Gramine (formerly called "Graphene") is a lightweight library OS, designed to run a single Linux application in an isolated environment. Currently, Gramine runs on Linux and Intel SGX enclaves on Linux platforms. With Intel SGX support, Gramine can secure a critical application in a hardware-encrypted memory region and protect the application from a malicious system stack with minimal porting effort ("lift and shift" approach).
Since the last FOSDEM 2022 talk Gramine project has done two releases where we continue to enhance Gramine by adding new features, fixing bugs, and improving performance. Few of the features being, enabling CPU and NUMA topology, support more syscalls and adding Vtune profiling support. In addition, we have also enhanced our GSC (Gramine shielded Containers) tool to deploy Docker containers protected by Intel SGX enclaves. This talk will highlight the major enhancements, as well as the current status of the project and its future plans on enclave dynamic memory management support in Gramine.
Gramine github: https://github.com/gramineproject/gramine Gramine docs: https://gramine.readthedocs.io/en/latest/ Gramine support: https://gitter.im/gramineproject/community
Curated apps on Azure: https://azuremarketplace.microsoft.com/en-us/marketplace/apps/intelcorporation.curatedapppytorch?tab=Overview https://azuremarketplace.microsoft.com/en-us/marketplace/apps/intelcorporation.curatedappredis?tab=Overview
A recent blog on developer's guide to Gramine, https://techcommunity.microsoft.com/t5/azure-confidential-computing/developers-guide-to-gramine-open-source-lib-os-for-running/ba-p/3645841
Speakers: Vijay Dhanraj