Host an enclave

Host an enclave

Your hardware belongs on this list.

Enclave is an open market for confidential compute. Anyone with a machine that has a hardware TEE can run an enclave, claim funded work from the open queue, and be paid on chain for every lease they serve. There is no application to fill in and no account to be approved: your box proves what it is with an attestation, and the ledger does the rest.

The fleet you would be joining

Every box below is serving right now, with the capacity it has left. Yours would appear here once it registers.

Your hardware belongs on this list. Run an enclave on a box you own, claim paid work from the open queue, and the ledger pays your wallet for every lease you serve. Host an enclave →

What you need

  • A CPU with a hardware TEE and virtualisation available to the OS. Confidential VMs are what make the guarantee real, so a box without one can run the stack in dev mode but cannot sell.
  • Linux with KVM and a few gigabytes of RAM to give the guest. The build runs unprivileged; only the one-time device permission needs root.
  • A little gas. Your box registers itself and claims work with its own key, which costs a few cents of Base ETH. The CLI funds it from your wallet in one transfer.
  • No public IP. The enclave dials out and holds the connection, so a home machine behind CGNAT works.
  • A GPU is optional. CPU-only boxes serve CPU work; a GPU in confidential-computing mode sells GPU shares too.

Setting it up

Everything is one command line tool. Each step below is also a plain script in the repository if you would rather drive it yourself.

curl -fsSL https://get.enclave.host | sh

enclave host init      # mint this box's key, write its config
enclave host build     # build the measured guest image
enclave host run       # boot it, ctrl-c to stop
enclave host check     # is it answering, is the quote real hardware
enclave host install   # run it under systemd instead, enabled at boot

enclave host build assembles the guest from the same published images the hosted fleet runs, and folds the kernel, the initramfs and the boot arguments into the launch measurement. That measurement is reproducible: anyone can rebuild it and check that the number your box reports is the number the published release produces.

Getting paid

Once the box has gas, it registers itself and starts claiming funded deployments from the queue. The ledger escrows the runner share of what each deployment pays and credits it to your operator key for the time you actually hold the lease, and it sweeps to whatever wallet you named when the balance clears the payout threshold. Nobody holds your earnings on your behalf.

enclave host fund --eth 0.002   # gas the box, one signed transfer
enclave host status             # gas left, serving or not, earnings accrued

You set your own price. A box can name what it charges per hour for a full node and, if it has one, a full card. It then refuses work paying less than that, and the number is published alongside its capacity so buyers can see it.

enclave host init --price-cpu 2.50 # USD per hour for a full node

What tenants get, and what you can see

Apps that land on your box run inside the confidential VM, and the memory of that VM is encrypted by the processor against you as much as against anyone else. You host the work without being able to read it. Their TLS terminates inside the enclave too, so traffic passes through your machine as ciphertext.

That cuts both ways, and it is the point: buyers do not have to trust you, so they do not have to know who you are. What they check is the attestation your box produces, against the measurement of a published release.

Read the details

The full protocol, the trust argument and the operator notes live with the code:

  • Enclave Metal, how the self-hosted server is built and why its attestation is stronger than a managed one.
  • The hosting protocol, how an anonymous box proves itself, claims work and is paid.