nitriding-daemon
nitriding-daemon copied to clipboard
User ID change ineffective in enclave
I noticed that the user ID change we implemented in https://github.com/brave-experiments/star-randsrv/pull/33 is ineffective in an enclave. The UID always remains 0. I reached out to our AWS contacts and was told that this is by design: Their minimal container runtime does not support user ID changes.
We could simply document this behavior in the Dockerfiles that contain a USER
instruction (e.g., here) but I am tempted to partially undo https://github.com/brave/nitriding/pull/36, https://github.com/brave/nitriding/pull/37 (while keeping the refactored code), and https://github.com/brave-experiments/star-randsrv/pull/33 because these changes introduce a non-trivial amount of complexity that only benefits applications that are run outside an enclave, which I would not consider a critical use case. Do you have thoughts on this, @rillian?