{"id":21905882,"url":"https://github.com/cosmian/cenclave-image-base","last_synced_at":"2026-04-20T10:05:13.902Z","repository":{"id":263380025,"uuid":"890191908","full_name":"Cosmian/cenclave-image-base","owner":"Cosmian","description":"Cosmian Enclave base container image","archived":false,"fork":false,"pushed_at":"2024-12-30T14:01:18.000Z","size":30,"stargazers_count":0,"open_issues_count":1,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-01-27T07:30:11.495Z","etag":null,"topics":["enclave","sgx"],"latest_commit_sha":null,"homepage":null,"language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Cosmian.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-11-18T06:34:03.000Z","updated_at":"2024-12-13T08:44:43.000Z","dependencies_parsed_at":"2024-11-18T07:39:12.811Z","dependency_job_id":"20120844-25be-44cb-b924-cca71a84d68a","html_url":"https://github.com/Cosmian/cenclave-image-base","commit_stats":null,"previous_names":["cosmian/cenclave-image-base"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cosmian%2Fcenclave-image-base","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cosmian%2Fcenclave-image-base/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cosmian%2Fcenclave-image-base/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Cosmian%2Fcenclave-image-base/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Cosmian","download_url":"https://codeload.github.com/Cosmian/cenclave-image-base/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244919571,"owners_count":20531830,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["enclave","sgx"],"created_at":"2024-11-28T16:38:58.323Z","updated_at":"2026-04-20T10:05:13.856Z","avatar_url":"https://github.com/Cosmian.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cosmian Enclave Image Base\n\n## Overview\n\nBase image used for Python web application launched with [Cosmian Enclave](https://docs.cosmian.com/compute/cosmian_enclave/overview/).\n\nThe image is built and released with GitHub Actions as below:\n\n```console\n$ export BUILD_DATE=\"$(date \"+%Y%m%d%H%M%S\")\"\n$ docker build -t cenclave-base:$BUILD_DATE .\n```\n\nIt is recommended to use images released on [pkgs/cenclave-base](https://github.com/Cosmian/cenclave-image-base/pkgs/container/cenclave-base) as base layer.\n\n## Extend the image with your dependencies\n\nAs an example, `cenclave-base` can be extended with [Flask](https://flask.palletsprojects.com/en/stable/):\n\n```\nFROM ghcr.io/cosmian/cenclave-base:LAST_DATE_ON_GH_PACKAGES\n\nRUN pip3 install \"flask==3.1.0\"\n```\n\nreplace `LAST_DATE_ON_GH_PACKAGES` with the last one on [pkgs/cenclave-base](https://github.com/Cosmian/cenclave-image-base/pkgs/container/cenclave-base), then:\n\n```console\n$ docker build -t cenclave-flask:3.1.0\n```\n\n## Run with SGX\n\nFirst compress your Python flask application:\n\n```console\n$ tree src/\nsrc\n└── app.py\n\n0 directories, 2 files\n$ cat src/app.py\nfrom flask import Flask\n\napp = Flask(__name__)\n\n@app.route('/')\ndef hello():\n    return \"Hello World!\"\n$ tar -cvf /tmp/app.tar --directory=src app.py\n```\n\nthen generate a signer RSA key for the enclave:\n\n```console\n$ openssl genrsa -3 -out enclave-key.pem 3072\n```\n\nand finally run the Docker container with:\n\n- Enclave signer key mounted to `/root/.config/gramine/enclave-key.pem`\n- Tar of the python application mounted anywhere (`/tmp/app.tar` can be used)\n- `cenclave-run` binary as entrypoint\n- Enclave size in `--size` (could be `2G`, `4G`, `8G`)\n- Path of the tar file with the Python application in `--code`\n- Module path of your web application in `--application` (usually `app:app`)\n- Random UUID v4 in `--uuid`\n- Expiration date of the certificate as unix epoch time in `--self-signed`\n\n```console\n$ docker run -p 8080:443 \\\n    --device /dev/sgx_enclave \\\n    --device /dev/sgx_provision \\\n    --device /dev/sgx/enclave \\\n    --device /dev/sgx/provision \\\n    -v /var/run/aesmd:/var/run/aesmd \\\n    -v \"$(realpath enclave-key.pem)\":/root/.config/gramine/enclave-key.pem \\\n    -v /tmp/app.tar:/tmp/app.tar \\\n    --entrypoint cenclave-run \\\n    cenclave-flask:3.1.0 --size 8G \\\n                    --code /tmp/app.tar \\\n                    --host localhost \\\n                    --application app:app \\\n                    --uuid 533a2b83-4bc5-4a9c-955e-208c530bfd15 \\\n                    --self-signed 1769155711\n```\n\n## Check your web application\n\n```console\n$ # get self-signed certificate with OpenSSL\n$ openssl s_client -showcerts -connect localhost:8080 \u003c/dev/null 2\u003e/dev/null | openssl x509 -outform PEM \u003e/tmp/cert.pem\n$ # force self-signed certificate as CA bundle\n$ curl https://localhost:8080 --cacert /tmp/cert.pem\n```\n\n## Compute MRENCLAVE without SGX\n\nThe integrity of the application running in `cenclave-flask` is reflected in the `MRENCLAVE` value which is a SHA-256 hash digest of code, data, heap, stack, and other attributes of an enclave.\n\nUse `--dry-run` parameter with the exact same other parameters as above to output `MRENCLAVE` value:\n\n```console\n$ docker run --rm \\\n    -v /tmp/app.tar:/tmp/app.tar \\\n    --entrypoint cenclave-run \\\n    cenclave-flask:3.1.0 --size 8G \\\n                    --code /tmp/app.tar \\\n                    --host localhost \\\n                    --application app:app \\\n                    --uuid 533a2b83-4bc5-4a9c-955e-208c530bfd15 \\\n                    --self-signed 1769155711 \\\n                    --dry-run\n```\n\n__Note__: `MRSIGNER` value should be ignored because it is randomly generated at each dry run.\n\n## Testing Docker environment\n\nIf you want to test that your docker image contains all the dependencies needed, `cenclave-test` entrypoint wraps `flask run` command for you if you mount your code directory to `/app`:\n\n```console\n$ docker run --rm -ti \\\n    --entrypoint cenclave-test \\\n    --net host \\\n    -v src:/app \\\n    cenclave-flask:3.1.0 \\\n    --application app:app \\\n    --debug\n$ # default host and port of flask developement server\n$ curl http://127.0.0.1:5000\n```\n\nTo use your `secrets.json`, just add `-v secrets.json:/root/.cache/cenclave/secrets.json` to mount the file.\n\n\n## Determine the enclave memory size of your image\n\nSome files contained in the image are mounted into the enclave: libs, etc. \nThese files takes some memory spaces from the enclave size you have declared. The remaining space is the effective memory your app can use.\n\nYou can compute the effective memory by adding `--memory` in the previous commands:\n\n```console\n$ docker run --rm \\\n    -v /tmp/app.tar:/tmp/app.tar \\\n    --entrypoint cenclave-run \\\n    cenclave-flask:3.1.0 --size 8G \\\n                    --code /tmp/app.tar \\\n                    --host localhost \\\n                    --application app:app \\\n                    --uuid 533a2b83-4bc5-4a9c-955e-208c530bfd15 \\\n                    --self-signed 1769155711 \\\n                    --dry-run \\\n                    --memory\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcosmian%2Fcenclave-image-base","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcosmian%2Fcenclave-image-base","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcosmian%2Fcenclave-image-base/lists"}