web-app.conf

# Example: pin a small web app at a specific upstream commit and run it
# under the launcher.
#
# Replace COMMIT_SHA with the full SHA you want this launcher image to bind
# to. The launcher refuses to start unless COMMIT_SHA is a full 40-hex SHA-1
# or 64-hex SHA-256. Branches, tags, and short SHAs are rejected.
#
# REPO_URL must be the public canonical URL of the workload repository. When
# the launcher image is built reproducibly, a verifier checks:
#
#   image digest -> launcher repo at commit L
#                -> this config file
#                -> upstream workload repo at COMMIT_SHA
#
# so the launcher and its config together pin exactly which workload code
# runs inside the dstack TEE.

REPO_URL=https://github.com/example-org/example-web-app.git
COMMIT_SHA=0000000000000000000000000000000000000000
WORK_DIR=/var/lib/trusted-workload-launcher/example-web-app

# Build step. The launcher does not know or care what your workload is; drop
# in whatever command produces a runnable artifact inside the checkout.
INSTALL_CMD="npm ci --omit=dev"

# Long-running command. The launcher exec()s this so the workload receives
# signals (SIGTERM from `docker stop`, etc.) directly.
RUN_CMD="node server.js"

# Optional: cd into a subdirectory of the upstream repo before install/run.
# Useful if the workload lives in a monorepo subpath. Absolute paths and
# paths containing '..' are rejected.
# REPO_SUBDIR=apps/web

# Optional: a second env file whose KEY=VALUE lines are exported into the
# environment of INSTALL_CMD and RUN_CMD. Use this for runtime configuration
# (listen address, secrets, etc.) — keeping it separate from the pin config
# means config-only edits do not perturb the trust-bearing fields above.
# CHILD_ENV_FILE=/etc/trusted-workload-launcher/web-app.env