Skip to content
VirtEngine by DET.io Docs

HPC Workload Templates

VirtEngine ships a curated library of preconfigured HPC workload templates that simplify job submission and enforce security compliance. The five core ones are mpi-standard, gpu-compute, batch-standard, data-processing and interactive-session, alongside singularity-container and batch-array. They are compiled into the virtengine binary by hpc_workload_library (pkg/hpc_workload_library/templates.go:17), not stored on chain.

Custom templates can be authored, validated and signed as described below. Publishing one on-chain is not currently possible — see step 3.

Publishing flow

Section titled “Publishing flow”

  1. Define the template manifest. A template pins its runtime, resource envelope, security policy, entrypoint, and a parameter schema for tenants:

    {
      "template_id": "my-simulation",
      "name": "My Simulation Workload",
      "version": "1.0.0",
      "description": "Custom simulation workload for physics calculations",
      "type": "batch",
      "runtime": {
        "runtime_type": "singularity",
        "container_image": "ghcr.io/myorg/simulation:v1.2.3",
        "image_digest": "sha256:abc123...",
        "required_modules": ["gcc/11", "openmpi/4.1"]
      },
      "resources": {
        "min_nodes": 1,
        "max_nodes": 64,
        "default_nodes": 4,
        "min_cpus_per_node": 4,
        "max_cpus_per_node": 128,
        "default_cpus_per_node": 32,
        "min_memory_mb_per_node": 8192,
        "max_memory_mb_per_node": 256000,
        "default_memory_mb_per_node": 64000,
        "min_runtime_minutes": 5,
        "max_runtime_minutes": 2880,
        "default_runtime_minutes": 60,
        "network_required": true
      },
      "security": {
        "allowed_registries": ["ghcr.io", "docker.io"],
        "require_image_digest": true,
        "allow_network_access": false,
        "allow_host_mounts": true,
        "allowed_host_paths": ["/scratch", "/data"],
        "sandbox_level": "strict"
      },
      "entrypoint": {
        "command": "/opt/simulation/run.sh",
        "working_directory": "/work",
        "use_mpirun": true
      },
      "environment": [
        {"name": "SIM_THREADS", "value": "32"},
        {"name": "OUTPUT_DIR", "value_template": "/scratch/$USER/$SLURM_JOB_ID"}
      ],
      "parameter_schema": [
        {
          "name": "input_file",
          "type": "string",
          "description": "Path to input configuration",
          "required": true
        },
        {
          "name": "precision",
          "type": "enum",
          "enum_values": ["single", "double"],
          "default": "double"
        }
      ],
      "tags": ["simulation", "physics", "hpc"]
    }

  2. Sign the template. Templates must be cryptographically signed before publishing:

    import (
        "github.com/virtengine/virtengine/pkg/hpc_workload_library"
    )
    

    privateKey := loadProviderKey()
    signer := hpc_workload_library.NewTemplateSigner(privateKey)
    if err := signer.SignTemplate(template); err != nil {
        return err
    }

  3. There is no on-chain submission step. This chain cannot carry a workload template in a transaction at all, so there is nothing to propose and nothing to vote on. The steps below describe the manifest and signing work that does exist; publishing it on-chain does not.

Why the security block matters

Section titled “Why the security block matters”

The template’s security section is enforced, not advisory: registry allowlists, mandatory image digests, network-access policy, host-mount path allowlists, and sandbox level (strict) all constrain what tenant jobs can do on your nodes. Enforcement happens in the provider daemon, which reads the spec when it maps a template to a container and rejects an image outside allowed_registries or a missing digest when require_image_digest is set (pkg/provider_daemon/hpc_templates/container_mapper.go:300-320, :251-253). It is not applied by chain governance, and — per step 3 — no template reaches the chain to be reviewed at all. Reviewing a manifest before publishing it is the provider’s own responsibility.

Tenant-side consumption

Section titled “Tenant-side consumption”

The template CLI reads templates compiled into the virtengine binary. It does not query the chain, and it cannot show a published template, because nothing can be published (see step 3):

Terminal window
# Lists the built-in templates baked into the binary
virtengine hpc template list


# Shows one built-in template, or a local manifest with --file
virtengine hpc template show mpi-standard

list and show serve hpc_workload_library.GetBuiltinTemplates() (pkg/hpc_workload_library/templates.go:17, currently seven built-ins), so a template you create with virtengine hpc template create appears only if you pass that file back with --file. There is no chain-side template listing: no template query RPC is declared in sdk/proto/node/virtengine/hpc/v1/query.proto.

See Submitting HPC Jobs for the parameter-file format.