mainnet-worker-0142-3
Worker
mainnet
instance 1 of 5
running · up 24days 5h 5m 31s
2
TDX Hardware — Attestation
The hardware-signed TDX quote, verified against Intel's PCS collateral — the Intel DCAP signature chain, not Intel Trust Authority.
verifying…
Quote not decoded yet — showing the measurements as reported (to be cryptographically verified).
mrtd7fe60787222bd394cb516abca2435f22f035ab2cc9c0a4b4b3b148e46297f3d931a237b72f359052c6e657d8c1409173
rtmr0530526e456733dff151712d1db1728cfc3bc85ed0a6c13653add2e644c57068009595b935f6a50ce4a714bad2b33bc8e
rtmr1e8601b64942f9f7a66f4d8f5727c0a7d4a71953cfc3c7d13e043f8ddf4f94d2358afd17e01f567a5d8209f3cf7479489
rtmr2ad1ed113dbecf8516b1ae1ba33a5188d61dd4a4baf5c181c1dd3c61ed8b91a624b5ac2242328028e540d9a2fb4f2dbfe
rtmr3001f49dde2ea600119c298ca92212f044d220bedaf067ee5cc817103350d201538224a0880014830ca3d988b7f159b75
3
Source Code — Compose
The measured app-compose that pins exactly which container images run.
| Container | Image | Digest | Verify |
|---|---|---|---|
| worker | docker.io/outlayer/near-outlayer-workerOutLayer-built | sha256:9695defb09208e0f5385551915573f2793f6785ca14d3a8a1fca18f2785dca52 | Sigstore ↗ release ↗ |
Each digest above is the one measured into RTMR3, so the attestation binds the running code to this exact image; the Sigstore link ties that digest back to its build provenance.
app-compose (measured source identity)
{
"manifest_version": 2,
"name": "outlayer-worker-mainnet-0.1.42",
"runner": "docker-compose",
"docker_compose_file": "# OutLayer worker — deployed as a dstack CVM on a self-hosted TDX node.\n#\n# - image is pinned BY DIGEST (verifiable, Sigstore-attested release build) so the\n# app-compose hash (measured into RTMR3) is deterministic. 40-deploy-worker.sh\n# rewrites this digest for the chosen --version from the GitHub release.\n# - secrets are NOT here: env VALUES come via `vmm-cli ... --env-file worker.env`\n# (encrypted by the per-node KMS + embedded as a ciphertext blob). The compose text\n# keeps only ${VAR} references, so plaintext secrets never enter the measured compose;\n# dstack decrypts the env inside the CVM and docker-compose substitutes at runtime.\n# - the worker is outbound-only (polls the coordinator); no inbound ports.\n# - /var/run/dstack.sock is provided by dstack inside the CVM (TDX quotes).\n# - single worker service, no compiler sidecar (COMPILATION_ENABLED=false); no docker.sock —\n# execution is in-process wasmedge.\n\nservices:\n worker:\n image: docker.io/outlayer/near-outlayer-worker@sha256:9695defb09208e0f5385551915573f2793f6785ca14d3a8a1fca18f2785dca52\n restart: on-failure:5\n environment:\n API_BASE_URL: ${API_BASE_URL}\n API_AUTH_TOKEN: ${API_AUTH_TOKEN}\n NEAR_RPC_URL: ${NEAR_RPC_URL}\n OFFCHAINVM_CONTRACT_ID: ${OFFCHAINVM_CONTRACT_ID}\n OPERATOR_ACCOUNT_ID: ${OPERATOR_ACCOUNT_ID}\n # In TEE mode the operator key is generated at registration; only set for legacy mode.\n OPERATOR_PRIVATE_KEY: ${OPERATOR_PRIVATE_KEY:-}\n TEE_MODE: ${TEE_MODE}\n USE_TEE_REGISTRATION: ${USE_TEE_REGISTRATION}\n # Signature scheme for the on-chain worker key: ed25519 (default) or ml-dsa-65.\n WORKER_KEY_TYPE: ${WORKER_KEY_TYPE:-ed25519}\n COMPILATION_ENABLED: ${COMPILATION_ENABLED}\n # NOTE: do NOT pass COMPILATION_MODE to an EXECUTION worker. The worker rejects\n # COMPILATION_MODE=native + EXECUTION_ENABLED=true (a native compiler could exfiltrate\n # env secrets). This is an execution-only worker (COMPILATION_ENABLED=false), so leave\n # COMPILATION_MODE unset for an execution-only worker. (The env file may still\n # carry it harmlessly; the worker only sees what this compose passes.)\n EXECUTION_ENABLED: ${EXECUTION_ENABLED}\n # Init account pays gas for worker registration when USE_TEE_REGISTRATION=true.\n INIT_ACCOUNT_ID: ${INIT_ACCOUNT_ID:-}\n INIT_ACCOUNT_PRIVATE_KEY: ${INIT_ACCOUNT_PRIVATE_KEY:-}\n KEYSTORE_BASE_URL: ${KEYSTORE_BASE_URL:-}\n KEYSTORE_AUTH_TOKEN: ${KEYSTORE_AUTH_TOKEN:-}\n RUST_LOG: ${RUST_LOG:-info}\n SAVE_SYSTEM_HIDDEN_LOGS_TO_DEBUG: ${SAVE_SYSTEM_HIDDEN_LOGS_TO_DEBUG:-false}\n PRINT_WASM_STDERR: ${PRINT_WASM_STDERR:-false}\n ENABLE_EVENT_MONITOR: ${ENABLE_EVENT_MONITOR:-false}\n NEARDATA_API_URL: ${NEARDATA_API_URL:-}\n FASTNEAR_API_URL: ${FASTNEAR_API_URL:-}\n START_BLOCK_HEIGHT: ${START_BLOCK_HEIGHT:-0}\n WASM_CACHE_MAX_SIZE_MB: ${WASM_CACHE_MAX_SIZE_MB:-100}\n POLL_TIMEOUT_SECONDS: 30\n volumes:\n - /var/run/dstack.sock:/var/run/dstack.sock:ro\n",
"kms_enabled": true,
"gateway_enabled": false,
"local_key_provider_enabled": false,
"key_provider_id": "",
"public_logs": true,
"public_sysinfo": false,
"allowed_envs": [
"API_BASE_URL",
"API_AUTH_TOKEN",
"NEAR_RPC_URL",
"NEARDATA_API_URL",
"FASTNEAR_API_URL",
"START_BLOCK_HEIGHT",
"KEYSTORE_BASE_URL",
"KEYSTORE_AUTH_TOKEN",
"USE_TEE_REGISTRATION",
"TEE_MODE",
"EXECUTION_ENABLED",
"COMPILATION_ENABLED",
"COMPILATION_MODE",
"SAVE_SYSTEM_HIDDEN_LOGS_TO_DEBUG",
"PRINT_WASM_STDERR",
"INIT_ACCOUNT_ID",
"INIT_ACCOUNT_PRIVATE_KEY",
"WORKER_KEY_TYPE",
"OFFCHAINVM_CONTRACT_ID",
"OPERATOR_ACCOUNT_ID",
"RUST_LOG",
"ENABLE_EVENT_MONITOR",
"DOCKER_IMAGE",
"WASM_CACHE_MAX_SIZE_MB",
"MAX_EXECUTION_SECONDS_CAP",
"ITERATION_OVERHEAD_SECONDS"
],
"no_instance_id": true,
"secure_time": false
}
image_digests
docker.io/outlayer/near-outlayer-worker@sha256:9695defb09208e0f5385551915573f2793f6785ca14d3a8a1fca18f2785dca52
4
Network — Zero Trust Gateway
TLS terminates inside the TEE — the gateway never sees plaintext.
guarded domaincbd8fd429d1d7589a9949567b995c869ee735b5a-8081.dstack.outlayer.ai
5
App OS
The measured dstack guest OS image. The version is read live from each CVM's vm_config; the
os_image_hash is the precise, measured OS identity.
dstack releases ↗.
os_versiondstack-0.5.11
os_image_hashc2aa0186182fe8a404f16d5f3facb334d89be32703b3571c401b114a8b6e700d
mr_aggregated0b302bc3a0ced7f7a966b8fb15642722586d657947b3dd4db39c9f6e5eb810b2
compose_hashcbd8fd429d1d7589a9949567b995c869ee735b5a27801cb890205da8caa6b800
6
KMS — deploy-time key provisioning
Deploy-time only. Governed by an on-chain contract, the dstack KMS releases this CVM's keys at boot only if its measurements are approved — those keys decrypt the deployment env file (so secrets never enter the measured compose) and provision the CVM's RA-TLS identity + disk encryption. This secures how the worker is deployed; it does not hold OutLayer's application or user secrets — those run through the OutLayer keystore (master derived in-TEE via MPC), not the dstack KMS.
key_provider
kms