Nova Enclave Capsule
Build, package, and deploy trusted Nitro Enclave applications without the raw infrastructure headache.
Nova Enclave Capsule is an open-source toolkit that abstracts the complexity of AWS Nitro Enclaves. It provides a high-level runtime surface for attestation, secure networking, and key management—letting you focus on shipping value instead of operations.
From TEE Integration to Product Workflow
Traditional enclave projects often stall at the "integration" phase. Capsule turns Nitro Enclaves into a predictable product workflow.
The Integration Project (Old Way)
- Handling raw vsock & CID complexity
- Building custom proxy layers
- Integrating hardware-specific SDKs
- Fragile time-sync & log plumbing
The Capsule Workflow (New Way)
- ✓ Standard Docker-based builds
- ✓ Zero-config Ingress/Egress proxies
- ✓ High-level RESTful Capsule APIs
- ✓ Stable, supervised runtime environment
Architecture & Modules
Capsule is built as a layered system to ensure security, isolation, and developer productivity.
Capsule CLI & Shell
The CLI builds your Docker app into an EIF (Enclave Image Format). The Shell acts as the entrypoint in your host container, wrapping nitro-cli to launch the enclave securely.
Capsule Runtime
The core supervisor running inside the enclave. It manages the app lifecycle, handles networking (ingress/egress), synchronizes the clock, and exposes the Capsule API.
version: "v1"
run:
ingress:
- port: 8080
target: 8080 # App port inside enclave
egress:
allow: ["api.openai.com", "eth-mainnet.alchemy.com"]
mounts:
- path: "/data"
source: "hostfs"
Core Features
Ingress & Egress Control
Securely route traffic into your app and whitelist outbound HTTP/HTTPS destinations. No raw proxy setup required.
Host-backed Mounts
Expose host directories inside the enclave as normal filesystem paths using our transparent hostfs proxy.
Clock Sync
Keeps the enclave wall clock accurately aligned with the host—critical for TLS and time-sensitive signing.
Runtime Supervision
Streams app logs to the host console and monitors exit status for robust production reliability.
The Capsule API Suite
We provide a unified API surface at localhost so your app never has to touch low-level Nitro SDKs.
Attestation & Randomness
Fetch signed attestation documents (Enclave Identity) and high-entropy random seeds via simple HTTP calls.
KMS & Wallet Integration
Securely derive keys and sign transactions using Nova KMS-backed identities. Supports Ethereum (secp256k1) and P-384 ECDH encryption.
S3-Backed Storage
Encrypted object storage flows that link your enclave identity directly to cloud storage buckets.
What can you ship?
Private AI Backends
Protect prompts, user context, and model parameters inside a verifiable boundary.
Risk & Policy Engines
Run scoring and fraud detection logic that is verifiable and tamper-proof.
Signing Orchestration
Keep sensitive signing flows closer to the edge with hardware-backed security.
Developer Guide
Start from a template, develop locally with a mock service, and deploy to Nitro when ready.
Explore Examples
Check nova-app-examples for real-world patterns like secure fetchers and wallet integrations.
Build & Launch
Run capsule-cli build to generate your EIF and launch it on your local Nitro-enabled EC2 instance.