gramineproject/gramine repository overview

This is a set of Gramine Docker images, currently based on two distros: Ubuntu 20.04 and Ubuntu 22.04.

The images are minimal and contain:

• Gramine binaries and tools, and
• Intel SGX software stack required to run Gramine.

⁠SGX

To create SGX enclaves Gramine requires access to /dev/sgx_enclave device. To be able to spawn architectural enclaves the AESM service needs access to /dev/sgx_provision device. You need to pass both of these devices when running docker, if you want to use gramine-sgx. Example command to run docker image:

docker run --device /dev/sgx_enclave --device /dev/sgx_provision -it gramineproject/gramine

If you plan on using gramine-direct (non-SGX version), you need to change the seccomp profile to https://github.com/gramineproject/gramine/blob/master/scripts/docker_seccomp.json⁠, or completely disable it.

⁠SGX remote attestation

Please note that if your use case requires setting up the SGX remote attestation infrastructure, you may need to perform additional steps (depending on the attestation schema you'd like to use), described below.

⁠EPID attestation

If you require EPID attestation, no additional steps are needed.

⁠ECDSA/DCAP attestation in MS Azure cloud

MS Azure cloud provides two configurations for ECDSA/DCAP attestation:

• Ubuntu 20.04: a plugin called the Azure DCAP library⁠ that requires no additional configuration from the user. It only needs to be installed, via the package az-dcap-client; see additional instructions here⁠.

• Ubuntu 22.04: the Azure DCAP library plugin is deprecated, and the Intel QPL (Quote Provider Library) package must be used instead. See here⁠ on how to install and configure QPL in Azure.

In both cases, you need to restart the AESM service; Gramine Docker image provides a helpful script:

/restart_aesm.sh

⁠Intel ECDSA/DCAP attestation on the local machine

If you want to use your own attestation infrastructure, you need to:

• install the additional QPL (Quote Provider Library) package: apt install libsgx-dcap-default-qpl.
• install and configure the Intel PCCS service, see the documentation⁠.
• restart the AESM service: /restart_aesm.sh.

⁠References

For more information on Gramine, please refer to:

• https://www.gramineproject.io⁠
• https://github.com/gramineproject/gramine⁠
• https://gramine.readthedocs.io⁠