How enclaviaio/enclavia works
Enclavia is an auditable enclave runtime and client ecosystem. The primary user workflow is to use the CLI to manage and deploy an enclave, then connect with the Rust or WASM SDK: the SDK establishes an attestation-anchored encrypted channel through the router, and the enclave server forwards application traffic to the container. In parallel, enclave services provide outbound-network policy, encrypted persistent storage with anti-rollback checks, key management, and attested upgrade history. The README documents additional capabilities whose implementation was not sampled; those are represented only where the tree supports a source path, and uncertain wiring is omitted.
Main entry points: src/main.rs Enclave server · client.rs Rust client SDK · src/main.rs Synchronizer · src/main.rs Egress daemon
Components 23
Client access
- CLI commands
enclavia-cli/src/main.rs - Rust client SDK
enclavia/src/client.rs - WASM bindings
enclavia-wasm/src/lib.rs
Enclave runtime
- Enclave server
enclavia-server/src/main.rs - Egress daemon
enclavia-egress/src/main.rs - Egress policy
enclavia-egress/src/policy.rs - Hostname resolver
enclavia-egress/src/resolver.rs
Storage security
- Key manager
enclavia-crypto/src/main.rs - NBD storage client
nbd-client/src/main.rs
Attestation and trust
- Wire protocol
enclavia-protocol/src/lib.rs - Boot chain submitter
enclavia-chain-init/src/main.rs
Cluster coordination
- Synchronizer
synchronizer/src/main.rs - Raft replication
synchronizer/src/raft/mod.rs - Mesh identity fetcher
synchronizer-names-init/src/main.rs
Other components
- Enclave user
- Hosted control plane
- WebSocket router
- Container workload
- Host egress relay
- AWS KMS
- Host storage relay
- Host chain relay
- Nitro security module
Connections 22
- Enclave user → CLI commands: runs commands
- CLI commands → Hosted control plane: manages lifecycle
- Enclave user → Rust client SDK: sends requests
- Rust client SDK → WebSocket router: opens WebSocket
- WASM bindings → Rust client SDK: binds client API
- WebSocket router → Enclave server: forwards channel
- Enclave server → Container workload: forwards plaintext
- Rust client SDK → Wire protocol: uses wire types
- Enclave server → Wire protocol: uses wire types
- Enclave server → Nitro security module: requests attestation
- Egress daemon → Egress policy: checks flows
- Egress daemon → Hostname resolver: resolves hostnames
- Egress daemon → Host egress relay: dials over vsock
- Key manager → AWS KMS: requests key operations
- Key manager → Host storage relay: reads key blob
- NBD storage client → Host storage relay: serves block I/O
- NBD storage client → Synchronizer: checks and pins freshness
- Synchronizer → Raft replication: replicates volume state
- Synchronizer → Nitro security module: attests mesh identity
- Boot chain submitter → Nitro security module: collects attestation
- Boot chain submitter → Host chain relay: submits chain link
- Mesh identity fetcher → Synchronizer: provides routing identity