Tags: Dstack-TEE/dstack-examples
Tags
git-launcher: scrub checkout before launch
git-launcher: remove child env file support
git-launcher: rename trusted workload launcher
trusted-workload-launcher: entrypoint.sh default, dstack.sock mount, reference-value comparison Aggregator runtime now goes through the dstack SDK for KMS keys and TDX quotes against /var/run/dstack.sock, so the launcher's docs/examples need to (a) match the entry-script name workloads adopt and (b) make the dstack agent socket visible inside the workload container. The verifier-side review also asked for an explicit reference-values vs attestation-measurements comparison. Changes: - bin/trusted-workload-launcher: rename default entry script to entrypoint.sh and accept a new optional ENTRYPOINT_SCRIPT key (relative path, validated against absolute paths and '..'). Default mode still runs `bash <entry>` with no exec-bit requirement. Updated usage/help text, top comments, parse_config comment, and the `mode:` / `entry:` log lines. - tests/run-tests.sh: fixture's c3 now adds sub/entrypoint.sh and a sub/alt-entry.sh; added entrypoint_script_override and entrypoint_script_escape_rejected; updated default-mode marker assertions. 21/21 PASS. - examples/web-app.conf: now describes entrypoint.sh as the convention and documents ENTRYPOINT_SCRIPT as an optional override. - README.md (example): same convention; intro now lists `REPO_SUBDIR` / `ENTRYPOINT_SCRIPT` as the two path-selection trust- bearing fields. Added a `Mounting the dstack socket` subsection and added `/var/run/dstack.sock:/var/run/dstack.sock` to every compose snippet (local dev, production option A, and a note for option B). Workload-specific endpoint envs (e.g. DSTACK_LLM_ROUTER_DSTACK_ENDPOINT) are explicitly directed to CHILD_ENV_FILE, not to launcher config. - VERIFY.md: added a `Reference values to compare` block under step 2 with the concrete extraction shell snippet for `mrtd`, `rtmr0..2`, `compose-hash`, `os-image-hash`, `app-id`, and the launcher image digest inside the attested compose. Updated the quick-path step 1 to state explicitly that this comparison is what makes the attestation useful. Mentions of `REPO_SUBDIR` now also list `ENTRYPOINT_SCRIPT`. - README.md (root): unchanged in this commit (still the one-liner from b0478b6). No Rust-specific logic added to the launcher; it remains a build-system- agnostic bash launcher. Removed nothing about ALLOW_INSECURE / DSTACK_LLM_ROUTER_DSTACK_QUOTER_URL because neither was ever referenced here (confirmed via grep).
chore(ingress): bump image tag to 2.2 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
PreviousNext