Can you run multiple programs inside one AWS Nitro Enclave at the same time?

0

The AWS Nitro Enclave Concepts states that "An enclave is a virtual machine with its own kernel, memory, and CPUs" and "An enclave image file (.eif) includes a Linux operating system, libraries, and enclave applications that will be booted into an enclave when it is launched".

So, if the Enclave is in fact a Linux VM, can we run multiple programs inside one Nitro Enclave instance at once (as opposed to creating separate Nitro Enclave instances for each program)? The documentation makes be believe this is possible, but I have not found an example illustrating how this would be done---the closest example creates multiple enclave instances.

And if you can run multiple programs in one Enclave instance, do they have the same safety guarantees that programs would normally have (e.g., memory safety between programs)?

Bear
질문됨 일 년 전240회 조회
2개 답변
0

It is possible to run multiple programs in an enclave. But the question to ask is, why would you want to do that if you want isolation between those multiple programs to begin with? Package each program into a separate enclave if you want that isolation between them, most importantly run only trusted pieces of software inside the enclave, this is not a sand boxing solution.

Sudhir
답변함 일 년 전
0

to answer your question, yes it IS possible to run multiple programs inside of a Nitro Enclave. You'll need to provide customization to navigate the VSOCK for networking/storage considerations. Ideally with a DIY approach you'd want to use separate enclaves for each component that you want to isolate - if you're looking to run a full container/application with multiple components, you might want to look into some third party solutions since DIY for OSS/large apps can be a heavy lift.

profile picture
답변함 16일 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠