web-app.conf

# Example: pin a small web app at a specific upstream commit and run it
# under the launcher in default mode.
#
# The workload repo must contain a bash script at the fixed path
# './entrypoint.sh' (or at REPO_SUBDIR/entrypoint.sh if REPO_SUBDIR is set).
# The launcher checks out the pinned commit, then runs the script with
# 'bash entrypoint.sh' — no executable bit on the file is required.
# All install/build/run logic lives in that script, so its bytes are covered
# by source provenance of the pinned commit and no install/run command is
# trust-bearing in this config file.
#
# Replace COMMIT_SHA with the full SHA you want this launcher to bind to.
# The launcher refuses to start unless COMMIT_SHA is a full 40-hex SHA-1 or
# 64-hex SHA-256. Branches, tags, and short SHAs are rejected.
#
# A verifier checks:
#
#   image digest     -> launcher repo at commit L
#                       (via the Sigstore build-provenance attestation
#                        on the published image digest)
#   attested config  -> REPO_URL + COMMIT_SHA
#                       (via dstack compose-hash, or a derived image digest)
#   upstream repo    -> workload bytes at COMMIT_SHA, including entrypoint.sh
#
# Together these pin exactly which workload code runs inside the dstack TEE.

REPO_URL=https://github.com/example-org/example-web-app.git
COMMIT_SHA=0000000000000000000000000000000000000000
WORK_DIR=/var/lib/git-launcher/example-web-app

# Optional: cd into a subdirectory of the upstream repo before exec'ing
# entrypoint.sh. Useful if the workload lives in a monorepo subpath.
# Absolute paths and paths containing '..' are rejected.
# REPO_SUBDIR=apps/web

# Optional: override the default entry script name. Trust-bearing in default
# mode (selects which script runs). Absolute paths and '..' are rejected.
# ENTRYPOINT_SCRIPT=scripts/launch.sh

# Runtime configuration is not part of this launcher config. Pass non-secret
# workload env through Docker Compose `environment:` and pass secrets through
# dstack encrypted secrets, KMS, or mounted secret files.

# Advanced mode (use only if the workload repo cannot host its own
# entrypoint.sh — e.g. you are pinning a third-party repo unchanged):
# RUN_CMD="node server.js"
# INSTALL_CMD="npm ci --omit=dev"   # optional; only valid with RUN_CMD