blockbox

blockbox

Hardware-Attested Daemonless Container Execution Appliance (BlockBox Pods) Silicon-enforced memory encryption and deterministic launch attestation for enterprise confidential workloads.

---

Overview

Traditional container execution environments rely on shared host kernels and plaintext system memory, leaving critical enterprise and AI workloads exposed to host hypervisor vulnerabilities, state tampering, and un-attested runtime drift.

BlockBox provides a daemonless container execution appliance rooted directly in enterprise silicon (Intel TDX and AMD SEV-SNP):

• Hardware-Enforced Confidentiality: Workloads execute inside dedicated, memory-encrypted enclaves. Host hypervisors and cloud operators have zero access to memory contents.
• Deterministic Silicon Attestation: Generates cryptographically verifiable hardware attestation quotes (RTMR measurements) binding container state and output data.
• Daemonless Execution: Direct hardware launch with zero persistent root daemon attack surface.
• Audit-Ready Commitments: Deterministic output binding with SCITT transparency receipt alignment.

---

Installation

npm install blockbox

Or run directly via npx:

npx blockbox info

---

Quickstart

import { createBlockBoxManifest, BlockBoxPodRunner } from 'blockbox';

// 1. Define immutable pod manifest
const manifest = createBlockBoxManifest({
  podName: 'settlement-risk-pod',
  entrypoint: 'dist/app.js',
  binaryContentOrHash: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855',
  architecture: 'intel-tdx',
  vCpu: 4,
  memoryMb: 4096,
  allowedEgressHosts: ['api.ashlar.blue']
});

// 2. Instantiate runner inside hardware enclave boundary
const runner = new BlockBoxPodRunner(manifest);

// 3. Execute sensitive workload with deterministic silicon attestation
const result = await runner.runTask({ transactionId: 'TX-90412' }, async (input) => {
  return { approved: true, riskScore: 0 };
});

console.log('Execution Status:', result.status);
console.log('SCITT Digest:', result.quote.scittDigest);
// -> "scitt:quote:sha256:7f9a1..."

---

CLI Usage

# Display appliance status and silicon runtime parameters
npx blockbox info

# Generate a starter manifest
npx blockbox init my-pod > blockbox-manifest.json

# Validate a manifest file
npx blockbox verify blockbox-manifest.json

# Calculate deterministic RTMR measurements
npx blockbox measure blockbox-manifest.json

---

Documentation & Live Appliance

• Appliance Console: https://blockbox.blue
• Corporate Entity: Corrente Labs, Inc.
• Inquiries: contact@correntelabs.com

---

License

Apache-2.0. Copyright Corrente Labs, Inc.