Running MongoDB with persistent storage

MongoDB is a good example of an application that benefits by running in an AWS Nitro Enclave.

In this example, you will run a MongoDB server inside an AWS Nitro Enclave, and you will learn how to work with persistent storage with the Anjuna Nitro Runtime.

This example is focused on using persistent storage only and should not be used in production. For production MongoDB deployments, Anjuna recommends configuring encryption at rest, TLS, and using attestation to securely deliver the related encryption keys.

Build the required tools for block mounts

Block mounts for the Anjuna Nitro Runtime are based on the DRBD project, which must be built locally. Run the following commands to build the tools:

$ cd /opt/anjuna/nitro/drbd/
$ ./parent-drbd-setup.sh --build

Create a persistent volume disk file

When using block mounts, data is persisted to a volume disk file. To create a new volume disk file, run the following command:

$ cd /opt/anjuna/nitro/drbd/
# Create a 2048 MB disk file for the volume
$ ./parent-drbd-setup.sh --mem 2048 --disk-create ~/nitro-disk.img

Start the parent filesystem proxy

Then, you can start the filesystem proxy using the following command:

$ ./parent-drbd-setup.sh --start ~/nitro-disk.img

This proxy will communicate with the enclave over the vsock and persist data into the file ~/nitro-disk.img.

Install MongoDB Shell

Before running the MongoDB server, you will download a tool that will allow you to interact with the MongoDB server.

Create a file at /etc/yum.repos.d/mongodb-org-5.0.repo. You will need root access to write that file so that you can run sudo vim /etc/yum.repos.d/mongodb-org-5.0.repo.

Copy the following contents into the file and save it:

[mongodb-org-5.0]
name=MongoDB Repository
baseurl=https://repo.mongodb.org/yum/amazon/2/mongodb-org/5.0/x86_64/
gpgcheck=1
enabled=1
gpgkey=https://www.mongodb.org/static/pgp/server-5.0.asc

Now you can install the MongoDB Shell:

$ sudo yum install -y mongodb-org-shell

Building the enclave

In this section, you will build a MongoDB enclave that uses a block mount.

Create an enclave configuration file and name it enclave-config.yaml. This file configures MongoDB to bind to all IPs, sets a default username and password for the database, and mounts the volume to /data/db, where Mongo expects the DB files to be.

version: 1.8

# Run mongodb, bind to all IPs
command: [docker-entrypoint.sh, mongod, --auth, --port=27017, --bind_ip=0.0.0.0]

# Set a default MongoDB username and password
environment:
- MONGO_INITDB_ROOT_USERNAME=anjuna
- MONGO_INITDB_ROOT_PASSWORD=anjuna

# Set a persistent block mount
mounts:
  - type: block
    name: db-volume
    mountPath: /data/db

Build and run the enclave:

$ echo "Building enclave..."

# Build the enclave using the mongo:latest Docker image,
# enclave-config.yaml as the enclave configuration file,
# and save it to mongo-nitro.eif
$ anjuna-nitro-cli build-enclave --docker-uri mongo:latest --enclave-config-file enclave-config.yaml --output-file mongo-nitro.eif

# Start the network agent
$ anjuna-nitro-netd-parent --expose 27017 --daemonize
$ sleep 3

# Start the enclave you just created
$ anjuna-nitro-cli run-enclave --cpu-count 2 --memory 4096 --eif-path mongo-nitro.eif --debug-mode

The number of vCPU cores must be an even number due to hyperthreading.

If the agent is already running, it should be killed before starting the enclave.

Connecting to the database

After a few seconds of initialization, you should be able to connect to the MongoDB. Now you will connect and add some data. If you are unable to connect, wait a few more seconds and try again.

$ mongo -u anjuna -p anjuna 'mongodb://localhost'
> use demo
> db.data.insert({"hello_world":1})
> db.data.findOne()
{ "_id" : ObjectId("..."), "hello_world" : 1 }
> exit

You have added some data and you are able to query it.

Now, you can check that data is persisted when the enclave is restarted. To do so, you can terminate the enclave and run it again.

$ anjuna-nitro-cli terminate-enclave --all
$ pkill -f anjuna-nitro-netd-parent
$ /opt/anjuna/nitro/drbd/parent-drbd-setup.sh --stop
$ /opt/anjuna/nitro/drbd/parent-drbd-setup.sh --start ~/nitro-disk.img
$ anjuna-nitro-netd-parent --expose 27017 --daemonize
$ anjuna-nitro-cli run-enclave --cpu-count 2 --memory 4096 --eif-path mongo-nitro.eif --debug-mode

After 20-30 seconds, you should be able to connect to the DB and fetch the data you inserted before terminating the enclave:

$ mongo -u anjuna -p anjuna 'mongodb://localhost'
> use demo
> db.data.findOne()
> exit

You should be able to see the entry you created before: { "_id" : ObjectId("…"), "hello_world" : 1 }.

Congratulations! You have successfully set up an AWS Nitro Enclave with a persistent storage volume.