@@ -43,14 +43,6 @@ docker login registry.scontain.com
4343
4444## Prepare your application
4545
46- ::: warning
47-
48- For demo purposes, we omitted some development best practices in these examples.
49-
50- Make sure to check your field's best practices before going to production.
51-
52- :::
53-
5446Before going further, your ` <docker-hub-user>/hello-world:1.0.0 ` image built
5547previously is required.
5648
@@ -74,28 +66,36 @@ chmod +x sconify.sh
7466
7567## Build the TEE docker image
7668
69+ Before wrapping your iExec confidential application with Scone, you need to
70+ generate a custom signing key. This key is used for the sconification process.
71+
72+ Generate your enclave signing key with:
73+
74+ ``` bash
75+ openssl genrsa -3 -out enclave-key.pem 3072
76+ ```
77+
78+ This will create an ` enclave-key.pem ` file in your current directory. You will
79+ use this file in the sconify Docker command to sign your TEE image.
80+
7781We will use the following script to wrap the sconification process, copy the
7882` sconify.sh ` script in the current directory:
7983
8084::: code-group
8185
82- ``` bash [for Javascript]
86+ ``` bash [Javascript]
8387#! /bin/bash
8488
85- # Declare the app entrypoint
86- ENTRYPOINT=" node /app/app.js"
87-
8889# Declare image related variables
89- IMG_NAME=tee-scone-hello-world
9090IMG_FROM=< docker-hub-user> /hello-world:1.0.0
91- IMG_TO=< docker-hub-user> /${IMG_NAME} :1.0.0-debug
91+ IMG_TO=< docker-hub-user> /tee-scone-hello-world :1.0.0
9292
9393# Run the sconifier to build the TEE image based on the non-TEE image
9494docker run -it --rm \
95+ -v $PWD /enclave-key.pem:/sig/enclave-key.pem \
9596 -v /var/run/docker.sock:/var/run/docker.sock \
9697 registry.scontain.com/scone-production/iexec-sconify-image:5.9.1-v16\
9798 sconify_iexec \
98- --name=${IMG_NAME} \
9999 --from=${IMG_FROM} \
100100 --to=${IMG_TO} \
101101 --binary-fs \
@@ -105,31 +105,25 @@ docker run -it --rm \
105105 --binary=/usr/local/bin/node \
106106 --heap=1G \
107107 --dlopen=1 \
108- --no-color \
109108 --verbose \
110- --command=${ENTRYPOINT} \
111109 && echo -e " \n------------------\n" \
112110 && echo " successfully built TEE docker image => ${IMG_TO} " \
113111 && echo " application mrenclave.fingerprint is $( docker run --rm -e SCONE_HASH=1 ${IMG_TO} ) "
114112```
115113
116- ``` bash [for Python]
114+ ``` bash [Python]
117115#! /bin/bash
118116
119- # Declare the app entrypoint
120- ENTRYPOINT=" python3 /app/app.py"
121-
122117# Declare image related variables
123- IMG_NAME=tee-scone-hello-world
124118IMG_FROM=< docker-hub-user> /hello-world:1.0.0
125- IMG_TO=< docker-hub-user> /${IMG_NAME} :1.0.0-debug
119+ IMG_TO=< docker-hub-user> /tee-scone-hello-world :1.0.0
126120
127121# Run the sconifier to build the TEE image based on the non-TEE image
128- docker run -it \
122+ docker run -it --rm \
123+ -v $PWD /enclave-key.pem:/sig/enclave-key.pem \
129124 -v /var/run/docker.sock:/var/run/docker.sock \
130125 registry.scontain.com/scone-production/iexec-sconify-image:5.9.1-v16\
131126 sconify_iexec \
132- --name=${IMG_NAME} \
133127 --from=${IMG_FROM} \
134128 --to=${IMG_TO} \
135129 --binary-fs \
@@ -139,9 +133,7 @@ docker run -it \
139133 --binary=/usr/local/bin/python3 \
140134 --heap=1G \
141135 --dlopen=1 \
142- --no-color \
143136 --verbose \
144- --command=${ENTRYPOINT} \
145137 && echo -e " \n------------------\n" \
146138 && echo " successfully built TEE docker image => ${IMG_TO} " \
147139 && echo " application mrenclave.fingerprint is $( docker run --rm -e SCONE_HASH=1 ${IMG_TO} ) "
@@ -158,21 +150,11 @@ Run the `sconify.sh` script to build the Scone TEE application:
158150Push your image on DockerHub:
159151
160152``` bash
161- docker push < docker-hub-user> /tee-scone-hello-world:1.0.0-debug
153+ docker push < docker-hub-user> /tee-scone-hello-world:1.0.0
162154```
163155
164156Congratulations, you just built your Scone TEE application.
165157
166- ::: info
167-
168- You may have noticed the ` tee-debug ` flag in the image name, the built image is
169- actually in TEE debug mode, this allows you to have some debug features while
170- developing the app.
171-
172- Once you are happy with the debug app, contact us to go to production!
173-
174- :::
175-
176158## Test your app on iExec
177159
178160At this stage, your application is ready to be tested on iExec. The process is
@@ -198,7 +180,7 @@ Edit `iexec.json` and fill in the standard keys and the `mrenclave` object:
198180 "owner" : " <your-wallet-address>" , // starts with 0x
199181 "name" : " tee-scone-hello-world" , // application name
200182 "type" : " DOCKER" ,
201- "multiaddr" : " docker.io/<docker-hub-user>/tee-scone-hello-world:1.0.0-debug " , // app image
183+ "multiaddr" : " docker.io/<docker-hub-user>/tee-scone-hello-world:1.0.0" , // app image
202184 "checksum" : " <checksum>" , // starts with 0x, update it with your own image digest
203185 "mrenclave" : {
204186 "framework" : " SCONE" , // TEE framework (keep default value)
@@ -225,7 +207,7 @@ Run your TEE image with `SCONE_HASH=1` to get the enclave fingerprint
225207(mrenclave):
226208
227209``` bash
228- docker run --rm -e SCONE_HASH=1 < docker-hub-user> /tee-scone-hello-world:1.0.0-debug
210+ docker run --rm -e SCONE_HASH=1 < docker-hub-user> /tee-scone-hello-world:1.0.0
229211```
230212
231213:::
@@ -251,13 +233,6 @@ iexec app run --chain {{chainName}} --tag tee,scone --workerpool {{workerpoolAdd
251233
252234::: info
253235
254- You noticed we used ` {{workerpoolAddress}} ` instead of an ethereum address, this
255- is an ENS name.
256-
257- :::
258-
259- ::: info
260-
261236Remember, you can access task and app logs by following the instructions on page
262237[ Debug your tasks] ( /guides/build-iapp/debugging ) .
263238
0 commit comments