Dolos Independent Snapshots COalition

DISCo

Trust TEE Me Bro

01. SECURE_PIPELINE

Cardano Node
Raw Ledger Data
Dolos Indexing
Inside TEE Enclave
Signed snapshot
TEE attested

02. NATIVE_INTEGRATION

Integrated natively in dolos:

dolosone-liner
$ dolos bootstrap snapshot --tee

03. VERIFY_CURRENT_SNAPSHOT

Click a network to fetch its latest attestation and verify the Intel TDX quote in your browser.

PREPRODComing soon

04. ACTIVE_OPERATORS

IOG
TxPipe

05. FREQUENTLY_ASKED

How is the snapshot attested?

Each snapshot is produced inside a confidential VM built on the underlying dstack software, running on Intel TDX hardware. dolos syncs the chain from genesis inside the TEE, and when the export completes the enclave requests an Intel TDX DCAP quote (via the dstack guest agent) with REPORT_DATA[0:32] = SHA256(content_sha256) — binding the hardware proof directly to the snapshot content. The quote's MRTD measurement proves which container image ran, and the RTMRs capture the runtime state. (The verifier also still supports AMD SEV-SNP for snapshots produced on Azure Confidential Compute.)

How do I verify a snapshot?

Run disco-cli verify *.manifest.json — or let dolos do it in one step with dolos bootstrap snapshot --tee, which downloads, verifies, and restores. Verification does three things: it recomputes content_sha256 independently from the tarball, checks that the TDX quote's REPORT_DATA[:32] equals SHA256(content_sha256), and verifies the DCAP signature chain — attestation key → Quoting-Enclave report → the PCK certificate chain embedded in the quote → Intel SGX Root CA (self-contained; no network calls needed). It prints the MRTD and RTMR0..3 measurements. A PASS means genuine Intel TDX silicon certified that this exact content was produced by this exact code.

Is the content hash reproducible?

Yes. content_sha256 is deterministic: SHA256 over chain_sha256 (all block segments) and index_sha256 (the archive B-tree index), taken from dolos's --canonical export — which rebuilds the store key-sorted so it is byte-identical across independent syncs. Two operators syncing the same network and epoch with the same dolos version arrive at the same hash. So you can verify a snapshot by running your own independent sync from genesis and comparing hashes — you don't have to trust the operator.

What does a snapshot contain?

A gzip tarball of the canonical dolos store at the end of the requested epoch: the archive (raw Cardano block segments + chain index), plus the derived ledger state and indexes — so it bootstraps a fresh, ready-to-serve dolos node without syncing from genesis. The content_sha256 covers the archive (the reproducible part); the manifest also records the chain tip (slot, height, block hash) for cross-checking against any independent block explorer.

Where are snapshots published?

At https://snapshots.disco.land (Cloudflare R2, CDN-fronted), organised by network: preview/, preprod/, mainnet/. Each directory contains the snapshot tarball, checksums, manifest, and attestation file, plus a latest.json pointing to the most recent snapshot for that network. dolos bootstrap snapshot --tee pulls and verifies straight from here.