diff --git a/docs/rune_quick_start.md b/docs/rune_quick_start.md index ac5be566..717bab3c 100644 --- a/docs/rune_quick_start.md +++ b/docs/rune_quick_start.md @@ -1,128 +1,147 @@ -# Quick Start: rune on Occlum +# Quick Start: running Occlum with OCI runtime rune -[rune](https://github.com/alibaba/inclavare-containers) is a set of tools for running trusted applications in containers with the hardware-assisted enclave technology. +This user guide provides the steps to run Occlum with OCI Runtime `rune`. -## Hardware requirements -- Install [Intel SGX driver for Linux](https://github.com/intel/linux-sgx-driver#build-and-install-the-intelr-sgx-driver), required by Intel SGX SDK && PSW. -- Install [enable_rdfsbase kernel module](https://github.com/occlum/enable_rdfsbase#how-to-build), allowing to use `rdfsbase` -family instructions in Occlum. +[rune](https://github.com/alibaba/inclavare-containers/tree/master/rune) is a novel OCI Runtime used to run trusted applications in containers with the hardware-assisted enclave technology. ---- +[Occlum](https://github.com/occlum/occlum) is a memory-safe, multi-process library OS for Intel SGX. -## Build and install rune -`rune` is a CLI tool for spawning and running enclaves in containers according to the OCI specification. +# Requirements -Please refer to [this guide](https://github.com/alibaba/inclavare-containers#rune) to build `rune` from scratch. +- Ensure that you have one of the following required operating systems to build an Occlum container image: + - CentOS 8.1 + - Ubuntu 18.04-server ---- +- Please follow [Intel SGX Installation Guide](https://download.01.org/intel-sgx/sgx-linux/2.11/docs/Intel_SGX_Installation_Guide_Linux_2.11_Open_Source.pdf) to install Intel SGX driver, Intel SGX SDK & PSW for Linux. + - For CentOS 8.1, UAE service libraries are needed but may not be installed if SGX PSW installer is used. Please manually install it: + ```shell + rpm -i libsgx-uae-service-2.11.100.2-1.el8.x86_64.rpm + ``` -## Build Occlum application bundle -### Download Occlum sdk image -``` shell -yum install -y libseccomp-devel -mkdir "$HOME/rune_workdir" -docker pull occlum/occlum:0.12.0-centos7.5 -docker run -it --device /dev/isgx \ - -v $HOME/rune_workdir:/root/rune_workdir \ - occlum/occlum:0.12.0-centos7.5 +- Install [enable_rdfsbase kernel module](https://github.com/occlum/enable_rdfsbase#how-to-build), allowing to use FSGSBASE instructions in Occlum. Please skip this step when using kernel 5.9. Note that you are not able to run Occlum with kernel disabled FSGSBASE feature even you have installed this module. + +- Install rune and occlum. + - For CentOS 8.1: + 1. Add the repository to your sources. + ```shell + cat >/etc/yum.repos.d/inclavare-containers.repo <Dockerfile <Dockerfile <