Running the PCCS Service with Docker

[pbeza]

I'm working on running the PCCS service in a Docker container. But when I try running PCKIDRetrievalTool inside the container, I end up getting this:

$ PCKIDRetrievalTool                                                                                                  
                                                                                                                       
Intel(R) Software Guard Extensions PCK Cert ID Retrieval Tool Version 1.20.100.2                                     
                                                                                                                                                                                                                                               
Warning: platform manifest is not available or current platform is not multi-package platform.                                                                                                                                                 
pckid_retrieval.csv has been generated successfully!

and then, when running my app with gramine-sgx:

$ gramine-sgx my_app
Gramine is starting. Parsing TOML manifest file, this may take some time...
2024-03-03 21:54:38.969 [info]: Client Request-ID : 015661dcfb5f4cf7a7ee235aa7041e5b
2024-03-03 21:54:38.972 [error]: Error: The platform was not found in the cache.
    at ReqCachingMode.getPckCertFromPCS (file:///opt/intel/sgx-dcap-pccs/services/caching_modes/cachingMode.js:72:11)
    at CachingModeManager.getPckCertFromPCS (file:///opt/intel/sgx-dcap-pccs/services/caching_modes/cachingModeManager.js:54:23)
    at Module.getPckCert (file:///opt/intel/sgx-dcap-pccs/services/pckcertService.js:115:41)
    at async getPckCert (file:///opt/intel/sgx-dcap-pccs/controllers/pckcertController.js:77:25)
error: AESM service returned error 1; this may indicate that infrastructure for the DCAP attestation requested by Gramine is missing on this machine
error: load_enclave() failed with error: Operation not permitted (EPERM)

I found some links suggesting that fetching Intel certificates using the PCKIDRetrievalTool can only be done from outside a VM. Is this true?

Have you, by any chance, successfully run the PCKIDRetrievalTool and the pccs_server.js server (provided by the sgx-dcap-pccs package) inside a Docker container? Is it feasible at all? I'm not sure if I've misconfigured something, or if running the PCCS service/PCKIDRetrievalTool tool inside a Docker container is not possible for some reason.

[kailun-qin]

Hi @pbeza, thanks for your questions!

I'm working on running the PCCS service in a Docker container. But when I try running PCKIDRetrievalTool inside the container

Have you, by any chance, successfully run the PCKIDRetrievalTool and the pccs_server.js server (provided by the sgx-dcap-pccs package) inside a Docker container?

May I know why would you want to run PCKIDRetrievalTool in the same container of PCCS service (pccs_server.js)?

Sorry that I'm a bit confused, since PCKIDRetrievalTool is more related to the system provisioning step. It's more reasonable to run PCCS service (pccs_server.js) in a docker container, pls refer to this guide for details.

[pbeza]

Oh, should I set up the PCKIDRetrievalTool outside the Docker container and then run the PCCS server within a Docker container? I'll give it a try. Thanks for the guide link!

[pbeza]

This is my docker-compose.yml:

version: "3.9"
services:
  pccs:
    build:
      context: ..
      dockerfile: Dockerfile.pccs
    container_name: pccs
    volumes:
      - ${HOME}/.config/pccs/default.json:/opt/intel/pccs/config/default.json
      - ${HOME}/.config/pccs/file.crt:/opt/intel/pccs/ssl_key/file.crt
      - ${HOME}/.config/pccs/private.pem:/opt/intel/pccs/ssl_key/private.pem
    ports:
      - "8082:8082"
    # (...)
    # more services here
    # (...)

where Dockerfile.pccs it this Dockerfile from the Intel's repo.

I'm running it with:

$ docker compose build pccs

$ docker compose up pccs -d
[+] Running 2/2
 ✔ Network docker_default  Created                                                                                                                                                                                                      0.1s 
 ✔ Container pccs          Started

$ curl -kv https://localhost:8082
*   Trying 127.0.0.1:8082...
* Connected to localhost (127.0.0.1) port 8082 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.0 (OUT), TLS header, Unknown (21):
* TLSv1.3 (OUT), TLS alert, decode error (562):
* error:0A000126:SSL routines::unexpected eof while reading
* Closing connection 0
curl: (35) error:0A000126:SSL routines::unexpected eof while reading

@kailun-qin Any idea what is wrong? 🤔

[pbeza]

NVM, my bad on the port mapping:

    ports:
      - "8082:8082"

Should be:

    ports:
      - "8082:8081"

instead (as I have another instance running on my host machine using port 8081).

I think it works now:

$ curl -kv https://localhost:8082                                               
*   Trying 127.0.0.1:8082...
* Connected to localhost (127.0.0.1) port 8082 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=AU; ST=Some-State; O=Internet Widgits Pty Ltd
*  start date: Mar  1 12:50:23 2024 GMT
*  expire date: Mar  1 12:50:23 2025 GMT
*  issuer: C=AU; ST=Some-State; O=Internet Widgits Pty Ltd
*  SSL certificate verify result: self-signed certificate (18), continuing anyway.
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> GET / HTTP/1.1
> Host: localhost:8082
> User-Agent: curl/7.81.0
> Accept: */*
> 
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Mark bundle as not supporting multiuse
< HTTP/1.1 404 Not Found
< X-Powered-By: Express
< Request-ID: 676d158c623f4e40826d92fd5639fbee
< Content-Security-Policy: default-src 'none'
< X-Content-Type-Options: nosniff
< Content-Type: text/html; charset=utf-8
< Content-Length: 139
< Date: Mon, 04 Mar 2024 11:50:22 GMT
< Connection: keep-alive
< Keep-Alive: timeout=5
< 
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Error</title>
</head>
<body>
<pre>Cannot GET /</pre>
</body>
</html>
* Connection #0 to host localhost left intact

[pbeza]

Now PCCS is running, but I still have this problem:

+ gramine-sgx my_app
Gramine is starting. Parsing TOML manifest file, this may take some time...
error: AESM service returned error 1; this may indicate that infrastructure for the DCAP attestation requested by Gramine is missing on this machine
error: load_enclave() failed with error: Operation not permitted (EPERM)

@kailun-qin Is there an easy way to troubleshoot? I believe I've installed all the DCAP prerequisites, but if not, it's unclear how to pinpoint the problem.

Here are some logs (from docker compose logs pccs) that may be useful:

pccs  | 2024-03-04 13:35:13.643 [info]: Client Request-ID : df48d434a48842bda52150cf6932d569                           
pccs  | 2024-03-04 13:35:13.644 [info]: 192.168.64.3 - - [04/Mar/2024:13:35:13 +0000] "GET / HTTP/1.1" 404 139 "-" "curl/7.81.0"                                                                                                              
pccs  |                                                                                                                                                                                                                                       
pccs  | 2024-03-04 13:35:14.680 [info]: Client Request-ID : d1bd1e71c55849319b8b0c1bddbc9290                           
pccs  | 2024-03-04 13:35:14.682 [error]: Error: The platform was not found in the cache.                               
pccs  |     at ReqCachingMode.getPckCertFromPCS (file:///opt/intel/pccs/services/caching_modes/cachingMode.js:72:11)                                                                                                                          
pccs  |     at CachingModeManager.getPckCertFromPCS (file:///opt/intel/pccs/services/caching_modes/cachingModeManager.js:54:23)                                                                                                               
pccs  |     at Module.getPckCert (file:///opt/intel/pccs/services/pckcertService.js:115:41)                            
pccs  |     at async getPckCert (file:///opt/intel/pccs/controllers/pckcertController.js:77:25)                        
pccs  | 2024-03-04 13:35:14.683 [info]: 192.168.64.3 - - [04/Mar/2024:13:35:14 +0000] "GET /sgx/certification/v4/pckcert?qeid=12CE6AF1E4A81E0ECDAC427B99BB0295&encrypted_ppid=57B4E13692A15DA6273D4BE67D449E08E6261C4451BEA5C4BDF17847D1F3D062447FAAC25B8F7A1C15D29D5675DD8753BBA9388948D3DD8927ED76377CB422B925C5D10874ED93650F2E93C6D42F603D83FDAE651F29F0D90CD6FC76D28D885AE00A2B16BFA0C87F64489818A780BF4A555FDDF9B358EFE5EDAB11EC94EB959A247BF5386B27E3FECB7117B7408CDA0FB8F40CD62A4DF7AF120E3339E32D8CC72EFEEE2A04364998D2827E9AA27EFD04003EF42D544B9477D7BEB7B5736EA74991817098D475270BAE7667676AFCFC101B07E1ECB6C94BAF737826F9E2E7D40CDC9B124730E55145EE8406520D4BE458A03A6889FE6C19C0A18DDECE814E35B08F6E0E857B5CB75FDB20276A69A12F1DAFB3D51A117147B1B8C1539F759601682C4ADAFA1E6A68AA154237F5192C15341A3FE81F535E27FCC187297D618C4DD9B411A3786DD780BC5C50E07FB9C6DB7657303C49D653F0EC0EDB01D3B14526A44C0459B261EC788C26976DAE4CA2064EF921D3B75C08BF5CB8FEF84A3D1715B1&cpusvn=0B0B100FFFFF00000000000000000000&pcesvn=0F00&pceid=0000 HTTP/1.1" 461 40 "-" "-"

And one more log (it was suggested to inspect it here):

$ curl -v -k -G "https://localhost:8082/sgx/certification/v3/rootcacrl"
*   Trying 127.0.0.1:8082...
* Connected to localhost (127.0.0.1) port 8082 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
*  subject: C=AU; ST=Some-State; O=Internet Widgits Pty Ltd
*  start date: Mar  1 12:50:23 2024 GMT
*  expire date: Mar  1 12:50:23 2025 GMT
*  issuer: C=AU; ST=Some-State; O=Internet Widgits Pty Ltd
*  SSL certificate verify result: self-signed certificate (18), continuing anyway.
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> GET /sgx/certification/v3/rootcacrl HTTP/1.1
> Host: localhost:8082
> User-Agent: curl/7.81.0
> Accept: */*
> 
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Mark bundle as not supporting multiuse
< HTTP/1.1 404 Not Found
< X-Powered-By: Express
< Request-ID: fdccc6f3289a46bf98cdca6d91b29cd8
< Content-Type: text/html; charset=utf-8
< Content-Length: 32
< ETag: W/"20-YjlSrv4asRbnko5hv1veXxLePxc"
< Date: Mon, 04 Mar 2024 13:41:07 GMT
< Connection: keep-alive
< Keep-Alive: timeout=5
< 
* Connection #0 to host localhost left intact
No cache data for this platform

[pbeza]

I needed to run PCKIDRetrievalTool to fix the last problem. Closing this discussion. Thanks!