eigen-skills

name: eigen-skills description: "Deploy any app to EigenCompute TEE — hardware-isolated Trusted Execution Environments with encrypted memory, sealed secrets, and cryptographic attestation" version: 1.1.5 metadata: emoji: "🔒" tags: ["eigencompute", "tee", "deploy", "ecloud"] user-invocable: true

EigenCompute Deploy Skill

One-command integration: install this skill and Claude Code can deploy any app to EigenCompute TEE.

npm install eigen-skills

FIRST-TIME SETUP (do these once)

Step 1: Install the ecloud CLI

npm install -g @layr-labs/ecloud-cli

Step 2: Generate keys and authenticate

For new users who have never used ecloud before:

ecloud auth generate --store

This generates a new private key AND stores it in the OS keyring in one step.

If they already have a private key:

ecloud auth login

This will prompt them to paste their existing private key.

Step 3: Verify authentication

ecloud auth whoami

Should show their address and "stored credentials".

Step 4: Subscribe to billing (required before first deploy)

ecloud billing subscribe

Check status:

ecloud billing status

Step 5: Ensure Docker is installed and running

Docker Desktop (or docker daemon) must be running. The deploy process builds and pushes images. Check with:

docker info

If Docker is not running, start Docker Desktop:

• macOS: open -a Docker
• Then wait for docker info to succeed before proceeding.

DEPLOYING AN APP (full playbook)

CRITICAL: The ecloud compute app deploy CLI is fully interactive with 6+ prompts. It CANNOT be run directly from a non-interactive shell. You MUST use an expect script to automate the prompts.

Step 1: Ensure the project has a Dockerfile

If the project does not have a Dockerfile, generate one based on the project type:

Node.js:

FROM node:20-slim
WORKDIR /app
COPY package*.json ./
RUN npm ci --omit=dev
COPY . .
EXPOSE 3000
CMD ["node", "index.js"]

Python:

FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
EXPOSE 8000
CMD ["python", "main.py"]

Go:

FROM golang:1.22-alpine AS builder
WORKDIR /app
COPY go.* ./
RUN go mod download
COPY . .
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o server .
FROM alpine:3.19
COPY --from=builder /app/server /server
EXPOSE 8080
CMD ["/server"]

Rust:

FROM rust:1.77-slim AS builder
WORKDIR /app
COPY . .
RUN cargo build --release
FROM debian:bookworm-slim
COPY --from=builder /app/target/release/app /app
EXPOSE 8080
CMD ["/app"]

Also create a .dockerignore:

node_modules
.git
target
__pycache__

Step 2: Build the Docker image

IMPORTANT: Must build for linux/amd64 — EigenCompute TEEs run on x86_64.

docker build --platform linux/amd64 -t <REGISTRY_USER>/<APP_NAME>:latest .

Step 3: Push to a container registry

The image must be in a public registry (Docker Hub or GHCR) so EigenCompute can pull it.

docker push <REGISTRY_USER>/<APP_NAME>:latest

Step 4: Deploy using an expect script

Create a file called deploy.exp and run it with expect. This handles all interactive prompts:

#!/usr/bin/expect -f
set timeout 300

spawn ecloud compute app deploy --name "<APP_NAME>" --image-ref "<REGISTRY_USER>/<APP_NAME>:latest" --skip-profile --log-visibility public

# Prompt 1: Build from verifiable source? -> No
expect "Build from verifiable source?"
send "n\r"

# Prompt 2: Choose deployment method -> "Deploy existing image from registry" (arrow down once)
expect "Choose deployment method:"
send "\033\[B\r"

# Prompt 3: Env file -> "Continue without env file" (arrow down once)
# If the project has a .env file, select "Enter path to existing env file" instead (just press enter)
expect "Choose an option:"
send "\033\[B\r"

# Prompt 4: Instance type -> default g1-micro-1v (just press enter)
# Use arrow keys to select a larger instance if needed
expect "Choose instance:"
send "\r"

# Prompt 5: Resource usage monitoring -> Yes (just press enter)
expect "resource usage"
send "\r"

# Catch any remaining prompts
expect {
    "Confirm" { send "y\r"; exp_continue }
    "(y/N)" { send "y\r"; exp_continue }
    "(Y/n)" { send "y\r"; exp_continue }
    eof { }
}

Run it:

chmod +x deploy.exp && expect deploy.exp

The output will contain the App ID and IP address on success:

App ID: 0x...
App is now running with IP: x.x.x.x

Step 5: Verify the deployment

ecloud compute app list
ecloud compute app info <APP_ID>

Instance types available

Manage deployed apps

ecloud compute app list
ecloud compute app info <APP_ID>
ecloud compute app logs <APP_ID>
ecloud compute app start <APP_ID>
ecloud compute app stop <APP_ID>
ecloud compute app terminate <APP_ID>
ecloud compute app upgrade <APP_ID>

Set sealed secrets (encrypted env vars, decrypted only inside TEE)

ecloud compute app env set MY_SECRET="value" API_KEY="key"

TEE attestation

Inside the TEE, the KMS signing key is at /usr/local/bin/kms-signing-public-key.pem. Verify at https://verify-sepolia.eigencloud.xyz.

Dashboard

View any deployed app at:

https://verify-sepolia.eigencloud.xyz/app/<APP_ID>