Welcome to Occlum’s documentation!

Occlum is a memory-safe, multi-process library OS (LibOS) for Intel SGX. As a LibOS, it enables legacy applications to run on SGX with little or even no modifications of source code, thus protecting the confidentiality and integrity of user workloads transparently.

Table of Contents

Introduction

• Quick Start
  • Environment
  • Hello World
• User Commands
  • Work Flow Overview
  • General Commands
  • Container-like Commands
• Occlum Configuration
  • Default Legacy Mode (without EDMM support)
  • EDMM Configuration Add-on
  • Runtime Resource Configuration for Occlum process
• Build and Install
  • Build from Source
  • How to Build and Run Release-Mode Enclaves?
• Install Occlum with Popular Package Managers
  • Prerequisite
  • Install Occlum with APT on Ubuntu 20.04
  • Version Compatability Matrix
• Occlum-Compatible Executable Binaries
  • No fork syscall
  • libc version compatibility
  • Compiled with PIE (Position-Independent-Executable)
• How to Debug?

Tutorials

• Insight of Occlum Instance Generation
  • File System from Occlum Perspective
  • Redis in Occlum
  • copy_bom Case Study
• Distributed PyTorch
  • Overview
• Secure Spark Data Analytics using BigDL PPML and Occlum
  • Overall Architecture
  • PPML Occlum Spark on Azure
  • PPML Occlum Spark on Aliyun (Chinese version)
• LLM Inference in TEE
  • Overview

Inside Occlum

• Boot Flow Overview
  • Measurements
  • Boot flow
• Occlum File System Overview
  • SEFS
  • UnionFS
  • Async-SFS
  • HostFS
  • RamFS and other pseudo filesystems
  • Q & A
• Mount Support
  • Mount command
  • Mount and Unmount Filesystems at Runtime
• The Encrypted FS Image
  • How to use
• Remote Attestation
  • Init RA Solution
  • Azure Attestation
  • SGX KSS (Key Separation and Sharing feature) support
  • References
• Init RA Solutions
  • AECS Init-RA
  • GRPC-RATLS Init-RA

Demos and Examples

• Demos
• Benchmark Demos
  • Benchmarks Data
• Tests for Occlum
  • Unit Tests
  • Gvisor Tests
  • LTP Tests

Tools

• Builtin Toolchains
  • Toolchains
  • Auxiliary Libraries
• Copy Bom
  • Bom file
  • copy_bom
  • known limitations
  • Demos

Q&A

• Q&A