Overview
Join another computer and EnclaveStack places new resources wherever there is room. Networks span the machines, apps restart elsewhere when one goes offline, and you can move anything — data included — or drain a machine before you unplug it.
When to use it
- More memory or disk than one computer has.
- Keep apps running when one computer goes down.
- Put disk-heavy work on the machine with the fast disk.
How it works
- The agent
- The same enclave program, run as an agent on the other computer, serving its Docker Engine and QEMU over HTTPS on port 7071.
- Mutual TLS
- An EnclaveStack certificate authority (ECDSA P-256) and one-time join codes valid for an hour.
- WireGuard mesh
- Networks span machines through an encrypted tunnel.
Each machine is checked every 10 seconds and is offline after 30 seconds of silence. Placement picks the online, schedulable machine with the most free memory, or the one you name, or one with the labels you ask for. A move copies the data first, then switches, keeping the address.
Architecture
- You to Control plane
- Control plane to main
- Control plane to rack-1 (agent): mTLS
- main to rack-1 (agent): WireGuard
Flows
Joining a computer
- Add a machine; EnclaveStack prints a one-time join command.
- Run it on the other computer with Docker running.
- It shows online and takes new resources.
When a machine goes offline
- After 30 seconds without an answer it is offline.
- Apps without data restart on another machine after a minute.
- Data waits for its machine and carries on when it returns.
Set it up
In the console
- Open Machines and choose Add machine.
- Copy the join command.
- Run it on the other computer.
With the CLI
enclave machine add rack-1 --label disk=ssdWith OpenTofu
OpenTofu configuration
resource "enclave_machine" "rack_1" {
name = "rack-1"
labels = { disk = "ssd" }
}Settings reference
Every setting and output of the OpenTofu resource; the console and the CLI use the same names in their own words. Generated from platform 4d30582.
| Name | Type | Use | What it does |
|---|---|---|---|
name | text | required | Machine name. Changing it replaces the machine. |
labels | map of text | optional | Labels resources can ask for with machine_labels (up to 10). Change in place. |
schedulable | true or false | optional | Whether new resources may be placed here (false keeps what runs there). |
address | text | output | Where its agent is reached, once joined. |
id | text | output | Resource ID. |
join_command | text | output | The command that joins the machine's agent, valid for an hour and once; empty once joined. |
state | text | output | waiting (for its agent), online or offline (refreshed on read). |
Limits and security
Good to know
- Machines must run the same minor version.
- The main machine can’t be drained or removed.
Security
- Agents accept only the control plane’s certificate; join codes work once.