TDX Hardware — Attestation
The hardware-signed TDX quote, verified against Intel's PCS collateral — the Intel DCAP signature chain, not Intel Trust Authority.
Quote not decoded yet — showing the measurements as reported (to be cryptographically verified).
Source Code — Compose
The measured app-compose that pins exactly which container images run.
| Container | Image | Digest | Verify |
|---|---|---|---|
| kms | dstacktee/dstack-kmsdstack system image | sha256:84b793feed825a5b5e70d04386e931e0e110461492793f17ab2128e39808d989 | Sigstore ↗ |
Each digest above is the one measured into RTMR3, so the attestation binds the running code to this exact image; the Sigstore link ties that digest back to its build provenance.
app-compose (measured source identity)
{
"manifest_version": 2,
"name": "kms",
"runner": "docker-compose",
"docker_compose_file": "# SPDX-FileCopyrightText: © 2025 Phala Network <[email protected]>\n#\n# SPDX-License-Identifier: Apache-2.0\n\n# KMS deployment with external auth-simple webhook\n# auth-simple runs outside the CVM (operator infrastructure)\n\nservices:\n kms:\n image: dstacktee/dstack-kms@sha256:84b793feed825a5b5e70d04386e931e0e110461492793f17ab2128e39808d989\n network_mode: host\n volumes:\n - kms-volume:/kms\n - /var/run/dstack.sock:/var/run/dstack.sock\n restart: unless-stopped\n configs:\n - source: kms_config\n target: /kms/kms.toml\n command: sh -c 'mkdir -p /kms/certs /kms/images && exec dstack-kms -c /kms/kms.toml'\n\nvolumes:\n kms-volume:\n\nconfigs:\n kms_config:\n content: |\n [rpc]\n address = \"0.0.0.0\"\n port = 8000\n\n [rpc.tls]\n key = \"/kms/certs/rpc.key\"\n certs = \"/kms/certs/rpc.crt\"\n\n [rpc.tls.mutual]\n ca_certs = \"/kms/certs/tmp-ca.crt\"\n mandatory = false\n\n [core]\n cert_dir = \"/kms/certs\"\n admin_token_hash = \"f7de6e5b9f3f9112a603089cab8a2c572296be0ff613c47582b5f26d12e7c4e6\"\n\n [core.image]\n verify = true\n cache_dir = \"/kms/images\"\n download_url = \"http://10.0.2.2:11008/dstack-0.5.11.tar.gz\"\n download_timeout = \"2m\"\n\n [core.auth_api]\n type = \"webhook\"\n\n [core.auth_api.webhook]\n url = \"http://10.0.2.2:3001\"\n\n [core.onboard]\n enabled = true\n auto_bootstrap_domain = \"\"\n address = \"0.0.0.0\"\n port = 8000\n",
"kms_enabled": false,
"gateway_enabled": false,
"local_key_provider_enabled": true,
"key_provider_id": "",
"public_logs": true,
"public_sysinfo": true,
"allowed_envs": [],
"no_instance_id": true,
"secure_time": true
}
Network — Zero Trust Gateway
no app-fronted gateway domain for this role (n/a)
App OS
The measured dstack guest OS image. The version is read live from each CVM's vm_config; the
os_image_hash is the precise, measured OS identity.
dstack releases ↗.
KMS — deploy-time key provisioning
Deploy-time only. Governed by an on-chain contract, the dstack KMS releases this CVM's keys at boot only if its measurements are approved — those keys decrypt the deployment env file (so secrets never enter the measured compose) and provision the CVM's RA-TLS identity + disk encryption. This secures how the worker is deployed; it does not hold OutLayer's application or user secrets — those run through the OutLayer keystore (master derived in-TEE via MPC), not the dstack KMS.