feat(launcher): Add ability to use the launcher also for non tee setups. by barakeinav1 · Pull Request #1735 · near/mpc

barakeinav1 · 2026-01-11T09:00:19Z

This PR allows the MPC launcher to run both inside TEEs and outside TEEs using the same orchestration flow, without weakening any existing TEE security guarantees.

A new measured PLATFORM mode (TEE / NONTEE) explicitly controls whether dstack/attestation is required. TEE behavior remains fail-closed and fully attested, while non-TEE deployments can exercise the launcher logic without dstack.

High-level changes

Introduce measured PLATFORM={TEE|NONTEE} environment variable
Enforce strict, fail-closed behavior in PLATFORM=TEE
Skip dstack / RTMR extension in PLATFORM=NONTEE
Gate dstack socket mount and env vars on platform
Explicitly signal MPC node via MPC_TEE_MODE

tests:
added a few python tests.
I also run a manually test an started an MPC node using the launcher

gilcu3

Looks quite good. I have only two blockers, and a few suggestions:

~~I think there is a bug in the order of parameters for the docker_cmd~~ not a bug see comment

I expected to see a CI step that could test this code, now that non-tee deployments are possible. We should have something similar to

mpc/.github/workflows/ci.yml

Lines 16 to 76 in d4ab0a5

    
             docker-tee-build: 
        
               name: "Build MPC Node TEE Docker image" 
        
               runs-on: warp-ubuntu-2204-x64-16x 
        
               timeout-minutes: 60 
        
               permissions: 
        
                 contents: read 
        
               steps: 
        
                 - name: Checkout repository 
        
                   uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 
        
                   with: 
        
                     persist-credentials: false 
        
                 - name: Install repro-env 
        
                   run: | 
        
                     wget 'https://github.com/kpcyrd/repro-env/releases/download/v0.4.3/repro-env' 
        
                     echo '2a00b21ac5e990e0c6a0ccbf3b91e34a073660d1f4553b5f3cda2b09cc4d4d8a  repro-env' | sha256sum -c - 
        
                     sudo install -m755 repro-env -t /usr/bin 
        
                 - name: Build MPC Node binary and image 
        
                   run: | 
        
                     export NODE_IMAGE_NAME=test_image_tag_ci 
        
                     ./deployment/build-images.sh --node 
        
                 - name: Check Docker image can initialize and start 
        
                   run: | 
        
                     touch /tmp/image-digest.bin 
        
                     # Test container startup - fail if container can't start 
        
                     # Start container in background and check status after 60 seconds 
        
                     CONTAINER_ID=$(docker run -d \ 
        
                     -v /tmp/:/data \ 
        
                     -e MPC_HOME_DIR="/data" \ 
        
                     -e MPC_ACCOUNT_ID=test_image.near \ 
        
                     -e RUST_BACKTRACE="full" \ 
        
                     -e RUST_LOG="mpc=debug,info" \ 
        
                     -e MPC_SECRET_STORE_KEY=BD399143F5B3126098B0EAA023A0E730 \ 
        
                     -e MPC_P2P_PRIVATE_KEY=ed25519:2WBi5gRyJntYA7dCyddiwNV2yNTdr5uZhrP4WX5GNBL5DSVCSR7ESvcXF2DBfY5oPYhzBmHnguPVSXjr6UCi8h1g \ 
        
                     -e MPC_ACCOUNT_SK=ed25519:6X3Bnghdf89WjHQfHDFYjW2UeNaNqCQ1AUGxX7zgvbJT4KSoeXzuHEdux6A2jsphTZTmS4SUGQRyYqC2ik3UrMP \ 
        
                     -e NEAR_BOOT_NODES=ed25519:ERguu7jQuYk8pxNsRC6FdezvNsegBPva1GRGqjmtD7i2@10.10.10.10:24567 \ 
        
                     -e MPC_CONTRACT_ID=v1.signer_test \ 
        
                     -e MPC_IMAGE_HASH=5ba283860c0efa3d4c3e08a76a2b77fab4725baad4f48504eac858e04af7fd64 \ 
        
                     -e MPC_LATEST_ALLOWED_HASH_FILE=/tmp/image-digest.bin \ 
        
                     -e MPC_BACKUP_ENCRYPTION_KEY_HEX=0000000000000000000000000000000000000000000000000000000000000000 \ 
        
                     -e MPC_ENV=mainnet test_image_tag_ci) 
        
                     if [ -z "$CONTAINER_ID" ]; then 
        
                       echo "❌ Failed to start container" 
        
                       exit 1 
        
                     fi 
        
                     echo "Container started: $CONTAINER_ID" 
        
                     # Check if container is actually running 
        
                     sleep 60 
        
                     if [ -z "$(docker ps --filter "id=$CONTAINER_ID" --format "{{.ID}}")" ]; then 
        
                       docker logs "$CONTAINER_ID" 2>&1 | head -50 
        
                       echo "❌ Container cannot initialize/start properly" 
        
                       exit 1 
        
                     fi 
        
                     echo "✅ Container started successfully"

but now including the NONTEE launcher part

gilcu3 · 2026-01-14T07:42:46Z

+    if not is_unix_socket(DSTACK_UNIX_SOCKET):
+        raise RuntimeError(
+            f"PLATFORM=TEE requires dstack unix socket at {DSTACK_UNIX_SOCKET}."
+        )


I guess this is orthogonal to the issue? Something missing from before?

related, not orthogonal. (let says 42 degrees)
If we don't have DSTACK_UNIX_SOCKET when running in TEE mode, this is a critical failure.
better to stop right away.

gilcu3 · 2026-01-14T07:44:54Z

just for consistency

Suggested change

image: nearone/mpc-launcher@sha256:72f16f1d1ca9119f5c19cb3ec7f6338949e2ad3082bd01ba2099c6649e845f61

gilcu3 · 2026-01-14T07:59:58Z

Thank you very much for this doc!

gilcu3 · 2026-01-14T08:00:23Z

NIce to see these tests!

barakeinav1 · 2026-01-14T11:56:25Z

I expected to see a CI step that could test this code, now that non-tee deployments are possible. We should have something similar to

let add this as a separate task

Add CI job to validate NON-TEE launcher-based MPC deployment
#1758

gilcu3

Thank you, left 2 nits in the doc

barakeinav1 changed the title ~~launcher: Add ability to use the launcher also for non tee setups.~~ feat(launcher): Add ability to use the launcher also for non tee setups. Jan 11, 2026

barakeinav1 force-pushed the launcher-nontee-support branch 3 times, most recently from 6292270 to 7b0d1af Compare January 11, 2026 12:52

barakeinav1 added 2 commits January 11, 2026 16:07

launcher: add measured PLATFORM mode for TEE vs non-TEE

f276807

add tests

c12dbe0

barakeinav1 force-pushed the launcher-nontee-support branch from 7b0d1af to c12dbe0 Compare January 11, 2026 16:08

barakeinav1 added 3 commits January 12, 2026 11:51

update yamls

d8985b4

doc

c7d8a89

update launcher template

4ae540c

barakeinav1 force-pushed the launcher-nontee-support branch from e04b57b to 4ae540c Compare January 13, 2026 08:47

barakeinav1 requested review from gilcu3, netrome and pbeza January 14, 2026 07:08

DSharifi previously approved these changes Jan 14, 2026

View reviewed changes

Comment thread tee_launcher/test_launcher_config.py Resolved

gilcu3 requested changes Jan 14, 2026

View reviewed changes

code review fixes

40f6ae2

barakeinav1 dismissed DSharifi’s stale review via 40f6ae2 January 14, 2026 09:58

review fixes

b4eedb4

barakeinav1 force-pushed the launcher-nontee-support branch from 5fa62d7 to b4eedb4 Compare January 14, 2026 10:23

DSharifi previously approved these changes Jan 14, 2026

View reviewed changes

stricter inputs

3b79d9a

barakeinav1 dismissed DSharifi’s stale review via 3b79d9a January 14, 2026 11:47

barakeinav1 added 2 commits January 14, 2026 11:59

ruff

68faa7f

update launcher hash

6fdf87a

barakeinav1 force-pushed the launcher-nontee-support branch from 87988f4 to 6fdf87a Compare January 14, 2026 12:09

barakeinav1 mentioned this pull request Jan 14, 2026

Add CI job to validate NON-TEE launcher-based MPC deployment #1758

Closed

Merge branch 'main' into launcher-nontee-support

3c8739e

DSharifi previously approved these changes Jan 14, 2026

View reviewed changes

gilcu3 previously approved these changes Jan 14, 2026

View reviewed changes

Comment thread tee_launcher/using_the_launcher_in_nontee_setup.md Resolved

Comment thread tee_launcher/using_the_launcher_in_nontee_setup.md Resolved

barakeinav1 added this pull request to the merge queue Jan 14, 2026

barakeinav1 removed this pull request from the merge queue due to a manual request Jan 14, 2026

doc cleanup

d618976

barakeinav1 dismissed stale reviews from gilcu3 and DSharifi via d618976 January 14, 2026 13:15

barakeinav1 requested review from DSharifi and gilcu3 January 14, 2026 13:16

gilcu3 approved these changes Jan 14, 2026

View reviewed changes

Merge branch 'main' into launcher-nontee-support

eb54f5a

barakeinav1 enabled auto-merge January 14, 2026 14:48

DSharifi approved these changes Jan 14, 2026

View reviewed changes

barakeinav1 added this pull request to the merge queue Jan 14, 2026

Merged via the queue into main with commit 1347c6e Jan 14, 2026
26 of 27 checks passed

barakeinav1 deleted the launcher-nontee-support branch January 14, 2026 16:11

	docker-tee-build:
	name: "Build MPC Node TEE Docker image"
	runs-on: warp-ubuntu-2204-x64-16x
	timeout-minutes: 60
	permissions:
	contents: read

	steps:
	- name: Checkout repository
	uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
	with:
	persist-credentials: false

	- name: Install repro-env
	run: \|
	wget 'https://github.com/kpcyrd/repro-env/releases/download/v0.4.3/repro-env'
	echo '2a00b21ac5e990e0c6a0ccbf3b91e34a073660d1f4553b5f3cda2b09cc4d4d8a repro-env' \| sha256sum -c -
	sudo install -m755 repro-env -t /usr/bin

	- name: Build MPC Node binary and image
	run: \|
	export NODE_IMAGE_NAME=test_image_tag_ci
	./deployment/build-images.sh --node

	- name: Check Docker image can initialize and start
	run: \|
	touch /tmp/image-digest.bin
	# Test container startup - fail if container can't start
	# Start container in background and check status after 60 seconds
	CONTAINER_ID=$(docker run -d \
	-v /tmp/:/data \
	-e MPC_HOME_DIR="/data" \
	-e MPC_ACCOUNT_ID=test_image.near \
	-e RUST_BACKTRACE="full" \
	-e RUST_LOG="mpc=debug,info" \
	-e MPC_SECRET_STORE_KEY=BD399143F5B3126098B0EAA023A0E730 \
	-e MPC_P2P_PRIVATE_KEY=ed25519:2WBi5gRyJntYA7dCyddiwNV2yNTdr5uZhrP4WX5GNBL5DSVCSR7ESvcXF2DBfY5oPYhzBmHnguPVSXjr6UCi8h1g \
	-e MPC_ACCOUNT_SK=ed25519:6X3Bnghdf89WjHQfHDFYjW2UeNaNqCQ1AUGxX7zgvbJT4KSoeXzuHEdux6A2jsphTZTmS4SUGQRyYqC2ik3UrMP \
	-e NEAR_BOOT_NODES=ed25519:ERguu7jQuYk8pxNsRC6FdezvNsegBPva1GRGqjmtD7i2@10.10.10.10:24567 \
	-e MPC_CONTRACT_ID=v1.signer_test \
	-e MPC_IMAGE_HASH=5ba283860c0efa3d4c3e08a76a2b77fab4725baad4f48504eac858e04af7fd64 \
	-e MPC_LATEST_ALLOWED_HASH_FILE=/tmp/image-digest.bin \
	-e MPC_BACKUP_ENCRYPTION_KEY_HEX=0000000000000000000000000000000000000000000000000000000000000000 \
	-e MPC_ENV=mainnet test_image_tag_ci)

	if [ -z "$CONTAINER_ID" ]; then
	echo "❌ Failed to start container"
	exit 1
	fi

	echo "Container started: $CONTAINER_ID"

	# Check if container is actually running
	sleep 60
	if [ -z "$(docker ps --filter "id=$CONTAINER_ID" --format "{{.ID}}")" ]; then
	docker logs "$CONTAINER_ID" 2>&1 \| head -50
	echo "❌ Container cannot initialize/start properly"
	exit 1
	fi

	echo "✅ Container started successfully"


	image: nearone/mpc-launcher@sha256:72f16f1d1ca9119f5c19cb3ec7f6338949e2ad3082bd01ba2099c6649e845f61

Conversation

barakeinav1 commented Jan 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

gilcu3 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

gilcu3 Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

barakeinav1 Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

gilcu3 Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

gilcu3 Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

gilcu3 Jan 14, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

barakeinav1 commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gilcu3 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

barakeinav1 commented Jan 11, 2026 •

edited

Loading

gilcu3 left a comment •

edited

Loading

barakeinav1 commented Jan 14, 2026 •

edited

Loading