3
0
Fork
You've already forked enclaveos
0
No description
  • Rust 65.8%
  • Dockerfile 17.7%
  • Shell 13.7%
  • Makefile 2.8%
Find a file
2025年12月02日 12:09:39 -08:00
LICENSES convert repo to AGPL3 + commercial license 2025年11月30日 09:33:00 -08:00
rootfs clean up and add attestation service 2025年11月30日 10:12:38 -08:00
src remove duplicate import 2025年12月02日 12:09:39 -08:00
.dockerignore initial busybox/linux building 2022年06月24日 02:02:51 -07:00
.gitignore port c init to rust 2022年10月06日 12:30:07 -07:00
Cargo.lock clean up and add attestation service 2025年11月30日 10:12:38 -08:00
Cargo.toml clean up and add attestation service 2025年11月30日 10:12:38 -08:00
Containerfile convert repo to AGPL3 + commercial license 2025年11月30日 09:33:00 -08:00
LICENSE remove ascii 2025年12月01日 18:01:26 -08:00
Makefile convert repo to AGPL3 + commercial license 2025年11月30日 09:33:00 -08:00
README.md stagex refactor 2024年02月17日 08:42:39 -08:00

EnclaveOS

https://git.distrust.co/public/enclaveos

About

A minimal, immutable, and deterministic Linux unikernel build system targeting various Trusted Execution Environments for use cases that require high security and accountability.

This is intended as a reference repository which could serve as a boilerplate to build your own hardened and immutable operating system images for high security applications.

Platforms

Platform Target Status Verified boot Method
AWS Nitro Enclaves aws booting Nitro attestation API
GCP Confidential Compute gcp research vTPM 2.0 attestation
Azure Confidential VMs azure research vTPM 2.0 attestation
Generic/Qemu generic research vTPM 2.0 attestation

Features

  • Immutability
    • Root filesystem is a CPIO filesystem extracted to a RamFS at boot
  • Minimalism
    • < 5MB footprint
    • Nothing is included but a kernel and your target binary by default
    • Sample "hello world" included as a default reference
    • Debug builds include busybox init shim and drop to a shell
  • Determinism
    • Multiple people can build artifacts and get identical hashes
    • Allows one to prove distributed artifacts correspond to published sources
  • Hardening
    • No TCP/IP network support
      • Favor using a virtual socket or physical interface to a gateway system
    • Most unessesary kernel features are disabled at compile time
    • Follow Kernel Self Protection Project recommendations

Development

Requirements

  • 10GB+ free RAM
  • Docker 20+
  • GNU Make

Build

make