How to get started with the Enclave CLI-Elastic Compute Service(ECS)-阿里云帮助中心

This topic describes how to use the Enclave CLI to build, start, and stop an enclave on an instance that supports enclaves.

Procedure

Create an enclave-enabled instance and pre-allocate resources for the enclave.

For more information, see Set up a confidential computing environment for enclaves.
Build an enclave image file.

After you install the Enclave CLI, use the sample Dockerfile in the /usr/share/ali-enclaves/examples/hello directory to build an enclave image file.
1. Run the following command to build a Docker image named hello with the latest tag.
```
sudo docker build /usr/share/ali-enclaves/examples/hello -t hello
```
2. Run the following command to verify the Docker image build.
```
sudo docker images hello:latest
```
  If the output contains the hello Docker image with the latest tag, the image build was successful.
```
[test@i22ze8kho0z4u_ ~]$ sudo docker images hello:latest
REPOSITORY    TAG       IMAGE ID       CREATED          SIZE
hello         latest    66d39ebd3dbc   22 seconds ago   4.26MB
```
3. Run the following command to build an enclave image file named hello.eif.
```
sudo enclave-cli build-enclave --docker-uri hello:latest --output-file hello.eif
```
  If no errors are reported, the build is successful and the hello.eif enclave image file is created. The PCR (Platform Configuration Register) values in the output are the measurement hashes of the enclave and can be used for remote attestation. The following is a sample output:
```
Start building the Enclave Image...
Enclave Image successfully created.
{
  "Measurements": {
    "HashAlgorithm": "Sha256 { ... }",
    "PCR11": "dc5dcd841f87e2b6c0e65a11b46b25ebe2999a8a5f0318e10c0175b60000****",
    "PCR8": "2c6944f47864f1f8ab276000a9f057fcdf9f56a015c0bc5e2339f24b0000****",
    "PCR9": "8ef5fe53a7709cc1c1a0aa7b5149a55bcd524cccc9f43e7a3baf44ca0000****"
  }
}
```
Run the following command to start the enclave.

This command starts an enclave from the hello.eif image file in debug mode, configuring it with 2 vCPUs and 1024 MiB of memory. For more information about the parameters, see Run an enclave.
```
sudo enclave-cli run-enclave --cpu-count 2 --memory 1024 --eif-path hello.eif --debug-mode
```
The following output indicates that the enclave started successfully. In this example, the enclave ID is 4f39d839-0f7a-4bee-a09d-93b8b1d6****-enc1. You must specify this ID when you use the Enclave CLI to manage the enclave.

Note
The CID (Context Identifier) of this enclave is 4, which the system assigns automatically. vsock is the sole communication channel between the instance and an enclave not running in debug mode.
```
Start allocating memory...
Started enclave with enclave-cid: 4, memory: 1024 MiB, cpu-ids: [2, 3]
{
    "EnclaveID": "4f39d839-0f7a-4bee-a09d-93b8b1d6****-enc1",
    "ProcessID": 1234,
    "EnclaveCID": 4,
    "NumberOfCPUs": 2,
    "CPUIDs": [
        2,
        3
    ],
    "MemoryMiB": 1024
}
```
Run the following command to check the enclave's state.
```
enclave-cli describe-enclaves
```
The output displays information such as the enclave ID, number of vCPUs, memory size, and state. A state of RUNNING indicates that the enclave is running.
```
[
  {
    "EnclaveID": "4f39d839-0f7a-4bee-a09d-93b8b1d6****-enc1",
    "ProcessID": 1234,
    "EnclaveCID": 4,
    "NumberOfCPUs": 2,
    "CPUIDs": [
      2,
      3
    ],
    "MemoryMiB": 1024,
    "State": "RUNNING",
    "Flags": "DEBUG_MODE"
  }
]
```
Because the enclave is running in debug mode, you can also run the following command to view its console output.
```
enclave-cli console --enclave-id 4f39d839-0f7a-4bee-a09d-93b8b1d6****-enc1
```
If the enclave is running, the output is similar to the following:
```
[   1] Hello from the enclave side!
[   2] Hello from the enclave side!
[   3] Hello from the enclave side!
...
```
Note
In this example, the enclave prints the message Hello from the enclave side! every five seconds. The number in brackets indicates the message count.

Run the following command to terminate the enclave.

sudo enclave-cli terminate-enclave --enclave-id 4f39d839-0f7a-4bee-a09d-93b8b1d6****-enc1

The following output indicates that the enclave terminated successfully.

Successfully terminated enclave 4f39d839-0f7a-4bee-a09d-93b8b1d6****-enc1.
{
  "EnclaveID": "12345678-1234-5678-1234-12345678****-enc1",
  "Terminated": true
}