app.manifest.template

{% set arch_libdir = "/lib/x86_64-linux-gnu" %}
{% set log_level = "error" %}

sys.stack.size = "2048K"
sys.brk.max_size = "1024K"

loader.entrypoint = "file:{{ gramine.libos }}"
libos.entrypoint = "/sgx/app"

loader.log_level = "{{ log_level }}"

loader.env.LD_LIBRARY_PATH = "/usr/lib:/lib:{{ arch_libdir }}:/usr/lib:/usr/{{ arch_libdir }}"
loader.env.PATH = "/bin:/usr/bin"

loader.env.IS_SIMULATION = { passthrough = true }
loader.env.CLUSTER = { passthrough = true }
loader.env.MINIMUM_CONTEXT_SLOT = { passthrough = true }
loader.env.RPC_URL = { passthrough = true }
loader.env.PAYER = { passthrough = true }
loader.env.FUNCTION_KEY = { passthrough = true }
loader.env.FUNCTION_DATA = { passthrough = true }
loader.env.FUNCTION_REQUEST_KEY = { passthrough = true }
loader.env.FUNCTION_REQUEST_DATA = { passthrough = true }
loader.env.FUNCTION_ROUTINE_KEY = { passthrough = true }
loader.env.FUNCTION_ROUTINE_DATA = { passthrough = true }
loader.env.QUEUE_AUTHORITY = { passthrough = true }
loader.env.VERIFIER = { passthrough = true }
loader.env.VERIFIER_ENCLAVE_SIGNER = { passthrough = true }
loader.env.REWARD_RECEIVER = { passthrough = true }
loader.env.CHAIN_ID = { passthrough = true }
loader.env.VERIFYING_CONTRACT = { passthrough = true }
loader.env.FUNCTION_PARAMS = { passthrough = true }
loader.env.FUNCTION_CALL_IDS = { passthrough = true }

fs.mounts = [
  { path = "/etc", uri = "file:/etc" },
  { uri = "file:/sgx", path = "/sgx" },
  { uri = "file:/etc/ssl/certs", path = "/etc/ssl/certs" },
  { uri = "file:/lib64", path = "/lib64" },
  { uri = "file:/usr", path = "/usr" },
  { uri = "file:/usr/lib/ssl/certs", path = "/usr/lib/ssl/certs" },
  { uri = "file:{{ arch_libdir }}", path = "{{ arch_libdir }}" },
  { uri = "file:{{ gramine.runtimedir() }}", path = "/lib" },
]

loader.env.MALLOC_ARENA_MAX = "1"
sgx.enclave_size = "128M"
sgx.nonpie_binary = true
sgx.edmm_enable = {{ 'true' if env.get('EDMM', '0') == '1' else 'false' }}
sgx.max_threads = 128
sgx.remote_attestation = "dcap"

sys.insecure__allow_eventfd = true

sgx.trusted_files = [
  "file:/sgx/",
  "file:/etc/ssl/certs/",
  "file:/lib64/",
  "file:/usr/include/",
  "file:/usr/lib/ssl/certs/",
  "file:/usr/{{ arch_libdir }}/",
  "file:{{ arch_libdir }}/",
  "file:{{ gramine.libos }}",
  "file:{{ gramine.runtimedir() }}/",
]

sgx.allowed_files = [
    "file:/etc/hosts",
    "file:/etc/host.conf",
    "file:/etc/gai.conf",
    "file:/etc/resolv.conf",
    "file:/etc/localtime",
    "file:/etc/nsswitch.conf",
]