Introduction to Graphene¶
Graphene is a lightweight guest OS, designed to run a single Linux application with minimal host requirements. Graphene can run applications in an isolated environment with benefits comparable to running a complete OS in a virtual machine – including guest customization, ease of porting to different host OSes, and process migration.
Graphene supports running Linux applications using the Intel SGX (Software Guard Extensions) technology (we call this version Graphene-SGX). With Intel SGX, applications are secured in hardware-encrypted memory regions (called SGX enclaves). SGX protects code and data in the enclave against privileged software attacks and against physical attacks on the hardware off the CPU package (e.g., cold-boot attacks on RAM). Graphene is able to run unmodified applications inside SGX enclaves, without the toll of manually porting the application to the SGX environment.
Building and running Graphene¶
Contacts and Contributing¶
For bug reports, post an issue on our GitHub repository: https://github.com/oscarlab/graphene/issues.
If you want to contribute to the project, please see Contributing to Graphene. Thank you for your interest!
Table of Contents¶
- Quick start
- Manifest syntax
- Attestation and Secret Provisioning
- Cloud Deployment
- Introduction to SGX
- graphene-manifest – Graphene manifest preprocessor
- gsc – Graphene Shielded Containers
- ias_request – Submit Intel Attestation Service request
- is_sgx_available – Check environment for SGX compatibility
- pal_loader – Run something
- quote_dump – Display SGX quote structure
- verify_ias_report – Submit Intel Attestation Service request
- PAL host ABI
- PAL as loader
- Data types and variables
- Pal APIs
- Porting Graphene PAL