Docker Setup with PKCS11
Background
We are developing a Spring application which does crypto operations. Requirement of project is that this application implementation should be independent of HSM specific libraries (because client may have any HSM) and hence we used SunPKCS11 interface. SunPKCS11 interface needs a path to HSM library file which implements common PKCS11 interface. This way any HSM which has library implemented PKCS11 interface, would work with application.
Current State
We have host machine for testing where HSM is installed. HSM installer also provides the library which implements PKCS11 interface. We are planning to deploy this application using Docker. Since application should be HSM library independent we have create docker image where no HSM specific information is mentioned. However, we have mount complete lib folder (where PKCS11 implementation library is present) of HSM using docker-compose file. When we do docker-compose up, it gives error for a library which belongs to HSM (though its mounted in lib folder).
Error in loading shared library xxx.so
Question
- Should I use docker in this case? I have seen discussions in internet to access devices using docker and answer was mostly to use some other docker image which is device specific. However, I don't know if HSM to be used with application (at client side) would have such docker image.
- If so, Is it good idea to mount lib folder of HSM? During HSM installation, I have installed 3 rpm files. These 3 installation might have additional libraries which would be required for interacting with HSM.
- In case what I am doing is correct approach, what is cause of error?
Dockerfile
FROM some/url/xxxbuild:openjdk8u151-alpine3.7-1.0.0
LABEL maintainer "Team"
ENV APP_USER myapp
ENV APP_HOME /opt/my/app
USER $APP_USER
RUN madir -p $APP_HOME/config
docker-compose file
my-microservice:
image: my-microservice:1.1.0-SNAPSHOT
container_name: my-microservice-container
restart: on-failure
environment:
SERVER_PORT: 9999
JAVA_OPTS: -Dlog4j.configurationFile=/opt/gd/app/config/log4j2.xml
ports:
- 8888:9999
volumes:
- ./applicationSpecificFile:/opt/gd/app/config
- /opt/hsm/lib:/opt/hsm/lib <-- HSM Specific lib files
I am new to Docker and Linux. Let me know in case I miss to mention something.
hsm sunpkcs11
asked Nov 23 '18 at 10:20
sneshsnesh
265
add a comment |
Background
We are developing a Spring application which does crypto operations. Requirement of project is that this application implementation should be independent of HSM specific libraries (because client may have any HSM) and hence we used SunPKCS11 interface. SunPKCS11 interface needs a path to HSM library file which implements common PKCS11 interface. This way any HSM which has library implemented PKCS11 interface, would work with application.
Current State
We have host machine for testing where HSM is installed. HSM installer also provides the library which implements PKCS11 interface. We are planning to deploy this application using Docker. Since application should be HSM library independent we have create docker image where no HSM specific information is mentioned. However, we have mount complete lib folder (where PKCS11 implementation library is present) of HSM using docker-compose file. When we do docker-compose up, it gives error for a library which belongs to HSM (though its mounted in lib folder).
Error in loading shared library xxx.so
Question
- Should I use docker in this case? I have seen discussions in internet to access devices using docker and answer was mostly to use some other docker image which is device specific. However, I don't know if HSM to be used with application (at client side) would have such docker image.
- If so, Is it good idea to mount lib folder of HSM? During HSM installation, I have installed 3 rpm files. These 3 installation might have additional libraries which would be required for interacting with HSM.
- In case what I am doing is correct approach, what is cause of error?
Dockerfile
FROM some/url/xxxbuild:openjdk8u151-alpine3.7-1.0.0
LABEL maintainer "Team"
ENV APP_USER myapp
ENV APP_HOME /opt/my/app
USER $APP_USER
RUN madir -p $APP_HOME/config
docker-compose file
my-microservice:
image: my-microservice:1.1.0-SNAPSHOT
container_name: my-microservice-container
restart: on-failure
environment:
SERVER_PORT: 9999
JAVA_OPTS: -Dlog4j.configurationFile=/opt/gd/app/config/log4j2.xml
ports:
- 8888:9999
volumes:
- ./applicationSpecificFile:/opt/gd/app/config
- /opt/hsm/lib:/opt/hsm/lib <-- HSM Specific lib files
I am new to Docker and Linux. Let me know in case I miss to mention something.
hsm sunpkcs11
asked Nov 23 '18 at 10:20
sneshsnesh
265
PKCS#11 defines a programming interface. Each HSM is delivered with some implementations of this interface, for use in some particular contexts (Windows, Linux, ...). If your HSM provider does not support Docker, you may have difficulties. There are two types of HSM: basic HSM and network HSM. A PKCS#11 implementation library may work correctly with Docker, since it does not use system calls to specific local hardware. On the contrary, you may encounter more difficulties to use a basic HSM.
– Alexandre Fenyo
Dec 27 '18 at 18:01
add a comment |
Background
We are developing a Spring application which does crypto operations. Requirement of project is that this application implementation should be independent of HSM specific libraries (because client may have any HSM) and hence we used SunPKCS11 interface. SunPKCS11 interface needs a path to HSM library file which implements common PKCS11 interface. This way any HSM which has library implemented PKCS11 interface, would work with application.
Current State
We have host machine for testing where HSM is installed. HSM installer also provides the library which implements PKCS11 interface. We are planning to deploy this application using Docker. Since application should be HSM library independent we have create docker image where no HSM specific information is mentioned. However, we have mount complete lib folder (where PKCS11 implementation library is present) of HSM using docker-compose file. When we do docker-compose up, it gives error for a library which belongs to HSM (though its mounted in lib folder).
Error in loading shared library xxx.so
Question
- Should I use docker in this case? I have seen discussions in internet to access devices using docker and answer was mostly to use some other docker image which is device specific. However, I don't know if HSM to be used with application (at client side) would have such docker image.
- If so, Is it good idea to mount lib folder of HSM? During HSM installation, I have installed 3 rpm files. These 3 installation might have additional libraries which would be required for interacting with HSM.
- In case what I am doing is correct approach, what is cause of error?
Dockerfile
FROM some/url/xxxbuild:openjdk8u151-alpine3.7-1.0.0
LABEL maintainer "Team"
ENV APP_USER myapp
ENV APP_HOME /opt/my/app
USER $APP_USER
RUN madir -p $APP_HOME/config
docker-compose file
my-microservice:
image: my-microservice:1.1.0-SNAPSHOT
container_name: my-microservice-container
restart: on-failure
environment:
SERVER_PORT: 9999
JAVA_OPTS: -Dlog4j.configurationFile=/opt/gd/app/config/log4j2.xml
ports:
- 8888:9999
volumes:
- ./applicationSpecificFile:/opt/gd/app/config
- /opt/hsm/lib:/opt/hsm/lib <-- HSM Specific lib files
I am new to Docker and Linux. Let me know in case I miss to mention something.
hsm sunpkcs11
asked Nov 23 '18 at 10:20
sneshsnesh
265
Background
We are developing a Spring application which does crypto operations. Requirement of project is that this application implementation should be independent of HSM specific libraries (because client may have any HSM) and hence we used SunPKCS11 interface. SunPKCS11 interface needs a path to HSM library file which implements common PKCS11 interface. This way any HSM which has library implemented PKCS11 interface, would work with application.
Current State
We have host machine for testing where HSM is installed. HSM installer also provides the library which implements PKCS11 interface. We are planning to deploy this application using Docker. Since application should be HSM library independent we have create docker image where no HSM specific information is mentioned. However, we have mount complete lib folder (where PKCS11 implementation library is present) of HSM using docker-compose file. When we do docker-compose up, it gives error for a library which belongs to HSM (though its mounted in lib folder).
Error in loading shared library xxx.so
Question
- Should I use docker in this case? I have seen discussions in internet to access devices using docker and answer was mostly to use some other docker image which is device specific. However, I don't know if HSM to be used with application (at client side) would have such docker image.
- If so, Is it good idea to mount lib folder of HSM? During HSM installation, I have installed 3 rpm files. These 3 installation might have additional libraries which would be required for interacting with HSM.
- In case what I am doing is correct approach, what is cause of error?
Dockerfile
FROM some/url/xxxbuild:openjdk8u151-alpine3.7-1.0.0
LABEL maintainer "Team"
ENV APP_USER myapp
ENV APP_HOME /opt/my/app
USER $APP_USER
RUN madir -p $APP_HOME/config
docker-compose file
my-microservice:
image: my-microservice:1.1.0-SNAPSHOT
container_name: my-microservice-container
restart: on-failure
environment:
SERVER_PORT: 9999
JAVA_OPTS: -Dlog4j.configurationFile=/opt/gd/app/config/log4j2.xml
ports:
- 8888:9999
volumes:
- ./applicationSpecificFile:/opt/gd/app/config
- /opt/hsm/lib:/opt/hsm/lib <-- HSM Specific lib files
I am new to Docker and Linux. Let me know in case I miss to mention something.
hsm sunpkcs11
hsm sunpkcs11
asked Nov 23 '18 at 10:20
sneshsnesh
265
asked Nov 23 '18 at 10:20
sneshsnesh
265
asked Nov 23 '18 at 10:20
sneshsnesh
265
asked Nov 23 '18 at 10:20
sneshsnesh
265
asked Nov 23 '18 at 10:20
sneshsnesh
265
265
PKCS#11 defines a programming interface. Each HSM is delivered with some implementations of this interface, for use in some particular contexts (Windows, Linux, ...). If your HSM provider does not support Docker, you may have difficulties. There are two types of HSM: basic HSM and network HSM. A PKCS#11 implementation library may work correctly with Docker, since it does not use system calls to specific local hardware. On the contrary, you may encounter more difficulties to use a basic HSM.
– Alexandre Fenyo
Dec 27 '18 at 18:01
add a comment |
PKCS#11 defines a programming interface. Each HSM is delivered with some implementations of this interface, for use in some particular contexts (Windows, Linux, ...). If your HSM provider does not support Docker, you may have difficulties. There are two types of HSM: basic HSM and network HSM. A PKCS#11 implementation library may work correctly with Docker, since it does not use system calls to specific local hardware. On the contrary, you may encounter more difficulties to use a basic HSM.
– Alexandre Fenyo
Dec 27 '18 at 18:01
PKCS#11 defines a programming interface. Each HSM is delivered with some implementations of this interface, for use in some particular contexts (Windows, Linux, ...). If your HSM provider does not support Docker, you may have difficulties. There are two types of HSM: basic HSM and network HSM. A PKCS#11 implementation library may work correctly with Docker, since it does not use system calls to specific local hardware. On the contrary, you may encounter more difficulties to use a basic HSM.
– Alexandre Fenyo
Dec 27 '18 at 18:01
PKCS#11 defines a programming interface. Each HSM is delivered with some implementations of this interface, for use in some particular contexts (Windows, Linux, ...). If your HSM provider does not support Docker, you may have difficulties. There are two types of HSM: basic HSM and network HSM. A PKCS#11 implementation library may work correctly with Docker, since it does not use system calls to specific local hardware. On the contrary, you may encounter more difficulties to use a basic HSM.
– Alexandre Fenyo
Dec 27 '18 at 18:01
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53444804%2fdocker-setup-with-pkcs11%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53444804%2fdocker-setup-with-pkcs11%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
PKCS#11 defines a programming interface. Each HSM is delivered with some implementations of this interface, for use in some particular contexts (Windows, Linux, ...). If your HSM provider does not support Docker, you may have difficulties. There are two types of HSM: basic HSM and network HSM. A PKCS#11 implementation library may work correctly with Docker, since it does not use system calls to specific local hardware. On the contrary, you may encounter more difficulties to use a basic HSM.
– Alexandre Fenyo
Dec 27 '18 at 18:01