Separate the native AWS runtime wrapper

deploy/runtime/native-aws/Dockerfile

@@ -0,0 +1,35 @@
+# syntax=docker/dockerfile:1
+# Both inputs must be explicit accepted digest references. Build at repository root.
+ARG TS_NATIVE_PROVIDER_IMAGE
+ARG TS_NATIVE_RUNTIME_IMAGE
+FROM ${TS_NATIVE_PROVIDER_IMAGE} AS binary-source
+FROM ${TS_NATIVE_RUNTIME_IMAGE} AS runtime
+
+ARG TS_NATIVE_PROVIDER_IMAGE
+ARG TS_NATIVE_RUNTIME_IMAGE
+# No runtime operation needs setuid/setgid tools. Nonroot alone is insufficient.
+RUN set -eu; \
+    printf '%s\n' "$TS_NATIVE_PROVIDER_IMAGE" | grep -Eq '@sha256:[a-f0-9]{64}$'; \
+    printf '%s\n' "$TS_NATIVE_RUNTIME_IMAGE" | grep -Eq '@sha256:[a-f0-9]{64}$'; \
+    . /etc/os-release; test "$ID:$VERSION_ID" = debian:13; \
+    apt-get update; \
+    apt-get upgrade -y --no-install-recommends; \
+    apt-get install -y --no-install-recommends ca-certificates libgcc-s1 coreutils; \
+    rm -rf /var/lib/apt/lists/*; \
+    find / -xdev -type f -perm /6000 -exec chmod a-s {} +; \
+    install -d -m 0700 -o 10001 -g 10001 /run/trusted-server
+LABEL ts.native.provider-image="${TS_NATIVE_PROVIDER_IMAGE}" \
+      ts.native.runtime-image="${TS_NATIVE_RUNTIME_IMAGE}"
+WORKDIR /app
+COPY --from=binary-source --chmod=0555 /usr/local/bin/app /usr/local/bin/app
+COPY --from=binary-source /usr/local/share/ts-build-inputs.sha256 /usr/local/share/ts-build-inputs.sha256
+COPY --chmod=0555 deploy/runtime/native-aws/entrypoint.sh /usr/local/bin/ts-native-entrypoint
+ENV EDGEZERO__ADAPTER__HOST=0.0.0.0 \
+    EDGEZERO__ADAPTER__PORT=8787 \
+    EDGEZERO__STORE_BINDINGS_FILE=/run/trusted-server/native-bindings.toml
+USER 10001:10001
+# ECS must still qualify ownership on its matching task volume mount.
+VOLUME ["/run/trusted-server"]
+EXPOSE 8787
+STOPSIGNAL SIGTERM
+ENTRYPOINT ["/usr/local/bin/ts-native-entrypoint"]

deploy/runtime/native-aws/Dockerfile.dockerignore

@@ -0,0 +1,7 @@
+# This overrides the root deny-by-default context for this Dockerfile only.
+# Keep operator input/state/config files out of the deployment-image context.
+**
+!deploy/
+!deploy/runtime/
+!deploy/runtime/native-aws/
+!deploy/runtime/native-aws/entrypoint.sh

deploy/runtime/native-aws/README.md

@@ -0,0 +1,45 @@
+# Native AWS runtime wrapper
+
+This is the existing demo's runtime wrapper, separate from the source-built
+native image. Build at the repository root and supply two explicit digest
+references: `TS_NATIVE_PROVIDER_IMAGE` supplies the application binary and input
+manifest; `TS_NATIVE_RUNTIME_IMAGE` supplies the Debian 13 runtime. The wrapper
+neither builds TS nor provisions infrastructure. An accepted reference must name
+the image whose inputs and runtime checks were actually reviewed; syntax alone
+is not qualification.
+
+The image runs as UID/GID10001. `/run/trusted-server` must be an owned, writable
+private mount. Its declared volume does not establish ownership on an ECS task
+volume; that remains a deployment check. Keep the root filesystem read-only and
+provide required writable temporary storage when selecting that runtime mode.
+
+`TS_NATIVE_BINDINGS_TOML` contains provider identifiers/references, never secret
+values. The entrypoint publishes it as a literal0600 file under the private
+runtime directory. Optional `TS_NATIVE_GEO_PROFILE_TOML` is published the same
+way. Empty explicitly selected Geo input fails rather than selecting Off. With
+no profile content, inherited pointers cannot enable Geo. The application owns
+validation of both formats.
+
+After publication the wrapper removes those input-content variables and the
+local-provider directory defaults, then execs the application. It never sources
+or evaluates TOML. SIGTERM reaches the application directly. AWS credentials and
+referenced secret values belong to the selected runtime providers, not build
+arguments or public examples.
+
+```mermaid
+flowchart TD
+    A[Reviewed native binary image] --> C[Separate runtime wrapper]
+    B[Explicit Debian runtime image] --> C
+    C --> D[Publish literal private provider files]
+    D --> E[Exec native TS and forward signals]
+```
+
+Run the retained local publication and signal tests with the repository Node:
+
+```sh
+node --test deploy/runtime/native-aws/test-entrypoint.mjs
+```
+
+These tests do not establish that a selected binary/runtime image combination,
+ECS volume, IAM role or live front door has been qualified. No cloud operation
+or live input change belongs to this review unit.

deploy/runtime/native-aws/entrypoint.sh

@@ -0,0 +1,50 @@
+#!/bin/sh
+set -eu
+
+# This input contains provider identifiers and references, never secret values.
+if [ -z "${TS_NATIVE_BINDINGS_TOML:-}" ]; then
+    printf '%s\n' 'TS_NATIVE_BINDINGS_TOML is required' >&2
+    exit 1
+fi
+
+runtime_dir='/run/trusted-server'
+if [ ! -d "$runtime_dir" ] || [ ! -w "$runtime_dir" ] || [ ! -x "$runtime_dir" ]; then
+    printf '%s\n' 'Native bindings directory must be writable' >&2
+    exit 1
+fi
+
+umask 077
+temporary=$(mktemp "$runtime_dir/.native-bindings.XXXXXX")
+trap 'rm -f "$temporary"' 0
+trap 'exit 1' 1 2 15
+# printf treats the entire input as data. Never source or evaluate these bytes.
+printf '%s' "$TS_NATIVE_BINDINGS_TOML" > "$temporary"
+chmod 0600 "$temporary"
+mv -fT -- "$temporary" "$runtime_dir/native-bindings.toml"
+trap - 0 1 2 15
+
+# An absent profile keeps Geo Off. An explicitly empty profile is an error,
+# not an implicit fallback. The app owns typed parsing and provider selection.
+if [ "${TS_NATIVE_GEO_PROFILE_TOML+x}" = x ]; then
+    if [ -z "$TS_NATIVE_GEO_PROFILE_TOML" ]; then
+        printf '%s\n' 'TS_NATIVE_GEO_PROFILE_TOML must not be empty' >&2
+        exit 1
+    fi
+    temporary=$(mktemp "$runtime_dir/.native-geo.XXXXXX")
+    trap 'rm -f "$temporary"' 0
+    trap 'exit 1' 1 2 15
+    printf '%s' "$TS_NATIVE_GEO_PROFILE_TOML" > "$temporary"
+    chmod 0600 "$temporary"
+    mv -fT -- "$temporary" "$runtime_dir/native-geo.toml"
+    trap - 0 1 2 15
+    TS_NATIVE_GEO_PROFILE_FILE="$runtime_dir/native-geo.toml"
+    export TS_NATIVE_GEO_PROFILE_FILE
+else
+    # Do not let an inherited pointer or a previous volume file select Geo.
+    unset TS_NATIVE_GEO_PROFILE_FILE
+fi
+
+# The base image's local roots need not exist when both stores are remote.
+unset EDGEZERO__ADAPTER__CONFIG_DIR EDGEZERO__ADAPTER__DATA_DIR
+unset TS_NATIVE_BINDINGS_TOML TS_NATIVE_GEO_PROFILE_TOML
+exec /usr/local/bin/app "$@"