duckdb.manifest.template

# This is a general manifest template for running DuckDB.
# Don't use this manifest in production

loader.entrypoint = "file:{{ gramine.libos }}"
libos.entrypoint = "{{ execdir }}/duckdb/build/release/duckdb"

#loader.log_level = "{{ log_level }}"
loader.log_level = "error"

loader.insecure__use_cmdline_argv = true

loader.env.LD_LIBRARY_PATH = "/lib:{{ arch_libdir }}"
loader.env.PATH = "{{ execdir }}"
# Set HOME to suppress "warning: cannot find home directory"
loader.env.HOME = "/"
# loader.env.MALLOC_ARENA_MAX = "1"
sys.insecure__allow_eventfd = true

fs.mounts = [
  { path = "/lib", uri = "file:{{ gramine.runtimedir() }}" },
  { path = "{{ arch_libdir }}", uri = "file:{{ arch_libdir }}" },
  #{ path = "{{ execdir }}/duckdb/build/release/duckdb", uri = "file:{{ execdir }}/duckdb/build/release/duckdb" },
  { path = "{{ execdir }}", uri = "file:{{ execdir }}" },
  #{ path = "{{ execdir }}/benchmarks", uri = "file:{{ execdir }}/benchmarks" },
  # { path = "{{ execdir }}/duckdb/build/release/src/libduckdb.so", uri = "file:{{ execdir }}/duckdb/build/release/src/libduckdb.so" },
]

# Unfortunately, non-SGX Gramine cannot use special keys such as "_sgx_mrenclave", so for this
# example to work on both non-SGX and SGX versions we hardcode a dummy key. In SGX production case,
# it is recommended to remove this insecure key and instead use "_sgx_mrenclave"/"_sgx_mrsigner".
fs.insecure__keys.default = "ffeeddccbbaa99887766554433221100"

#sgx.debug = true
sgx.edmm_enable = false
sgx.enclave_size = "2G"
sgx.max_threads = 1000
sgx.use_exinfo = true
sgx.insecure__allow_memfaults_without_exinfo = true
# sgx.enable_stats = true
sgx.preheat_enclave = true
# sgx.profile.mode = "ocall_outer"
# sgx.profile.with_stack = 1
# sgx.insecure__rpc_thread_num = 64

sgx.trusted_files = [
  "file:{{ gramine.libos }}",
  "file:{{ execdir }}/duckdb/build/release/duckdb",
  "file:{{ gramine.runtimedir() }}/",
  "file:{{ arch_libdir }}/",
  "file:{{ execdir }}/scripts/test.sql",
  # "file:{{ execdir }}/build/release/src/libduckdb.so",
]

sgx.allowed_files = [
  "file:benchmarks/orders.parquet",
  "file:test.duckdb",
  "file:test.duckdb.wal",
]