Thanks, Derek. That was helpful to see.
Here's what I ended up doing for others that might be interested:
For reference, I'm on an Ubuntu EC2 image (x86_64 x86_64 x86_64 GNU/Linux)
1. Install binfmt-support:
$ sudo apt-get install binfmt-support
2. Create script to run 32 bit nexe: /usr/local/bin/run_nexe32
/home/ubuntu/nacl_sdk/pepper_19/tools/sel_ldr_x86_32 -a -S -B /home/ubuntu/nacl_sdk/pepper_19/tools/irt_core_x86_32.nexe "$@"
3. Create script to run 64 bit nexe: /usr/local/bin/run_nexe64
/home/ubuntu/nacl_sdk/pepper_19/tools/sel_ldr_x86_64 -a -S -B /home/ubuntu/nacl_sdk/pepper_19/tools/irt_core_x86_64.nexe "$@"
4. Make sure scripts are executable
$ sudo chmod ugo+x /usr/bin/local/run_nexe32
$ sudo chmod ugo+x /usr/bin/local/run_nexe64
5. Register the nexe file formats:
$ sudo update-binfmts --install NEXE32 /usr/local/bin/run_nexe32 --magic \\x7fELF\\x01\\x01\\x01\\x7b\\x07\\x00\\x00\\x00\\x00\\x00\\x00
$ sudo update-binfmts --install NEXE64 /usr/local/bin/run_nexe64 --magic \\x7fELF\\x02\\x01\\x01\\x7b\\x07\\x00\\x00\\x00\\x00\\x00\\x00
6. Done!
Now I can just run nexes like so:
$ ./hello_x86_32.nexe
DEBUG MODE ENABLED (bypass acl)
[7374,4148045536:05:33:00.414748] BYPASSING ALL ACL CHECKS [7374,4148045536:05:33:00.416947] Native Client module will be loaded at base address 0x00000000b7324000 [7374,4148045536:05:33:00.428396] NaClMakePcrelThunk: got addr 0x185a0000 Hello, World!
and...
$ ./hello_x86_64.nexe
DEBUG MODE ENABLED (bypass acl)
[7379,4006541152:05:33:36.505945] BYPASSING ALL ACL CHECKS
[7379,4006541152:05:33:36.508066] Native Client module will be loaded at base address 0x00007f1800000000
Hello, World!
Mike.