Running Nginx in an Anjuna Confidential Container

$ anjuna-gcp-cli disk create --docker-uri=nginx:latest --size 20G

$ anjuna-azure-cli disk create --docker-uri=nginx:latest --disk-size 20G

$ export NETWORK_NAME="anjuna-gcp-network"
$ gcloud compute networks create ${NETWORK_NAME}
$ gcloud compute firewall-rules create anjuna-gcp-rule-http  \
    --network ${NETWORK_NAME}  \
    --allow tcp:80

$ # Replace these with your own values as needed
$ export RESOURCE_GROUP_NAME="myResourceGroup"
$ export LOCATION="eastus"
$ export VNET_NAME="myVnet"
$ export SUBNET_NAME="mySubnet"
$ export NSG_NAME="myNSG"
$ export PUBLIC_IP_NAME="myPublicIP"
$ export NIC_NAME="myNic"

$ # Create a Virtual Network
$ az network vnet create --resource-group ${RESOURCE_GROUP_NAME} --location ${LOCATION} --name ${VNET_NAME} --address-prefix 10.0.0.0/16

$ # Create a Subnet
$ az network vnet subnet create --resource-group ${RESOURCE_GROUP_NAME} --vnet-name ${VNET_NAME} --name ${SUBNET_NAME} --address-prefixes 10.0.0.0/24

$ # Create a Network Security Group
$ az network nsg create --resource-group ${RESOURCE_GROUP_NAME} --name ${NSG_NAME}

$ # Create a Security Rule allowing TCP traffic over port 80
$ az network nsg rule create --resource-group ${RESOURCE_GROUP_NAME} --nsg-name ${NSG_NAME} --name Allow-80 --protocol Tcp --direction Inbound --priority 1000 --source-address-prefix '*' --source-port-range '*' --destination-address-prefix '*' --destination-port-range 80 --access Allow

$ # Associate the Network Security Group with the Subnet
$ az network vnet subnet update --resource-group ${RESOURCE_GROUP_NAME} --vnet-name ${VNET_NAME} --name ${SUBNET_NAME} --network-security-group ${NSG_NAME}

$ # Create a Public IP address
$ az network public-ip create --resource-group ${RESOURCE_GROUP_NAME} --name ${PUBLIC_IP_NAME} --sku Standard --allocation-method Static

$ # Create a Network Interface with the Public IP address
$ az network nic create --resource-group ${RESOURCE_GROUP_NAME} --name ${NIC_NAME} --vnet-name ${VNET_NAME} --subnet ${SUBNET_NAME} --network-security-group ${NSG_NAME} --public-ip-address ${PUBLIC_IP_NAME}

$ export SERVICE_ACCOUNT_NAME=anjuna-nginx-service-account
$ export GCP_PROJECT=$(gcloud config get project)
$ export SERVICE_ACCOUNT_EMAIL="${SERVICE_ACCOUNT_NAME}@${GCP_PROJECT}.iam.gserviceaccount.com"
$ gcloud iam service-accounts create ${SERVICE_ACCOUNT_NAME} \
    --description="Service Account for Anjuna Nginx Quickstart" \
    --display-name="Anjuna Nginx Quickstart"
$ gcloud projects add-iam-policy-binding ${GCP_PROJECT} \
    --member="serviceAccount:${SERVICE_ACCOUNT_EMAIL}" \
    --role="roles/logging.logWriter"

$ export INSTANCE_NAME=anjuna-gcp-nginx-instance
$ anjuna-gcp-cli instance create \
    --instance=${INSTANCE_NAME} \
    --image=${IMAGE_NAME} \
    --network=${NETWORK_NAME}  \
    --service-account=${SERVICE_ACCOUNT_EMAIL}

INFO   [0001] Using configured GCP project:  my-project
INFO   [0010] Instance created: anjuna-gcp-nginx-instance

$ export INSTANCE_NAME=anjuna-azure-nginx-instance
$ anjuna-azure-cli instance create \
  --name ${INSTANCE_NAME} \
  --location eastus \
  --image-gallery myGallery \
  --image-definition myFirstDefinition \
  --image-version 0.1.0 \
  --resource-group myResourceGroup \
  --storage-account ${STORAGE_ACCOUNT_NAME} \
  --nics myNic

$ anjuna-gcp-cli instance describe \
    --instance=${INSTANCE_NAME} \
    --attestation-report

$ anjuna-azure-cli instance describe \
  --name ${INSTANCE_NAME} \
  --resource-group myResourceGroup

Name                         ResourceGroup       PowerState      PublicIps         Fqdns    Location    Zones
---------------------------  ------------------  --------------  ---------------  -------  ----------  -------
anjuna-azure-nginx-instance  myResourceGroup     VM Running      172.171.202.232           eastus

$ export IP_ADDRESS=$(anjuna-gcp-cli instance describe \
    --instance=${INSTANCE_NAME} \
    --show-ip | egrep -m 1 -i "AccessConfig: External NAT IpAddr:\s*[0-9]+" \
    | sed -E 's/.*IpAddr\:\s*([0-9.]+).*/\1/')
$ curl ${IP_ADDRESS}:80

$ export IP_ADDRESS=$(anjuna-azure-cli instance describe \
    --resource-group myResourceGroup --name ${INSTANCE_NAME} \
    --json --query publicIps | grep -oE "[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+" | awk 'NR==1')
$ curl ${IP_ADDRESS}:80

$ anjuna-gcp-cli instance describe \
    --instance=${INSTANCE_NAME} \
    --logs --tail

ANJ-ENCLAVE: Container setup finished
ANJ-ENCLAVE: Launching command /usr/sbin/nginx
2023/02/17 22:07:34 [notice] 1#1: using the "epoll" event method
2023/02/17 22:07:34 [notice] 1#1: nginx/1.23.3
2023/02/17 22:07:34 [notice] 1#1: built by gcc 10.2.1 20210110 (Debian 10.2.1-6)

$ anjuna-azure-cli instance log --tail \
  --name ${INSTANCE_NAME} \
  --resource-group myResourceGroup

$ anjuna-gcp-cli instance delete --instance=${INSTANCE_NAME}

$ anjuna-azure-cli instance delete --name ${INSTANCE_NAME} --resource-group myResourceGroup