Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Dockerfile to build on Alpine Linux (static musl binaries) #81

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

alexatblock
Copy link

Description of changes:
I am building a nitro-enclave container on Alpine Linux. Alpine uses musl instead of glibc. That means that I can't use the kmstool* binaries that are built on Amazon Linux. This PR adds a Dockerfile that can build everything in Alpine. A container that uses alpine as its base and adds the gcompat package can use the kmstool* binaries produced by this change.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@alcioa
Copy link
Contributor

alcioa commented Aug 23, 2022

Hi, we already integrated ACM for Nitro Enclaves on Alpine. See here an example: https://github.com/aws/aws-nitro-enclaves-acm/blob/main/env/enclave/Dockerfile. And while it would be nice to have multiple base images build support, we usually prefer the integration product/project that ingests this SDK to handle that.

@alexatblock
Copy link
Author

kmstool-enclave-cli depends on a bunch of c libraries. that seems like a lot of build logic to push into consuming applications that otherwise don't need (or want) to manage a c toolchain. Since kmstool-enclave-cli is meant to run in an enclave where you want to really control and constrain dependencies, it seems like a statically-linked option would be broadly useful to enclave-users.

The best thing would be if you could just call KMS from the enclave in the native SDK for your language, but if you have to use kmstool-enclave-cli, it would be nice to at least not have a dependency on dynamic linking to an amazon-linux image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants