,"_155":-5,"_156":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_134":135},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":17},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_84":-5,"_85":86,"_125":-5,"_126":11,"_127":17,"_128":11,"_129":-5,"_130":11,"_131":-5,"_132":133},"canonicalUrl","https://hub.docker.com/r/enclaive/rust-sgx/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","enclaive","reponame","rust-sgx","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":70,"_75":11,"_76":77,"_81":29,"_82":83},"categories",[],"content_types",[40],"image","date_registered","2022-08-24T12:59:59.279119Z","description","SGX-ready Enclaive Docker Image for Rust runtime","is_private","last_updated","2022-09-12T10:22:37.73392Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[52],"application/vnd.docker.container.image.v1+json","name","pull_count",2395,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","\n
\n

\n \n $\"rust-sgx\"$ \n \n
Rust-SGX \n\n

Rust-SGX: Execute Rust applications in the safest Confidential Compute runtime

\n\n

packed by enclaive

\n
\n #intelsgx # confidentialcompute #dont-trust-a-cloud\n
\n Contribute\n ·\n Report Bug\n ·\n Request Feature\n

\n\n\n\n## What is Rust and SGX?\n\n> Rust is a multi-paradigm, general-purpose programming language. Rust emphasizes performance, type safety, and concurrency. Rust enforces memory safety—that is, that all references point to valid memory—without requiring the use of a garbage collector or reference counting present in other memory-safe languages. To simultaneously enforce memory safety and prevent concurrent data races, Rust's borrow checker tracks the object lifetime and variable scope of all references in a program during compilation. Rust is popular for systems programming but also offers high-level features including functional programming constructs.\n\n[Overview of Rust](https://www.rust-lang.org/)\n\n> Intel Security Guard Extension (SGX) delivers advanced hardware and RAM security encryption features, so called enclaves, in order to isolate code and data that are specific to each application. When data and application code run in an enclave additional security, privacy and trust guarantees are given, making the container an ideal choice for (untrusted) cloud environments.\n\n[Overview of Intel SGX](https://www.intel.com/content/www/us/en/developer/tools/software-guard-extensions/overview.html)\n\nApplication code executing within an Intel SGX enclave:\n\n- Remains protected even when the BIOS, VMM, OS, and drivers are compromised, implying that an attacker with full execution control over the platform can be kept at bay\n- Benefits from memory protections that thwart memory bus snooping, memory tampering and “cold boot” attacks on images retained in RAM\n- At no moment in time data, program code and protocol messages are leaked or de-anonymized\n- Reduces the trusted computing base of its parent application to the smallest possible footprint\n\n\n## Why use Rust-SGX (instead of \"vanilla\" Rust) images?\nFollowing benefits come for free with Rust-SGX :\n\n* Protect Rust data, applications, services, APIs, AI models against intelectual property theft/violation irrespectively where the container runs thanks to full fledge memory container encryption and integrity protection at runtime\n* Shield container application against container escalation attacks with hardened security against kernel-space exploits, malicious and accidental privilege [insider](https://www.ibm.com/topics/insider-threats) attacks, [UEFI firmware](https://thehackernews.com/2022/02/dozens-of-security-flaws-discovered-in.html) exploits and other \"root\" attacks using the corruption of the application to infiltrate your network and system\n* Build and deploy rust application as usual while inheriting literally for free security and privacy through containerization including\n * strictly better TOMs (technical and organizatorial measures)\n * privacy export regulations compliant deployment anywhere, such as [Schrems-II](https://www.europarl.europa.eu/RegData/etudes/ATAG/2020/652073/EPRS_ATA(2020)652073_EN.pdf)\n * GDPR/CCPA compliant processing (\"data in use\") of user data (in the cloud) as data is anonymized thanks to the enclave\n\n \n## TL;DR\n\n```sh\ndocker pull enclaive/rust-sgx\ndocker-compose up -d\n```\n**Warning**: This quick setup is only intended for development environments. You are encouraged to change the insecure default credentials and check out the available configuration options in the [build](#build-the-image) section for a more secure deployment.\n\n\n\n## How to deploy Rust-SGX in a zero-trust cloud?\n\nThe following cloud infrastractures are SGX-ready out of the box\n* [Microsoft Azure Confidential Cloud](https://azure.microsoft.com/en-us/solutions/confidential-compute/) \n* [OVH Cloud](https://docs.ovh.com/ie/en/dedicated/enable-and-use-intel-sgx/)\n* [Alibaba Cloud](https://www.alibabacloud.com/blog/alibaba-cloud-released-industrys-first-trusted-and-virtualized-instance-with-support-for-sgx-2-0-and-tpm_596821) \n* [Kraud Cloud](https://kraud.cloud/)\n\nConfidential compute is a fast growing space. Cloud providers continiously add confidential compute capabilities to their portfolio. Please [contact](#contact) us if the infrastracture provider of your preferred choice is missing.\n\n\n## Getting started\n### Platform requirements\n\nCheck for *Intel Security Guard Extension (SGX)* presence by running the following\n```\ngrep sgx /proc/cpuinfo\n```\nAlternatively have a thorough look at Intel's [processor list](https://www.intel.com/content/www/us/en/support/articles/000028173/processors.html). (We remark that macbooks with CPUs transitioned to Intel are unlikely supported. If you find a configuration, please [contact](#contact) us know.)\n\nNote that in addition to SGX the hardware module must support FSGSBASE. FSGSBASE is an architecture extension that allows applications to directly write to the FS and GS segment registers. This allows fast switching to different threads in user applications, as well as providing an additional address register for application use. If your kernel version is 5.9 or higher, then the FSGSBASE feature is already supported and you can skip this step.\n\nThere are several options to proceed\n* If: No SGX-ready hardware
\n[Azure Confidential Compute](https://azure.microsoft.com/en-us/solutions/confidential-compute/\") cloud offers VMs with SGX support. Prices are fair and have been recently reduced to support the [developer community](https://azure.microsoft.com/en-us/updates/announcing-price-reductions-for-azure-confidential-computing/). First-time users get $200 USD [free](https://azure.microsoft.com/en-us/free/) credit. Other cloud provider like [OVH](https://docs.ovh.com/ie/en/dedicated/enable-and-use-intel-sgx/) or [Alibaba](https://www.alibabacloud.com/blog/alibaba-cloud-released-industrys-first-trusted-and-virtualized-instance-with-support-for-sgx-2-0-and-tpm_596821) cloud have similar offerings.\n* Elif: Virtualization
\n Ubuntu 21.04 (Kernel 5.11) provides the driver off-the-shelf. Read the [release](https://ubuntu.com/blog/whats-new-in-security-for-ubuntu-21-04). Go to [download](https://ubuntu.com/download/desktop) page.\n* Elif: Kernel 5.9 or higher
\nInstall the DCAP drivers from the Intel SGX [repo](https://github.com/intel/linux-sgx-driver)\n\n ```sh\n sudo apt update\n sudo apt -y install dkms\n wget https://download.01.org/intel-sgx/sgx-linux/2.13.3/linux/distro/ubuntu20.04-server/sgx_linux_x64_driver_1.41.bin -O sgx_linux_x64_driver.bin\n chmod +x sgx_linux_x64_driver.bin\n sudo ./sgx_linux_x64_driver.bin\n\n sudo apt -y install clang-10 libssl-dev gdb libsgx-enclave-common libsgx-quote-ex libprotobuf17 libsgx-dcap-ql libsgx-dcap-ql-dev az-dcap-client open-enclave\n ```\n\n* Else: Kernel older than version 5.9
\n Upgrade to Kernel 5.11 or higher. Follow the instructions [here](https://ubuntuhandbook.org/index.php/2021/02/linux-kernel-5-11released-install-ubuntu-linux-mint/). \n\n### Software requirements\nInstall the docker engine\n```sh\n sudo apt-get update\n sudo apt-get install docker-ce docker-ce-cli containerd.io\n sudo usermod -aG docker $USER # manage docker as non-root user (obsolete as of docker 19.3) \n```\nUse `docker run hello-world` to check if you can run docker (without sudo).\n\n\n## Get this image\n\nThe recommended way to get the enclaive Rust-SGX Open Source Docker Image is to pull the prebuilt image from the [Docker Hub Registry](https://hub.docker.com/r/enclaive/rust-sgx).\n\n```console\ndocker pull enclaive/rust-sgx:latest\n```\n\nTo use a specific version, you can pull a versioned tag. You can view the\n[list of available versions](https://hub.docker.com/r/enclaive/rust-sgx/tags/)\nin the Docker Hub Registry.\n\n```console\ndocker pull enclaive/rust-sgx:[TAG]\n```\n\n\n## Build the image\nIf you wish, you can also build the image yourself.\n\n```console\ndocker build -t enclaive/rust-sgx:latest 'https://github.com/enclaive/enclaive-docker-rust-sgx.git#master'\n```\n\nThe build process of the image contains two stages\n* First Stage (\"builder\"): uses the official Rust Docker image to compile the [project](hello_world) to an executable using cargo\n* Second Stage: Gathers all additional required resources, generates the manifest form [template](rust.manifest.template) and signs it\n\nDuring the build, `ARG projectName` specifies the name of the project directory and executable. Further\n`ARG webFiles` specifies the directory for *.html, *.js, ... . Both are defined in the [docker-compose.yml](docker-compose.yml)\n\nIf more packages are required during build or runtime, they can be added to the `package.txt` or `build/package.txt`\nto install them during the build.\n\nAfter the build is finished, the app environment looks like this by default\n```\n/entrypoint/\n + app #executable\n + $webFiles/\n + *.html\n```\n\n## Modify the image\nTo run another Rust executable, it is enough to replace the `hello_world` project with yours and change the argument `projectName` in [docker-compose.yml](docker-compose.yml) to your project name.\nThe same applies to the argument `webFiles`; if not needed, this part can be removed.\n\n**Note:** After the image is built the `$webFiles` are located in `/entrypoint/$webFiles/`.\n\n\n## Run the image\nRun\n``\ndocker-compose up -d\n``\nto start the rust application.\n\n\n## Test the image\nRun \n``curl http://{your_host_ip}`` \nthe console prints `Server is running`.\n\n\n\n## Contributing\n\nContributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are **greatly appreciated**. If you have a suggestion that would make this better, please fork the repo and create a pull request. You can also simply open an issue with the tag \"enhancement\".\n\n1. Fork the Project\n2. Create your Feature Branch (`git checkout -b feature/AmazingFeature`)\n3. Commit your Changes (`git commit -m 'Add some AmazingFeature'`)\n4. Push to the Branch (`git push origin feature/AmazingFeature`)\n5. Open a Pull Request\n\n\n## Support\n\nDon't forget to give the project a star! Spread the word on social media! Thanks again!\n\n\n## License\n\nDistributed under the GPLv3 License. See `LICENSE` for further information.\n\n\n## Contact\n\nenclaive.io - [@enclaive_io](https://twitter.com/enclaive_io) - contact@enclaive.io - [https://enclaive.io](https://enclaive.io)\n\n\n\n## Acknowledgments\n\nThis project greatly celebrates all contributions from the gramine team. Special shout out to [Dmitrii Kuvaiskii](https://github.com/dimakuv) from Intel for his support. \n\n* [Gramine Project](https://github.com/gramineproject)\n* [Intel SGX](https://github.com/intel/linux-sgx-driver)\n* [Rust](https://www.rust-lang.org)\n\n\n## Trademarks \n\nThis software listing is packaged by enclaive.io. The respective trademarks mentioned in the offering are owned by the respective companies, and use of them does not imply any affiliation or endorsement. \n","has_starred","hub_user","immutable_tags_settings",{"_71":11,"_72":73},"enabled","rules",[74],".*","is_automated","permissions",{"_78":17,"_79":11,"_80":11},"read","write","admin","user","storage_size",95314926,"orgData","recentTags",[87],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":96,"_97":98,"_46":114,"_115":90,"_116":29,"_117":52,"_53":118,"_119":120,"_121":105,"_122":114,"_123":62,"_124":17},"content_type","creator",16983236,"digest","sha256:0d72ee3f687a90c77a10ccce20369013403d5ad6d15ae781b4c4a2a45b211d29","full_size",95304703,"id",288506707,"images",[99],{"_100":101,"_91":92,"_102":103,"_104":105,"_106":107,"_108":109,"_110":103,"_111":-5,"_112":94,"_59":62,"_113":-5},"architecture","amd64","features","","last_pulled","2026-09-28T13:34:30.570308267Z","last_pushed","2022-09-12T10:22:38Z","os","linux","os_features","os_version","size","variant","2022-09-12T10:22:37.705123Z","last_updater","last_updater_username","media_type","latest","repository",17900855,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":136,"_143":144,"_132":153,"_154":11},{"_36":137,"_38":138,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":139,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":140,"_75":11,"_76":142,"_81":29,"_82":83},[],[40],[52],{"_71":11,"_72":141},[74],{"_78":17,"_79":11,"_80":11},"tags",{"_145":60,"_146":-5,"_147":-5,"_148":149},"count","next","previous","results",[150],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":96,"_97":151,"_46":114,"_115":90,"_116":29,"_117":52,"_53":118,"_119":120,"_121":105,"_122":114,"_123":62,"_124":17},[152],{"_100":101,"_91":92,"_102":103,"_104":105,"_106":107,"_108":109,"_110":103,"_111":-5,"_112":94,"_59":62,"_113":-5},[],"canDeleteTags","actionData","errors"]

enclaive/rust-sgx

Tags for enclaive/rust-sgx