I'm currently evaluating AWS Nitro Enclaves for isolating a reasoning agent that operates on sensitive financial data. The agent itself is a moderately large PyTorch model (approximately 4.2 GB in `.pt` format) bundled with a custom inference server. My goal is to package the entire runtime—server binary, model file, and configuration—into a single Enclave Image File (EIF) for attestation and secure deployment.

However, the `nitro-cli build-enclave` command consistently fails during the EIF creation process when I include the model asset. The error is rather generic, indicating a failure in the PCR calculation, but I suspect it's related to the size of the final disk image or perhaps filesystem nuances within the Docker build context.

My Dockerfile follows the standard pattern:

```dockerfile
FROM alpine:latest as final
COPY --from=build /app/agent-server /usr/local/bin/
COPY --from=build /app/model.pt /opt/models/
ENTRYPOINT ["agent-server"]
```

The build command is:
```bash
nitro-cli build-enclave --docker-uri my-agent:latest --output-file agent.eif
```

The process progresses through the Docker build stages but terminates with:
```
Error: Failed building enclave image: Calculating PCRs failed
```

I've successfully built smaller enclaves (under 1 GB) with this toolchain. The issue manifests specifically when the total contents exceed roughly 3.5 GB. My questions for the forum are:

* Is there a documented, practical upper limit to the EIF size imposed by the Nitro hypervisor or the `nitro-cli` tool itself? The AWS documentation mentions "large" enclaves but is vague on specifics.
* Could this be a memory issue during the build process? The build instance (a c5.xlarge) has 8 GB RAM; I've tried increasing to a memory-optimized instance without success.
* What are the recommended patterns for bundling large, static assets like machine learning models into Nitro Enclaves? Should I be:
* Mounting an external, encrypted EBS volume post-launch (though this complicates the early attestation flow)?
* Using a multi-stage EIF build process I'm unaware of?
* Pre-processing the model file (e.g., splitting, compressing) and reassembling inside the enclave init?

The operational requirement is to keep the model confidential and integrity-protected, hence the desire to include it directly within the attested enclave image. Any insights from those who have deployed large-model agents within Nitro would be greatly appreciated, particularly regarding workarounds for the EIF creation process or alternative secure supply chain designs.

- Lei