4

Is it possible to create and run Intel SGX enclaves within a virtualised environment such as Virtualbox or Docker?

wasp256
  • 5,943
  • 12
  • 72
  • 119
  • We have created a dockerfile which can run SGX applications and Enclaves into a docker container. See: https://hub.docker.com/r/aminueza/docker-sgx or https://github.com/aminueza/docker-sgx – Amanda Souza Jan 11 '17 at 17:51

2 Answers2

4

It is possible to run and start enclaves from virtual machines. However, the virtualization software must be able to support the SGX instruction set. VirtualBox and Docker still don't support SGX, but KVM and Xen both have patches available to support SGX.

For more details see here: https://01.org/intel-software-guard-extensions/sgx-virtualization

Surenthar
  • 361
  • 2
  • 5
2

Surely SGX applications can run in virtualised environment, because running Intel SGX just require Ring 3 privilege. But your motherboard needs to be changed to enable it, and there should be some modifications need to be made in the Hypervisor or OS. Currently, it seems Intel SGX is still not yet supported in traditional virtualised environments like XEN/KVM in the mainstream, but there are some preliminary SGX virtualization patches from Intel.

In addition, there are some research papers talking about SGX applications running on virtualised environments:

  • SCONE is a docker-compatible secure container. You may check their website. There is a OSDI'16 paper describing SCONE.

  • Haven provides shielded execution , that protects the confidentiality and integrity of programs/data from the platform on which it runs. It is based on Windows HyperV and Libos. There is an OSDI'14 paper describing Haven.

Martijn Pieters
  • 1,048,767
  • 296
  • 4,058
  • 3,343
Richard Li
  • 396
  • 1
  • 14