@@ -43,14 +43,6 @@ docker login registry.scontain.com
43
43
44
44
## Prepare your application
45
45
46
- ::: warning
47
-
48
- For demo purposes, we omitted some development best practices in these examples.
49
-
50
- Make sure to check your field's best practices before going to production.
51
-
52
- :::
53
-
54
46
Before going further, your ` <docker-hub-user>/hello-world:1.0.0 ` image built
55
47
previously is required.
56
48
@@ -74,28 +66,36 @@ chmod +x sconify.sh
74
66
75
67
## Build the TEE docker image
76
68
69
+ Before wrapping your iExec confidential application with Scone, you need to
70
+ generate a custom signing key. This key is used for the sconification process.
71
+
72
+ Generate your enclave signing key with:
73
+
74
+ ``` bash
75
+ openssl genrsa -3 -out enclave-key.pem 3072
76
+ ```
77
+
78
+ This will create an ` enclave-key.pem ` file in your current directory. You will
79
+ use this file in the sconify Docker command to sign your TEE image.
80
+
77
81
We will use the following script to wrap the sconification process, copy the
78
82
` sconify.sh ` script in the current directory:
79
83
80
84
::: code-group
81
85
82
- ``` bash [for Javascript]
86
+ ``` bash [Javascript]
83
87
#! /bin/bash
84
88
85
- # Declare the app entrypoint
86
- ENTRYPOINT=" node /app/app.js"
87
-
88
89
# Declare image related variables
89
- IMG_NAME=tee-scone-hello-world
90
90
IMG_FROM=< docker-hub-user> /hello-world:1.0.0
91
- IMG_TO=< docker-hub-user> /${IMG_NAME} :1.0.0-debug
91
+ IMG_TO=< docker-hub-user> /tee-scone-hello-world :1.0.0
92
92
93
93
# Run the sconifier to build the TEE image based on the non-TEE image
94
94
docker run -it --rm \
95
+ -v $PWD /enclave-key.pem:/sig/enclave-key.pem \
95
96
-v /var/run/docker.sock:/var/run/docker.sock \
96
97
registry.scontain.com/scone-production/iexec-sconify-image:5.9.1-v16\
97
98
sconify_iexec \
98
- --name=${IMG_NAME} \
99
99
--from=${IMG_FROM} \
100
100
--to=${IMG_TO} \
101
101
--binary-fs \
@@ -105,31 +105,25 @@ docker run -it --rm \
105
105
--binary=/usr/local/bin/node \
106
106
--heap=1G \
107
107
--dlopen=1 \
108
- --no-color \
109
108
--verbose \
110
- --command=${ENTRYPOINT} \
111
109
&& echo -e " \n------------------\n" \
112
110
&& echo " successfully built TEE docker image => ${IMG_TO} " \
113
111
&& echo " application mrenclave.fingerprint is $( docker run --rm -e SCONE_HASH=1 ${IMG_TO} ) "
114
112
```
115
113
116
- ``` bash [for Python]
114
+ ``` bash [Python]
117
115
#! /bin/bash
118
116
119
- # Declare the app entrypoint
120
- ENTRYPOINT=" python3 /app/app.py"
121
-
122
117
# Declare image related variables
123
- IMG_NAME=tee-scone-hello-world
124
118
IMG_FROM=< docker-hub-user> /hello-world:1.0.0
125
- IMG_TO=< docker-hub-user> /${IMG_NAME} :1.0.0-debug
119
+ IMG_TO=< docker-hub-user> /tee-scone-hello-world :1.0.0
126
120
127
121
# Run the sconifier to build the TEE image based on the non-TEE image
128
- docker run -it \
122
+ docker run -it --rm \
123
+ -v $PWD /enclave-key.pem:/sig/enclave-key.pem \
129
124
-v /var/run/docker.sock:/var/run/docker.sock \
130
125
registry.scontain.com/scone-production/iexec-sconify-image:5.9.1-v16\
131
126
sconify_iexec \
132
- --name=${IMG_NAME} \
133
127
--from=${IMG_FROM} \
134
128
--to=${IMG_TO} \
135
129
--binary-fs \
@@ -139,9 +133,7 @@ docker run -it \
139
133
--binary=/usr/local/bin/python3 \
140
134
--heap=1G \
141
135
--dlopen=1 \
142
- --no-color \
143
136
--verbose \
144
- --command=${ENTRYPOINT} \
145
137
&& echo -e " \n------------------\n" \
146
138
&& echo " successfully built TEE docker image => ${IMG_TO} " \
147
139
&& echo " application mrenclave.fingerprint is $( docker run --rm -e SCONE_HASH=1 ${IMG_TO} ) "
@@ -158,21 +150,11 @@ Run the `sconify.sh` script to build the Scone TEE application:
158
150
Push your image on DockerHub:
159
151
160
152
``` bash
161
- docker push < docker-hub-user> /tee-scone-hello-world:1.0.0-debug
153
+ docker push < docker-hub-user> /tee-scone-hello-world:1.0.0
162
154
```
163
155
164
156
Congratulations, you just built your Scone TEE application.
165
157
166
- ::: info
167
-
168
- You may have noticed the ` tee-debug ` flag in the image name, the built image is
169
- actually in TEE debug mode, this allows you to have some debug features while
170
- developing the app.
171
-
172
- Once you are happy with the debug app, contact us to go to production!
173
-
174
- :::
175
-
176
158
## Test your app on iExec
177
159
178
160
At this stage, your application is ready to be tested on iExec. The process is
@@ -198,7 +180,7 @@ Edit `iexec.json` and fill in the standard keys and the `mrenclave` object:
198
180
"owner" : " <your-wallet-address>" , // starts with 0x
199
181
"name" : " tee-scone-hello-world" , // application name
200
182
"type" : " DOCKER" ,
201
- "multiaddr" : " docker.io/<docker-hub-user>/tee-scone-hello-world:1.0.0-debug " , // app image
183
+ "multiaddr" : " docker.io/<docker-hub-user>/tee-scone-hello-world:1.0.0" , // app image
202
184
"checksum" : " <checksum>" , // starts with 0x, update it with your own image digest
203
185
"mrenclave" : {
204
186
"framework" : " SCONE" , // TEE framework (keep default value)
@@ -225,7 +207,7 @@ Run your TEE image with `SCONE_HASH=1` to get the enclave fingerprint
225
207
(mrenclave):
226
208
227
209
``` bash
228
- docker run --rm -e SCONE_HASH=1 < docker-hub-user> /tee-scone-hello-world:1.0.0-debug
210
+ docker run --rm -e SCONE_HASH=1 < docker-hub-user> /tee-scone-hello-world:1.0.0
229
211
```
230
212
231
213
:::
@@ -251,13 +233,6 @@ iexec app run --chain {{chainName}} --tag tee,scone --workerpool {{workerpoolAdd
251
233
252
234
::: info
253
235
254
- You noticed we used ` {{workerpoolAddress}} ` instead of an ethereum address, this
255
- is an ENS name.
256
-
257
- :::
258
-
259
- ::: info
260
-
261
236
Remember, you can access task and app logs by following the instructions on page
262
237
[ Debug your tasks] ( /guides/build-iapp/debugging ) .
263
238
0 commit comments