---

What is dstack?

dstack is the open framework for confidential AI — deploy AI applications with cryptographic privacy guarantees.

AI providers ask users to trust them with sensitive data. But trust doesn't scale, and trust can't be verified. With dstack, your containers run inside confidential VMs (Intel TDX) with native support for NVIDIA Confidential Computing (H100, Blackwell). Users can cryptographically verify exactly what's running: private AI with your existing Docker workflow.

Supported Platforms

Features

Zero friction onboarding

• Docker Compose native: Bring your docker-compose.yaml as-is. No SDK, no code changes.
• Encrypted by default: Network traffic and disk storage encrypted out of the box.

Hardware-rooted security

• Private by hardware: Data encrypted in memory, inaccessible even to the host.
• Reproducible OS: Deterministic builds mean anyone can verify the OS image hash.
• Workload identity: Every app gets an attested identity users can verify cryptographically.
• Confidential GPUs: Native support for NVIDIA Confidential Computing (H100, Blackwell).

Trustless operations

• Isolated keys: Per-app keys derived in TEE. Survives hardware failure. Never exposed to operators.
• Code governance: Updates follow predefined rules (e.g., multi-party approval). Operators can't swap code or access secrets.

Getting Started

Try it now: Chat with LLMs running in TEE at chat.redpill.ai. Click the shield icon to verify attestations from Intel TDX and NVIDIA GPUs.

Deploy your own:

# docker-compose.yaml
services:
  vllm:
    image: vllm/vllm-openai:latest
    runtime: nvidia
    command: --model Qwen/Qwen2.5-7B-Instruct
    ports:
      - "8000:8000"

Deploy to a self-hosted TDX machine with the dstackup install -> dstack deploy workflow, or use Phala Cloud for managed infrastructure. AMD SEV-SNP hosts use the same workflow when the selected guest image includes digest.txt.

Setting up dstack on your own hardware? Start with the self-hosted quick onboarding guide

Building or customizing the guest OS itself? Follow the guest-OS build guide.

Developing without TEE hardware? Use a development image with no-TEE mode and swtpm.

Architecture

Repository layout

dstack/  Core services, Rust crates, host and guest runtime code
sdk/     Stable public SDK paths
os/      Guest-OS payload, image contract, and build backends
docs/    User and operator documentation
tools/   Standalone development and security tools

The default and recommended OS backend is mkosi under os/mkosi/. The Yocto backend under os/yocto/ is deprecated and kept only to rebuild existing images; do not use it for new work. Shared rootfs payload and release assembly stay outside the backends so they are not duplicated. See os/README.md.

Scripts follow the same ownership boundaries: component-specific helpers stay beside their component under dstack/; files installed into every guest live in os/common/rootfs/; backend-neutral image tooling lives in os/image/; mkosi-only helpers live in os/mkosi/scripts/ (deprecated Yocto-only helpers in os/yocto/scripts/); and repository-wide standalone utilities live in tools/.

Your container runs inside a Confidential VM, such as Intel TDX or AMD SEV-SNP, with optional GPU isolation via NVIDIA Confidential Computing. The CPU TEE protects application logic; the GPU TEE protects model weights and inference data.

Core components:

• Guest Agent: Runs inside each CVM. Generates TDX attestation quotes so users can verify exactly what's running. Provisions per-app cryptographic keys from KMS. Encrypts local storage. Apps interact via /var/run/dstack.sock.

• KMS: Runs in its own TEE. Verifies TDX quotes before releasing keys. Enforces authorization policies defined in on-chain smart contracts — operators cannot bypass these checks. Derives deterministic keys bound to each app's attested identity.

• Gateway: Terminates TLS at the edge and provisions ACME certificates automatically. Routes traffic to CVMs. All internal communication uses RA-TLS for mutual attestation.

• VMM: Runs on bare-metal TDX hosts. Parses docker-compose files directly — no app changes needed. Boots CVMs from a reproducible OS image. Allocates CPU, memory, and confidential GPU resources.

Full security model →

Security and Trust

Security docs are linked here so deployers and reviewers can quickly find the trust model, production guidance, audit, and the status of already-answered public findings.

• Security Overview - entry point for users, operators, researchers, and AI agents
• Security Model - threat model, trust boundaries, and verification checklist
• Public Security Reports - public status for security reports and related hardening work
• Security Best Practices - production settings and hardening guidance
• Security Audit - third-party audit by zkSecurity
• Report a Vulnerability - use GitHub's private security reporting path

Please do not disclose exploitable vulnerabilities in public GitHub issues. Use the private reporting path in SECURITY.md.

SDKs

Apps communicate with the guest agent via HTTP over /var/run/dstack.sock. Use the HTTP API directly with curl, or use a language SDK:

Documentation

For Developers

• Confidential AI - Inference, agents, and training with hardware privacy
• Usage Guide - Deploying and managing apps
• Verification - How to verify TEE attestation

For Operators

• Hardware Enablement - Prepare a TDX or AMD SEV-SNP host
• AMD SEV-SNP - Image, attestation, and key-release requirements
• Self-hosted Quick Onboarding - First app on one host
• Build the Guest OS - Build and verify bootable images from source
• Deployment - Self-hosting on TDX or AMD SEV-SNP hardware
• Upgrading to 0.6 - Upgrading from dstack 0.5.x
• On-Chain Governance - Smart contract authorization
• Gateway - Gateway configuration

Reference

• Guest Agent API v1 - Key derivation, signature chains, and the versioned guest API
• Guest Agent API v0 - The frozen legacy surface, for clients that still speak the unversioned API
• App Compose Format - Compose file specification
• Intel TDX Attestation - Measurement and runtime-event verification
• Native TEE Interfaces - Advanced compatibility with Linux TEE devices and configfs-tsm
• VMM CLI Guide - Command-line reference
• Design Decisions - Architecture rationale
• FAQ - Frequently asked questions

FAQ

Why not use AWS Nitro / Azure Confidential VMs / GCP directly?

You can — but you'll build everything yourself: attestation verification, key management, Docker orchestration, certificate provisioning, and governance. dstack provides all of this out of the box.

Approach	Docker native	GPU TEE	Key management	Attestation tooling	Open source
dstack	✓	✓	✓	✓	✓
AWS Nitro Enclaves	-	-	Manual	Manual	-
Azure Confidential VMs	-	Preview	Manual	Manual	-
GCP Confidential Computing	-	-	Manual	Manual	-

Cloud providers give you the hardware primitive. dstack gives you the full stack: reproducible OS images, automatic attestation, per-app key derivation, TLS certificates, and smart contract governance. No vendor lock-in.

How is this different from SGX/Gramine?

SGX requires porting applications to enclaves. dstack uses full-VM isolation (Intel TDX) — bring your Docker containers as-is. Plus GPU TEE support that SGX doesn't offer.

What's the performance overhead?

Minimal. Intel TDX adds ~2-5% overhead for CPU workloads. NVIDIA Confidential Computing has negligible impact on GPU inference. The main cost is memory encryption, which is hardware-accelerated on supported CPUs.

Is this production-ready?

Yes. dstack powers production AI infrastructure at OpenRouter and NEAR AI. The framework has been audited by zkSecurity and is a Linux Foundation Confidential Computing Consortium project.

Can I run this on my own hardware?

Yes. dstack runs on supported TEE-capable servers, including Intel TDX-capable hardware. See the deployment guide for self-hosting instructions. You can also use Phala Cloud for managed infrastructure.

What TEE hardware is supported?

• GCP: Intel TDX (Confidential VMs)
• AWS: Nitro Enclaves (NSM attestation)
• Bare metal: Intel TDX (4th/5th Gen Xeon) and AMD SEV-SNP on supported dstack OS images. Intel TDX is the production path; AMD SEV-SNP is new and experimental.
• GPUs: NVIDIA Confidential Computing (H100, Blackwell)

How do users verify my deployment?

Your app exposes attestation quotes via the SDK. Users verify these quotes using dstack-verifier, dcap-qvl, or the Trust Center. See the verification guide for details.

Trusted by

• OpenRouter - Confidential AI inference providers powered by dstack
• NEAR AI - Private AI infrastructure powered by dstack

dstack is a Linux Foundation Confidential Computing Consortium open source project.

Community

Telegram · GitHub Discussions · Examples

For enterprise support and licensing, book a call or email us at [email protected].

Cite

If you use dstack in your research, please cite:

@article{zhou2025dstack,
  title={Dstack: A Zero Trust Framework for Confidential Containers},
  author={Zhou, Shunfan and Wang, Kevin and Yin, Hang},
  journal={arXiv preprint arXiv:2509.11555},
  year={2025}
}

Media Kit

Logo and branding assets: dstack-logo-kit

License

The dstack-owned source, SDKs, documentation, tools, guest OS backend, and image-assembly code are Apache-2.0. Embedded and third-party components retain their own license declarations and notices. See file-level SPDX declarations and REUSE.toml for the exact scope.