Running an Example Application using AWS Nitro Platform

1.0 Introduction

This article describes how to run an example Confidential Container - Enclave OS application on a compute node in Fortanix Confidential Computing Manager (CCM).

2.0 Prerequisites

Ensure the following:

• A Confidential Container - Enclave OS application must be created.

3.0 Run the Application

Perform the following steps:

1. Log in to Fortanix Armor Platform. For more information, refer to Access and Set Up Fortanix Armor.

2. Create a Fortanix Armor Identity and Access Management (IAM) group. For more information, refer to Create a Group.

3. Navigate to Fortanix CCM user interface (UI). For more information, refer to Fortanix Armor Solutions.

4. In the CCM UI left navigation panel, click Applications, and then click ADD APPLICATION.

   

5. In the Add Application form:

   1. Under Select application type, select Confidential Container - Enclave OS.

   2. Under Select platform type, select AWS Nitro.

   3. Click NEXT to proceed to add a Confidential Container - Enclave OS application. For more information, refer to Add Application.

6. Approve the domain for the Confidential Container - Enclave OS application. For more information, refer to Domain and Application Build Approval.

7. On the application details page, click ADD BUILD.

8. Create an application build for the Confidential Container - Enclave OS application by providing a required tag. For more information, refer to Create Application Build.

9. Approve the application build for the Confidential Container - Enclave OS application. For more information, refer to Domain and Application Build Approval.

10. Run the following command to run the application build:

    sudo docker run -it --rm --privileged -v /run/nitro_enclaves:/run/nitro_enclaves -e RUST_LOG=debug -e NODE_AGENT=http://172.31.14.110:9092/v1/ -p 80:80 -p 443:443 513076507034.dkr.ecr.us-west-1.amazonaws.com/development-images/em-test-framework-nginx-9913:nitro

    Where,

    • 9092: The port on which the Node Agent listens.

    • 172.31.14.110: The Node Agent Host IP.

    • em-test-framework-nginx-9913:nitro: The converted application image displayed in the BUILDS table.

    NOTE

    • Use your own inputs for Node IP, Port, and Converted Image in the above format. The information in the example above is just a sample.

    • You can optionally pass the ENCLAVEOS_DEBUG environment variable to run the application in debug mode.

11. To verify that the application is running, click Applications and verify that the application build is displayed as running on the application details page.