Hide `loader.entrypoint` manifest option

For end users, the `loader.entrypoint` manifest option is always the
LibOS binary. Similarly, `sgx.trusted_files` must always contain the
LibOS binary.

This commit is a counterpart to the commit "[python,CI-Examples] Hide
loader.entrypoint manifest option" in the core Gramine repo.

Signed-off-by: Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com>

[Docs] Remove highlight directive from README

This works around GitHub rendering bug that renders "sh" in this place.

Signed-off-by: Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com>

Set `sgx.max_threads` to 1 if EDMM is enabled

Latest Gramine (v1.6) introduced support for dynamic thread creation
when EDMM is enabled; in such cases `sgx.max_threads` doesn't need to be
set to an application-specific value.

Signed-off-by: Anjali Rai <anjali.rai@intel.com>

Add `/usr/lib` to PyTorch manifest

On Debian 12, PyTorch installation uses the package python3-torchvision
version 0.14.1. This version of python3-torchvision depends on the `libgloo.so`
library that is installed under `/usr/lib`. Before this commit, this directory
was missing from the PyTorch manifest file, so we need to add it.

Signed-off-by: Jinen Gandhi <jinen.gandhi@intel.com>

Do not fetch tokens

Starting from v1.4, Gramine automatically fetches tokens (only on SGX
platforms where it is required).

Signed-off-by: Anjali Rai <anjali.rai@intel.com>

Limit the number of threads for R example

The latest version of R (Patched 4.2.1) uses OpenBLAS with OpenMP,
which allocates 128MB of memory for each potentially created thread.
Since by default the number of threads is calculated by OpenBLAS as
the number of available CPU cores, this per-thread memory allocation
may quickly exceed the enclave size on large platforms.

To avoid running out of enclave memory, we set OMP_NUM_THREADS
environment variable to 4, to limit the number of created threads.

This was detected on a CentOS 8 platform with a large number of CPU
cores (Gramine ran out of enclave memory).

Signed-off-by: Anjali Rai <anjali.rai@intel.com>

Limit the number of threads for R example

The latest version of R (Patched 4.2.1) uses OpenBLAS with OpenMP,
which allocates 128MB of memory for each potentially created thread.
Since by default the number of threads is calculated by OpenBLAS as
the number of available CPU cores, this per-thread memory allocation
may quickly exceed the enclave size on large platforms.

To avoid running out of enclave memory, we set OMP_NUM_THREADS
environment variable to 4, to limit the number of created threads.

This was detected on a CentOS 8 platform with a large number of CPU
cores (Gramine ran out of enclave memory).

Signed-off-by: Anjali Rai <anjali.rai@intel.com>

Apply Make workaround for grouped targets to all examples

Signed-off-by: Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com>

Remove Apache example

It doesn't work in Gramine because it depends on Sys-V semaphores, and
these are not implemented in Gramine. Sys-V support was dropped from
Gramine in June 2021 (it was incorrect, insecure and buggy), but we
forgot to remove the Apache example.

Signed-off-by: Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com>

Update examples to use TOML-array syntax for files

All example manifests now use the TOML-array syntax for
`sgx.trusted_files`, `sgx.allowed_files` and `sgx.protected_files`.

Signed-off-by: Dmitrii Kuvaiskii <dmitrii.kuvaiskii@intel.com>