Gramine Recommended VM and Setup

[Astewart1510]

Recommended VM Setup

Hi guys, Im wanting to use a VM to run some of my own development.
Is there an installation document out there to run gramine on an Ubuntu 20.04 Microsoft Azure Confidential Computing VM ?
I cam get the simple helloworld example to run perfectly but I am trying to access the "dev/attestation/quote" files..
everytime I try I keep getting an error

(host_platform.c:156:init_quoting_enclave_targetinfo) error: AESM service returned error 30; this may indicate that infrastructure for the EPID attestation requested by Gramine is missing on this machine
(host_main.c:1269:main) error: load_enclave() failed with error: Operation not permitted (EPERM)

even though my aesm service is running and active...
I am not opposed to using "dcap" either...

I am definitely missing something from the installation with Azure confidential compute.. but I cant seem to work it out.. I have tried to install all kinds of drivers but nothing seems to work.
I know this is quite a vague question.. but at the end of the day im looking for some help to setup a VM so that I can run a gramine application that can access the "dev/attestation/quote" ..

[kailun-qin]

Hi @Astewart1510!

Have you installed the Azure-specific libraries (az-dcap-client) correctly? Pls kindly see the related section (ECDSA/DCAP attestation in MS Azure cloud) in https://hub.docker.com/r/gramineproject/gramine.

[Astewart1510]

Thank you ! This worked perfectly.

[dimakuv]

@Astewart1510 Have you seen this document from Microsoft Azure: https://learn.microsoft.com/en-us/azure/confidential-computing/quick-create-portal ? Please check it out.

As @kailun-qin mentioned, most probably you're missing the Azure DCAP Client, see https://learn.microsoft.com/en-us/azure/confidential-computing/quick-create-portal#install-azure-dcap-client.

Another important note: you cannot install libsgx-dcap-default-qpl and az-dcap-client together -- in this case, the behavior is undefined. So please remove libsgx-dcap-default-qpl if you accidentally installed it.