Add workaround for the network issue of the keyprovider

key-provider-build/docker-compose.yaml

@@ -1,7 +1,6 @@
 services:
   gramine-sealing-key-provider:
     container_name: gramine-sealing-key-provider
-    network_mode: host
     build:
       context: .
       dockerfile: Dockerfile
@@ -10,8 +9,16 @@ services:
       - "/dev/sgx_enclave:/dev/sgx_enclave"
       - "/dev/sgx_provision:/dev/sgx_provision"
     volumes:
-      - "/etc/sgx_default_qcnl.conf:/etc/sgx_default_qcnl.conf"
-    environment:
-      - SGX=1 
+      - "./sgx_default_qcnl.conf:/etc/sgx_default_qcnl.conf"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
     ports:
-      - "3443:3443"
+      - "127.0.0.1:3443:3443"
+
+  # proxy to access the local pccs for the aesm service
+  # The local PCCS is supposed to be running on the host machine and listening on 127.0.0.1:8081
+  pccs-proxy:
+    image: alpine/socat
+    container_name: pccs-proxy
+    network_mode: host
+    command: TCP-LISTEN:8082,bind=172.17.0.1,fork,reuseaddr TCP:127.0.0.1:8081

key-provider-build/sgx_default_qcnl.conf

@@ -0,0 +1,9 @@
+{
+  "pccs_url": "https://host.docker.internal:8082/sgx/certification/v4/",
+  "use_secure_cert": false,
+  "retry_times": 6,
+  "retry_delay": 10,
+  "pck_cache_expire_hours": 168,
+  "verify_collateral_cache_expire_hours": 168,
+  "local_cache_only": false
+}