Skip to main content

​
Does dstack support GCP / Azure

dstack is open for PRs to add that support. Currently it focuses on bare metal because it offers the most fine-grained control and access to vanilla TDX.

​
How does KMS key generation work and how can it be modified?

The key generation logic is implemented in the onboard service:
Reference: https://github.com/Dstack-TEE/dstack/blob/master/kms/src/onboard\_service.rs#L50

​
How does on-chain KMS work and how can I customize its governance?

The KMS contract allows for customizable ownership and governance:

​
Where can I find KMS deployment instructions?

Complete deployment documentation is available here: Reference: https://github.com/Dstack-TEE/dstack/blob/master/docs/deployment.md

​
How does the current data encryption system work?

The CVM data disk is a LUKS2 volume encrypted with aes-xts-plain64. The guest creates it on first boot and unlocks it on every boot after that. The key comes from KMS, which releases it only after the CVM’s attestation passes the app’s on-chain authorization. KMS derives it from its root key over the app ID and instance ID, so each instance gets a distinct key that exists only inside the CVM. The host holds ciphertext and never sees the key. LUKS encrypts the disk but does not authenticate it, so detecting a modified block is the filesystem’s job. The default zfs checksums every block and fails the read. ext4 checksums metadata but not file data. Reference: dstack-util/src/system_setup.rs

​
Where is the deployment function located in the Dstack-TEE codebase, and can it be integrated with custom tools?

The deployment logic for Dstack-TEE is part of its Rust-based implementation, there are multiple services involved in the deployment pipeline. The Dstack-TEE GitHub repository contains the core services (e.g., vmm, gateway, kms, meta-dstack).

​
Can I run a Docker image directly in a TEE without setting up all dstack components?

Yes, you can run a Docker image in a TEE using the dstack SDK without setting up all components, but with limitations. The SDK provides a base VM image that runs a minimal VM containing your Docker container. The essential components are kms (key management service) and vmm (TEE runtime), which must be included. Optional components like dstack-gateway (for TLS support) can be skipped if you don’t need features like encrypted communication. Configure the SDK with your Docker image and the required components as per the documentation.