Host an enclave

On a Windows PC

Each app runs in its own Enclave Shield partition, a Hyper-V virtual machine on a PC that has proven to the network, through its TPM, that it booted securely. Setup checks the PC, turns on Hyper-V and asks you to name your host. Joining costs nothing: once the PC proves its hardware, its first registration is paid for you.

Setup can also be run from PowerShell:

irm https://get.enclave.host/host.ps1 | iex

On an Android phone

Each app runs in its own protected virtual machine, which Android itself cannot reach into, and the phone proves to the network which build of the app it runs before it is sent any work. Install the app and open it: it asks for the virtual-machine permission once, through the phone's Wireless debugging, makes its key and starts hosting. Its screen is the same hosting panel as the Windows app: hosting on or off, how much of the phone to share, your price, earnings and payout.

The fleet you would be joining

Marketplace hosts show their available capacity and protection badges. Connect your wallet to also see owner-only hosts you’re authorized to use.

What can be listed

• A confidential server: a CPU with a hardware TEE, optionally a GPU in confidential-computing mode. Tenants' memory is encrypted against your operating system and their TLS terminates inside the VM. It is listed with a jade tee cpu badge and sells the full service; the rest of this page describes it.
• An Enclave Shield host: hardware-enforced CPU isolation keeps the host OS out, even without a confidential-computing processor. It must pass the same acceptance tests before taking tenant work.
• Any other GPU, including a card beside a confidential processor: it serves through Shield's masked offload, whatever the CPU or operating system. A card in a supported confidential-computing mode runs inside the boundary instead. Admission reads proof of the card's own mode, and a card is neither advertised nor routed until Shield's checks pass.

Eligibility comes from proof checked at attach, never from what a machine says about itself or which operating system it runs. A machine takes general tenant work only after marketplace admission, which for a new confidential box means a published allowlist of measurements. Owner-authorized hosting is listed separately when it has active deployments and does not grant admission. What each level guarantees, exactly →

What a confidential server needs

• A CPU with a hardware TEE and virtualisation available to the OS. Confidential VMs are what make the guarantee real; a box without one cannot sell this tier.
• Linux with KVM and a few gigabytes of RAM to give the guest. The build runs unprivileged; only the one-time device permission needs root.
• A little gas. Your box registers itself and claims work with its own key, which costs a few cents of Base ETH. The CLI funds it from your wallet in one transfer.
• No public IP. The enclave dials out and holds the connection, so a home machine behind carrier NAT works.
• A GPU is optional. CPU-only boxes serve CPU work; a GPU in confidential-computing mode sells GPU shares too.

Setting it up

Everything is one command line tool. Each step below is also a plain script in the repository if you would rather drive it yourself.

curl -fsSL https://get.enclave.host | sh

enclave host init      # mint this box's key, write its config
enclave host build     # build the measured guest image
enclave host run       # boot it, ctrl-c to stop
enclave host check     # is it answering, is the quote real hardware
enclave host install   # run it under systemd instead, enabled at boot

enclave host build assembles the guest from a tagged release, and folds the kernel, the initramfs and the boot arguments into the launch measurement.

Getting paid

Once the box has gas, it registers itself and claims funded deployments from the queue. The ledger escrows the runner share of each payment, credits your operator key for the time you actually hold the lease, and sweeps the balance to the wallet you named once it clears the payout threshold.

enclave host fund --eth 0.002   # gas the box, one signed transfer
enclave host status             # gas left, serving or not, earnings accrued

You set your own price. A box can name what it charges per hour for a full node and, if it has one, a full card. It then refuses work paying less than that, and the number is published alongside its capacity so buyers can see it.

enclave host init --price-cpu 2.50 # USD per hour for a full node

What tenants get, and what you can see

Apps that land on a confidential server each run in their own confidential VM, and the memory of each VM is encrypted by the processor against your operating system and every process on it, root included. You host the work without being able to read it. Their TLS terminates inside the enclave too, so traffic passes through your machine as ciphertext.

That cuts both ways, and it is the point: buyers do not have to trust you, so they do not have to know who you are. What they check is the attestation your box produces, against the measurement of a published release.

One limit is told to buyers, not hidden: the processor defends memory against software, not against physical attacks with lab equipment, and you have physical access to your own machine. Buyers who need to rule that out see who runs each host and choose accordingly. The limit, in the architecture notes →

Read the details

The full protocol, the trust argument and the operator notes live with the code:

• Enclave Metal, how the self-hosted server is built and why its attestation is stronger than a managed one.
• The hosting protocol, how an anonymous box proves itself, claims work and is paid.
• The Architecture tab under Develop, every protection level with its mechanism, its evidence and its status.