Welcome to Occlum’s documentation!

Occlum is a memory-safe, multi-process library OS (LibOS) for Intel SGX. As a LibOS, it enables legacy applications to run on SGX with little or even no modifications of source code, thus protecting the confidentiality and integrity of user workloads transparently.

Note

This project is under active development. There is no guarantee that the content here are all up to date.

Table of Contents

Introduction

• Quick Start
  • Environment
  • Hello World
• User Commands
  • Work Flow Overview
  • General Commands
  • Container-like Commands
• Occlum Configuration
  • Runtime Resource Configuration for Occlum process
• Build and Install
  • Build from Source
  • How to Build and Run Release-Mode Enclaves?
• Install Occlum with Popular Package Managers
  • Prerequisite
  • Install Occlum with APT on Ubuntu 20.04
  • Version Compatability Matrix
• Occlum-Compatible Executable Binaries
  • No fork syscall
  • libc version compatibility
  • Compiled with PIE (Position-Independent-Executable)
• How to Debug?

Tutorials

• Insight of Occlum Instance Generation
  • File System from Occlum Perspective
  • Redis in Occlum
  • copy_bom Case Study
• Distributed PyTorch
• Secure Spark Data Analytics using BigDL PPML and Occlum
  • Overall Architecture
  • PPML Occlum Spark on Azure
  • PPML Occlum Spark on Aliyun (Chinese version)

Inside Occlum

• Boot Flow Overview
  • Measurements
  • Boot flow
• Occlum File System Overview
  • SEFS
  • UnionFS
  • Async-SFS
  • HostFS
  • RamFS and other pseudo filesystems
  • Q & A
• Mount Support
  • Mount command
  • Mount and Unmount Filesystems at Runtime
• The Encrypted FS Image
  • How to use
• Remote Attestation
  • Init-RA solution
  • Azure Attestation
  • SGX KSS (Key Separation and Sharing feature) support
  • References

Demos and Examples

• Demos
• Benchmark Demos
  • Benchmarks Data
• Tests for Occlum
  • Unit Tests
  • Gvisor Tests
  • LTP Tests

Tools

• Builtin Toolchains
  • Toolchains
  • Auxiliary Libraries
• Copy Bom
  • Bom file
  • copy_bom
  • known limitations

Q&A

• Q&A