make agent listen on unix socket instead of all devices about enclave-cc HOT 6 OPEN

@dcmiddle is this issue still relevant or can be closed?
If it's still relevant to what release do you think we should map it to (mid-November, end-December, mid-February etc...)?

from enclave-cc.

target for after occlum 1.0 release at end of calendar year. This is a security enhancement and does not block current release features.

from enclave-cc.

one thing related is k8s needs liveness and readiness probe to determining the status of the container, will the agent in the future need to respond to these checks in addition to app specific liveness and readiness checks?

from enclave-cc.

one thing related is k8s needs liveness and readiness probe to determining the status of the container, will the agent in the future need to respond to these checks in addition to app specific liveness and readiness checks?

no. the agent is opaque to kubernetes

from enclave-cc.

nevertheless, though all considered infra structure containers, but not like pause container, agent enclave container has a running process, runtime still has the responsibility to make sure the enclave-agent is healthy and functional and take action upon agent process failure.

from enclave-cc.

one additional thing that needs fixing here is: each pod gets a unique socket. currently, when running several pods they all have an agent that listen to the same address/port in the host network namespace

from enclave-cc.