Node Information

App Name
App ID
41093f4a24546671b719619e235b536f2810a9d8
Instance ID
51e802914650c1e30151612a4f2ed03b05220e90
Device ID
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Key Provider Info
{"name":"kms","id":"3059301306072a8648ce3d020106082a8648ce3d030107034200048844eb42ccdf8c52fd4f174f362fcb9bbd19c45fd48f1edec2d8f1ca23536ec1a74021b4cee610c074f8294d431b2b7fee2c39e5333fdaf0a4522d43fb159d9f"}
Machine Provider
dstack (dstack)
Operating System
DStack 0.5.12
Kernel Version
6.9.0-dstack
CPU
cpu0 @2400 MHz (2 cores)
Memory Usage
Used: 510.61 MB / Total: 3.65 GB (Available: 3.15 GB)
Swap Usage
Used: 0.00 B / Total: 0.00 B (Free: 0.00 B)
Load Average
1min: 0.62%, 5min: 0.56%, 15min: 0.53%
System Uptime
6056
Disk 0
Free: 38.15 GB / Total: 38.28 GB
Deployed Containers

Name	Status	Logs
dstack-gm-miner-1	Up 2 hours	View Logs
TCB Info

{
  "mrtd": "7fe60787222bd394cb516abca2435f22f035ab2cc9c0a4b4b3b148e46297f3d931a237b72f359052c6e657d8c1409173",
  "rtmr0": "027b610ab0555482f8a3868524093bdf3cdbe2539f81dfeeb886864654cb2fe3422f7fc36d4bab6fa46683aad11d1ba7",
  "rtmr1": "4ae609807c765916a31d724786ed74bcb97e168a9d937b04936aeef2015c907eba5ac352c6bcd749c246fd62ffb659ec",
  "rtmr2": "764489f277a8540189761e72b4238ba36d4d647e11bd958d8ab5522af2a4867b0ff63e06b0c4967f1857236244040a5d",
  "rtmr3": "d58236e1b163ec1675b8d5c1fb069f1bf68a4e12c5d09d581e6ca26acdc34af9bd6978180785e7bdfc5ba16d473e1bb6",
  "mr_aggregated": "01da98c67843f337b248acab7795cea44584182b5bd1b1bb236681630464ad9c",
  "os_image_hash": "8db40cb23008d6213668b5816702d100b37b859a8a5bfd18d938ae3a1b3715bd",
  "compose_hash": "b86a6b264cdf6201543234db7bc6c7dc11ac014f06c615d873c4fc8ce3544ec1",
  "device_id": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "event_log": [
    {
      "imr": 0,
      "event_type": 2147483659,
      "digest": "5b684faf8d02a733945f821d9cdd170802e72103977acf66949c9382500283adc90cbec57f8e7653f8bee1cab83689de",
      "event": "",
      "event_payload": "095464785461626c65000100000000000000af96bb93f2b9b84e9462e0ba745642360090800000000000"
    },
    {
      "imr": 0,
      "event_type": 2147483658,
      "digest": "344bc51c980ba621aaa00da3ed7436f7d6e549197dfe699515dfa2c6583d95e6412af21c097d473155875ffd561d6790",
      "event": "",
      "event_payload": "2946762858585858585858582d585858582d585858582d585858582d58585858585858585858585829000000c0ff000000000040080000000000"
    },
    {
      "imr": 0,
      "event_type": 2147483649,
      "digest": "9dc3a1f80bcec915391dcda5ffbb15e7419f77eab462bbf72b42166fb70d50325e37b36f93537a863769bcf9bedae6fb",
      "event": "",
      "event_payload": "61dfe48bca93d211aa0d00e098032b8c0a00000000000000000000000000000053006500630075007200650042006f006f007400"
    },
    {
      "imr": 0,
      "event_type": 2147483649,
      "digest": "6f2e3cbc14f9def86980f5f66fd85e99d63e69a73014ed8a5633ce56eca5b64b692108c56110e22acadcef58c3250f1b",
      "event": "",
      "event_payload": "61dfe48bca93d211aa0d00e098032b8c0200000000000000000000000000000050004b00"
    },
    {
      "imr": 0,
      "event_type": 2147483649,
      "digest": "d607c0efb41c0d757d69bca0615c3a9ac0b1db06c557d992e906c6b7dee40e0e031640c7bfd7bcd35844ef9edeadc6f9",
      "event": "",
      "event_payload": "61dfe48bca93d211aa0d00e098032b8c030000000000000000000000000000004b0045004b00"
    },
    {
      "imr": 0,
      "event_type": 2147483649,
      "digest": "08a74f8963b337acb6c93682f934496373679dd26af1089cb4eaf0c30cf260a12e814856385ab8843e56a9acea19e127",
      "event": "",
      "event_payload": "cbb219d73a3d9645a3bcdad00e67656f0200000000000000000000000000000064006200"
    },
    {
      "imr": 0,
      "event_type": 2147483649,
      "digest": "18cc6e01f0c6ea99aa23f8a280423e94ad81d96d0aeb5180504fc0f7a40cb3619dd39bd6a95ec1680a86ed6ab0f9828d",
      "event": "",
      "event_payload": "cbb219d73a3d9645a3bcdad00e67656f03000000000000000000000000000000640062007800"
    },
    {
      "imr": 0,
      "event_type": 4,
      "digest": "394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0",
      "event": "",
      "event_payload": "00000000"
    },
    {
      "imr": 0,
      "event_type": 10,
      "digest": "095d04cf26fe03aef6e3561fa24c1aa1cea93f4aeaf563b1f9f7616184c53454875925759434769cec2490acb563a337",
      "event": "",
      "event_payload": "414350492044415441"
    },
    {
      "imr": 0,
      "event_type": 10,
      "digest": "8d9a4d4777a1bc77ecd9d8d37a4628129a80052a510320159a20a923bd07a0e90d8d1f2e1ebf088992b25f0d0fa672ef",
      "event": "",
      "event_payload": "414350492044415441"
    },
    {
      "imr": 0,
      "event_type": 10,
      "digest": "3070721e169bc41884724cb0e6b3082e1baf249083d8b389181ba50b9afa951057876c380b8870e8c2facf2eff67a2b6",
      "event": "",
      "event_payload": "414350492044415441"
    },
    {
      "imr": 1,
      "event_type": 2147483651,
      "digest": "48368ab87e5b8fecfb216bc26bbccfe13081bf8b67d4d2ee7de708e91819eeb56227db2349fc3b04ad5f5719ffd11809",
      "event": "",
      "event_payload": "18e0fd7a00000000008485000000000000000000000000002a000000000000000403140072f728144ab61e44b8c39ebdd7f893c7040412006b00650072006e0065006c0000007fff0400"
    },
    {
      "imr": 0,
      "event_type": 2147483650,
      "digest": "1dd6f7b457ad880d840d41c961283bab688e94e4b59359ea45686581e90feccea3c624b1226113f824f315eb60ae0a7c",
      "event": "",
      "event_payload": "61dfe48bca93d211aa0d00e098032b8c0900000000000000020000000000000042006f006f0074004f0072006400650072000000"
    },
    {
      "imr": 0,
      "event_type": 2147483650,
      "digest": "23ada07f5261f12f34a0bd8e46760962d6b4d576a416f1fea1c64bc656b1d28eacf7047ae6e967c58fd2a98bfa74c298",
      "event": "",
      "event_payload": "61dfe48bca93d211aa0d00e098032b8c08000000000000003e0000000000000042006f006f0074003000300030003000090100002c0055006900410070007000000004071400c9bdb87cebf8344faaea3ee4af6516a10406140021aa2c4614760345836e8ab6f46623317fff0400"
    },
    {
      "imr": 1,
      "event_type": 2147483655,
      "digest": "77a0dab2312b4e1e57a84d865a21e5b2ee8d677a21012ada819d0a98988078d3d740f6346bfe0abaa938ca20439a8d71",
      "event": "",
      "event_payload": "43616c6c696e6720454649204170706c69636174696f6e2066726f6d20426f6f74204f7074696f6e"
    },
    {
      "imr": 1,
      "event_type": 4,
      "digest": "394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0",
      "event": "",
      "event_payload": "00000000"
    },
    {
      "imr": 2,
      "event_type": 6,
      "digest": "549e21b8d8898430a0be6e53191717f1d30d66588bdafe0055b20d197e415fae963b06ec925f14b027267812d3734fea",
      "event": "",
      "event_payload": "ed223b8f1a0000004c4f414445445f494d4147453a3a4c6f61644f7074696f6e7300"
    },
    {
      "imr": 2,
      "event_type": 6,
      "digest": "fd01285d396a483667123c1a1a64d83b2dd5c6cef2b8803c97522be00c5255ff27feb79f6ea9b46c6856bbe2769bad66",
      "event": "",
      "event_payload": "ec223b8f0d0000004c696e757820696e6974726400"
    },
    {
      "imr": 1,
      "event_type": 2147483655,
      "digest": "214b0bef1379756011344877743fdc2a5382bac6e70362d624ccf3f654407c1b4badf7d8f9295dd3dabdef65b27677e0",
      "event": "",
      "event_payload": "4578697420426f6f7420536572766963657320496e766f636174696f6e"
    },
    {
      "imr": 1,
      "event_type": 2147483655,
      "digest": "0a2e01c85deae718a530ad8c6d20a84009babe6c8989269e950d8cf440c6e997695e64d455c4174a652cd080f6230b74",
      "event": "",
      "event_payload": "4578697420426f6f742053657276696365732052657475726e656420776974682053756363657373"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "f9974020ef507068183313d0ca808e0d1ca9b2d1ad0c61f5784e7157c362c06536f5ddacdad4451693f48fcc72fff624",
      "event": "system-preparing",
      "event_payload": ""
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "075f5b4443cc76e8c9eae809f7e2cdf77fc26f519a265f73dd3927f584917c239549f507abd5056feee9d249f1333c36",
      "event": "app-id",
      "event_payload": "41093f4a24546671b719619e235b536f2810a9d8"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "ff6e7727086ebcf367eb4ef2c3e59b7fc5e64e22df37cccfc773bdff2ae16540a726510ba25ab98ca4dceec16af96cea",
      "event": "compose-hash",
      "event_payload": "b86a6b264cdf6201543234db7bc6c7dc11ac014f06c615d873c4fc8ce3544ec1"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "37a580cd334ffd1e0aeb7001e8ad627d22e160241be6fb70b8d1920a86f7341c837df23bf657cb0e93f0056700d86e7c",
      "event": "instance-id",
      "event_payload": "51e802914650c1e30151612a4f2ed03b05220e90"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "98bd7e6bd3952720b65027fd494834045d06b4a714bf737a06b874638b3ea00ff402f7f583e3e3b05e921c8570433ac6",
      "event": "boot-mr-done",
      "event_payload": ""
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "105de70790dbd69675d8ce184fca6f588c690ce61ed159ec318a8ee6113fa30fdd3222a4f17cf19d166d6a0f0641e035",
      "event": "mr-kms",
      "event_payload": "8ccccca54c5843a09771e32abc8d17105738d90b76d280924e30098eab7c51d0"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "9381eb17a317a6ebabc892bd4601743106b3f7415f2a82fe73c24b1b12d9fb982a26e7c49632fe2fae01ffbae6bf5ea2",
      "event": "os-image-hash",
      "event_payload": "8db40cb23008d6213668b5816702d100b37b859a8a5bfd18d938ae3a1b3715bd"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "83368b43a0fc6f824f5a9220592df85fd30e2d405ecbd253a5c6354af63e6c9b41aec557c38a38e348ab87f9ac8fc68c",
      "event": "key-provider",
      "event_payload": "7b226e616d65223a226b6d73222c226964223a223330353933303133303630373261383634386365336430323031303630383261383634386365336430333031303730333432303030343838343465623432636364663863353266643466313734663336326663623962626431396334356664343866316564656332643866316361323335333665633161373430323162346365653631306330373466383239346434333162326237666565326333396535333333666461663061343532326434336662313539643966227d"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "ba51104636900268b0e059fa3d266419d079d1e94aea26fb9fcbb8d764bf4c89a67ac271b8a0d1a3989945132a111fc7",
      "event": "storage-fs",
      "event_payload": "7a6673"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "1a76b2a80a0be71eae59f80945d876351a7a3fb8e9fd1ff1cede5734aa84ea11fd72b4edfbb6f04e5a85edd114c751bd",
      "event": "system-ready",
      "event_payload": ""
    }
  ],
  "app_compose": "{\"allowed_envs\":[\"ANTHROPIC_API_KEY\",\"ANTHROPIC_UPSTREAM\",\"BEDROCK_REGION\",\"BEDROCK_API_KEY\",\"AZURE_FOUNDRY_ENDPOINT\",\"AZURE_FOUNDRY_API_KEY\",\"AZURE_FOUNDRY_TENANT_ID\",\"AZURE_FOUNDRY_SUBSCRIPTION_ID\",\"AZURE_FOUNDRY_RESOURCE_GROUP\",\"AZURE_FOUNDRY_CLIENT_ID\",\"AZURE_FOUNDRY_CLIENT_SECRET\",\"OPENAI_API_KEY\",\"OPENAI_UPSTREAM\",\"AZURE_OPENAI_ENDPOINT\",\"AZURE_OPENAI_API_KEY\",\"AZURE_TENANT_ID\",\"AZURE_SUBSCRIPTION_ID\",\"AZURE_RESOURCE_GROUP\",\"AZURE_CLIENT_ID\",\"AZURE_CLIENT_SECRET\",\"GOOGLE_API_KEY\",\"CHUTES_API_KEY\",\"ZAI_API_KEY\",\"MOONSHOT_API_KEY\",\"DEEPINFRA_API_KEY\",\"KUBETEE_API_KEY\",\"ENGY_API_KEY\",\"MOONMATH_API_KEY\",\"NEAR_API_KEY\",\"GM_NODE_SECRET\"],\"docker_compose_file\":\"## gm miner compose template.\\n##\\n## Usage: `gmcli deploy` renders this file, substituting GM_IMAGE_REF\\n## with the digest-pinned image reference and GM_NETWORK with the active\\n## network name (`testnet` / `mainnet`), then submits it to Phala Cloud\\n## via `phala deploy`. Phala Cloud provisions the TDX CVM and runs the KMS.\\n##\\n## GM_NETWORK is a rendered literal, NOT an operator env var: its value\\n## comes from the `--testnet` / mainnet (default) selection on `gmcli\\n## deploy` and is substituted into the compose source before the file is\\n## submitted. That makes it part of the attestation-measured compose_hash,\\n## so a miner cannot change the targeted network (and the per-network\\n## benchmark upstream URL keyed off it inside the image) without moving\\n## the compose_hash — which the registry's attestation enforcement\\n## rejects.\\n##\\n## Provider keys and upstream selectors are NOT rendered into this file — `phala deploy`\\n## encrypts them client-side to the CVM key from the .env file written by `gmcli deploy`.\\n## Set only the keys you have; an unset key makes the upstream return 401,\\n## which the registry surfaces as a \\\"key not configured\\\" capability failure.\\n##\\n## GM_NODE_SECRET is the node secret (Mechanism 1 of\\n## attestation-and-identity.md): `gmcli deploy` generates it, writes\\n## it into the same Phala-Cloud-encrypted .env, and registers it with the\\n## registry. Envoy's inbound Lua filter enforces it as the `x-gm-node-key`\\n## header. It is declared here so it is part of the attestation-measured\\n## compose hash.\\n##\\n## Envoy serves the data plane on :8080 and forwards /attestation/info to\\n## gm-miner-attestd. Both run inside the TEE; attestd gates Azure serving.\\n##\\n## RA-TLS data plane (Mechanism 2 of attestation-and-identity.md): envoy\\n## terminates TLS on :8080 with a certificate minted by dstack's RA-TLS\\n## facility (see image/start.sh, image/envoy.yaml). For the gateway to\\n## receive that certificate the data plane MUST be reached through the\\n## dstack gateway's TLS-passthrough URL — the `s`-suffix form\\n## `https://<app-id>-8080s.<node>.phala.network`. The default `-8080`\\n## (no suffix) URL has the dstack gateway terminate TLS at the edge with\\n## its own ACME certificate, which would hide the miner's RA-TLS cert.\\n## `gmcli deploy` registers the `-8080s` passthrough URL with the\\n## registry for exactly this reason.\\n##\\n## dstack guest-agent socket: attestd calls the dstack guest agent's\\n## get_key (the TEE-bound attestation keypair) and get_quote / info\\n## endpoints over /var/run/dstack.sock. dstack exposes the socket on\\n## the CVM host but does not auto-mount it into app containers, so the\\n## bind mount below is required — without it attestd exits at startup\\n## and the container is restarted in a crash loop.\\n\\nservices:\\n  gm-miner:\\n    image: ghcr.io/taostat/gm-miner@sha256:9d7932c3924a82c006b88337b27bb65e2a5abfc4cf76134ef220d28b372011df\\n    ports:\\n      ## Envoy data plane — receives gateway inference traffic, the\\n      ## registry's `x-gm-provider` capability probes, and the\\n      ## registry's `GET /attestation/info` attestation probes. Envoy\\n      ## terminates RA-TLS here; callers reach it via the dstack\\n      ## TLS-passthrough URL (`<app-id>-8080s.<node>.phala.network`).\\n      - \\\"8080:8080\\\"\\n      ## Envoy Prometheus metrics — the `metrics` listener (image/\\n      ## envoy.yaml) serves ONLY `/stats/prometheus`, gated on the\\n      ## `x-gm-node-key` node secret; the full admin interface stays\\n      ## loopback-only. The registry control loop and the benchmark\\n      ## runner scrape it. Plaintext here — the dstack ingress fronts\\n      ## the port with TLS at its edge, so callers reach it at the\\n      ## default `<app-id>-9902.<node>.phala.network` URL.\\n      - \\\"9902:9902\\\"\\n    environment:\\n      ## Provider API keys — encrypted client-side to the CVM key by\\n      ## `phala deploy`. Set only the keys you own.\\n      - ANTHROPIC_API_KEY\\n      - ANTHROPIC_UPSTREAM\\n      - BEDROCK_REGION\\n      - BEDROCK_API_KEY\\n      ## Microsoft Foundry (Claude on Azure) — data-plane endpoint/key plus\\n      ## the read-only Entra service principal `attestd` uses to verify the\\n      ## account carries no owner-capture controls. Required when\\n      ## ANTHROPIC_UPSTREAM=foundry.\\n      - AZURE_FOUNDRY_ENDPOINT\\n      - AZURE_FOUNDRY_API_KEY\\n      - AZURE_FOUNDRY_TENANT_ID\\n      - AZURE_FOUNDRY_SUBSCRIPTION_ID\\n      - AZURE_FOUNDRY_RESOURCE_GROUP\\n      - AZURE_FOUNDRY_CLIENT_ID\\n      - AZURE_FOUNDRY_CLIENT_SECRET\\n      - OPENAI_API_KEY\\n      - OPENAI_UPSTREAM\\n      - AZURE_OPENAI_ENDPOINT\\n      - AZURE_OPENAI_API_KEY\\n      - AZURE_TENANT_ID\\n      - AZURE_SUBSCRIPTION_ID\\n      - AZURE_RESOURCE_GROUP\\n      - AZURE_CLIENT_ID\\n      - AZURE_CLIENT_SECRET\\n      - GOOGLE_API_KEY\\n      - CHUTES_API_KEY\\n      - ZAI_API_KEY\\n      - MOONSHOT_API_KEY\\n      - DEEPINFRA_API_KEY\\n      - KUBETEE_API_KEY\\n      - ENGY_API_KEY\\n      - MOONMATH_API_KEY\\n      - NEAR_API_KEY\\n      ## Node secret — enforced by envoy's inbound x-gm-node-key check.\\n      - GM_NODE_SECRET\\n      ## Active network — `testnet` or `mainnet`. Rendered as a literal\\n      ## by `gmcli deploy` (not an operator env var), so the value is\\n      ## part of the attestation-measured compose_hash. The image's\\n      ## `start.sh` maps it to the matching benchmark upstream URL —\\n      ## both URLs are hardcoded in the image, so a miner cannot point\\n      ## the `x-gm-provider: benchmark` route at a colluding service\\n      ## without moving the compose_hash, which the registry rejects.\\n      - GM_NETWORK=mainnet\\n    volumes:\\n      ## dstack guest-agent socket. The attestation server calls\\n      ## get_key (TEE-bound keypair), get_quote (fresh TDX quote), and\\n      ## info() (CVM measurements) over this socket. dstack does not\\n      ## auto-mount it into app containers — without this bind mount\\n      ## attestd crash-loops on \\\"Failed to connect to unix stream\\\".\\n      - /var/run/dstack.sock:/var/run/dstack.sock\\n    ## File-descriptor limit. Envoy is the data plane: every downstream\\n    ## connection and every upstream connection it opens consumes a\\n    ## file descriptor, so a streaming proxy at N concurrent connections\\n    ## holds ~2N fds plus Envoy's own (epoll, the :8080 listener, the\\n    ## attestd loopback socket, the dstack socket, logs). With nothing\\n    ## set here the container inherits whatever the dstack CVM's\\n    ## container runtime defaults to — on a containerd 2.x host that\\n    ## soft limit is 1024, which caps the miner at roughly 500 streaming\\n    ## connections before Envoy starts failing to open sockets and sheds\\n    ## load by resetting connections. 65536 gives a multi-thousand-\\n    ## connection budget with headroom; the overload-manager connection\\n    ## ceiling in envoy.yaml is set well under half this value, per\\n    ## Envoy's fd-sizing guidance. Declared here so it is part of the\\n    ## attestation-measured compose hash.\\n    ulimits:\\n      nofile:\\n        soft: 65536\\n        hard: 65536\\n    restart: unless-stopped\\n\",\"features\":[\"kms\",\"tproxy-net\"],\"gateway_enabled\":true,\"kms_enabled\":true,\"local_key_provider_enabled\":false,\"manifest_version\":2,\"name\":\"\",\"no_instance_id\":false,\"pre_launch_script\":\"# shellcheck shell=bash\\n# Phala Cloud pre-launch script for the gm miner CVM.\\n#\\n# This is upstream Phala Cloud's auto-injected pre-launch script v0.0.14\\n# with one functional change: a digest-aware GHCR pull-access verification\\n# block.\\n#\\n# Why the fix is needed: upstream's GHCR verification mis-parses\\n# digest-pinned image refs (`ghcr.io/owner/repo@sha256:...`). It treats the\\n# whole `repo@sha256:...` as the repository path and `latest` as the tag,\\n# builds a malformed manifest URL, gets a 404, and aborts before the\\n# container starts. `gmcli deploy` always pins images by digest, so it\\n# always hits this. The block below splits `@`-pinned refs into the bare\\n# repo and the `sha256:...` digest and verifies the manifest by digest.\\n#\\n# `gmcli deploy` bundles this file (`include_str!`), writes it to the\\n# deploy staging dir, and passes it to `phala deploy --pre-launch-script`.\\necho \\\"----------------------------------------------\\\"\\necho \\\"Running Phala Cloud Pre-Launch Script v0.0.14\\\"\\necho \\\"----------------------------------------------\\\"\\nset -e\\n\\n# Function: notify host\\nnotify_host() {\\n  if command -v dstack-util >/dev/null 2>&1; then\\n    dstack-util notify-host -e \\\"$1\\\" -d \\\"$2\\\"\\n  else\\n    tdxctl notify-host -e \\\"$1\\\" -d \\\"$2\\\"\\n  fi\\n}\\n\\nnotify_host_hoot_info() {\\n  notify_host \\\"boot.progress\\\" \\\"$1\\\"\\n}\\n\\nnotify_host_hoot_error() {\\n  notify_host \\\"boot.error\\\" \\\"$1\\\"\\n}\\n\\n# Function: Perform Docker cleanup\\nperform_cleanup() {\\n  echo \\\"Pruning unused images\\\"\\n  docker image prune -af\\n  echo \\\"Pruning unused volumes\\\"\\n  docker volume prune -f\\n  notify_host_hoot_info \\\"docker cleanup completed\\\"\\n}\\n\\n# Function: Check Docker login status without exposing credentials\\ncheck_docker_login() {\\n  local registry=\\\"$1\\\"\\n\\n  # When registry is specified, check auth entry for that registry in Docker config\\n  if [[ -n \\\"$registry\\\" ]]; then\\n    local docker_config_path=\\\"${DOCKER_CONFIG:-$HOME/.docker}/config.json\\\"\\n    if [[ -f \\\"$docker_config_path\\\" ]] && grep -q \\\"$registry\\\" \\\"$docker_config_path\\\"; then\\n      return 0\\n    else\\n      return 1\\n    fi\\n  fi\\n\\n  # Fallback check when no explicit registry is provided\\n  if docker info 2>/dev/null | grep -q \\\"Username\\\"; then\\n    return 0\\n  else\\n    return 1\\n  fi\\n}\\n\\n# Main logic starts here\\necho \\\"Starting login process...\\\"\\n\\n# Check if Docker credentials exist\\nif [[ -n \\\"$DSTACK_DOCKER_USERNAME\\\" && -n \\\"$DSTACK_DOCKER_PASSWORD\\\" ]]; then\\n  echo \\\"Docker credentials found\\\"\\n  DOCKER_REGISTRY_TARGET=\\\"${DSTACK_DOCKER_REGISTRY:-docker.io}\\\"\\n  echo \\\"Target Docker registry: $DOCKER_REGISTRY_TARGET\\\"\\n\\n  # Check if already logged in\\n  if check_docker_login \\\"$DSTACK_DOCKER_REGISTRY\\\"; then\\n    echo \\\"Already logged in to Docker registry: $DOCKER_REGISTRY_TARGET\\\"\\n  else\\n    echo \\\"Logging in to Docker registry: $DOCKER_REGISTRY_TARGET\\\"\\n    # Login without exposing password in process list\\n    if [[ -n \\\"$DSTACK_DOCKER_REGISTRY\\\" ]]; then\\n      if echo \\\"$DSTACK_DOCKER_PASSWORD\\\" | docker login -u \\\"$DSTACK_DOCKER_USERNAME\\\" --password-stdin \\\"$DSTACK_DOCKER_REGISTRY\\\"; then\\n        echo \\\"Docker login successful: $DOCKER_REGISTRY_TARGET\\\"\\n      else\\n        echo \\\"Docker login failed: $DOCKER_REGISTRY_TARGET\\\"\\n        notify_host_hoot_error \\\"docker login failed\\\"\\n        exit 1\\n      fi\\n    else\\n      if echo \\\"$DSTACK_DOCKER_PASSWORD\\\" | docker login -u \\\"$DSTACK_DOCKER_USERNAME\\\" --password-stdin; then\\n        echo \\\"Docker login successful: $DOCKER_REGISTRY_TARGET\\\"\\n      else\\n        echo \\\"Docker login failed: $DOCKER_REGISTRY_TARGET\\\"\\n        notify_host_hoot_error \\\"docker login failed\\\"\\n        exit 1\\n      fi\\n    fi\\n  fi\\n# Check if AWS ECR credentials exist\\nelif [[ -n \\\"$DSTACK_AWS_ACCESS_KEY_ID\\\" && -n \\\"$DSTACK_AWS_SECRET_ACCESS_KEY\\\" && -n \\\"$DSTACK_AWS_REGION\\\" && -n \\\"$DSTACK_AWS_ECR_REGISTRY\\\" ]]; then\\n  echo \\\"AWS ECR credentials found\\\"\\n\\n  # Check if AWS CLI is installed\\n  if [ ! -f \\\"./aws/dist/aws\\\" ]; then\\n    notify_host_hoot_info \\\"awscli not installed, installing...\\\"\\n    echo \\\"AWS CLI not installed, installing...\\\"\\n    curl \\\"https://awscli.amazonaws.com/awscli-exe-linux-x86_64-2.24.14.zip\\\" -o \\\"awscliv2.zip\\\"\\n    if ! echo \\\"6ff031a26df7daebbfa3ccddc9af1450 awscliv2.zip\\\" | md5sum -c; then\\n      echo \\\"MD5 checksum failed\\\"\\n      notify_host_hoot_error \\\"awscli install failed\\\"\\n      exit 1\\n    fi\\n    unzip awscliv2.zip &>/dev/null\\n  else\\n    echo \\\"AWS CLI is already installed: ./aws/dist/aws\\\"\\n  fi\\n\\n  # Set AWS credentials as environment variables\\n  export AWS_ACCESS_KEY_ID=\\\"$DSTACK_AWS_ACCESS_KEY_ID\\\"\\n  export AWS_SECRET_ACCESS_KEY=\\\"$DSTACK_AWS_SECRET_ACCESS_KEY\\\"\\n  export AWS_DEFAULT_REGION=\\\"$DSTACK_AWS_REGION\\\"\\n\\n  # Set session token if provided (for temporary credentials)\\n  if [[ -n \\\"$DSTACK_AWS_SESSION_TOKEN\\\" ]]; then\\n    echo \\\"AWS session token found, using temporary credentials\\\"\\n    export AWS_SESSION_TOKEN=\\\"$DSTACK_AWS_SESSION_TOKEN\\\"\\n  fi\\n\\n  # Test AWS credentials before attempting ECR login\\n  echo \\\"Testing AWS credentials...\\\"\\n  if ! ./aws/dist/aws sts get-caller-identity &>/dev/null; then\\n    echo \\\"AWS credentials test failed\\\"\\n    # For session token credentials, this might be expected if they're expired\\n    # Log warning but don't fail startup\\n    if [[ -n \\\"$DSTACK_AWS_SESSION_TOKEN\\\" ]]; then\\n      echo \\\"Warning: AWS temporary credentials may have expired, continuing startup\\\"\\n      notify_host_hoot_info \\\"AWS temporary credentials may have expired\\\"\\n    else\\n      echo \\\"AWS credentials test failed\\\"\\n      notify_host_hoot_error \\\"Invalid AWS credentials\\\"\\n      exit 1\\n    fi\\n  else\\n    echo \\\"Logging in to AWS ECR...\\\"\\n    if ./aws/dist/aws ecr get-login-password --region \\\"$DSTACK_AWS_REGION\\\" | docker login --username AWS --password-stdin \\\"$DSTACK_AWS_ECR_REGISTRY\\\"; then\\n      echo \\\"AWS ECR login successful\\\"\\n      notify_host_hoot_info \\\"AWS ECR login successful\\\"\\n    else\\n      echo \\\"AWS ECR login failed\\\"\\n      # For session token credentials, don't fail startup if login fails\\n      if [[ -n \\\"$DSTACK_AWS_SESSION_TOKEN\\\" ]]; then\\n        echo \\\"Warning: AWS ECR login failed with temporary credentials, continuing startup\\\"\\n        notify_host_hoot_info \\\"AWS ECR login failed with temporary credentials\\\"\\n      else\\n        notify_host_hoot_error \\\"AWS ECR login failed\\\"\\n        exit 1\\n      fi\\n    fi\\n  fi\\nfi\\n\\nperform_cleanup\\n\\n#\\n# GHCR image pull access verification (pure HTTP, no docker daemon).\\n#\\n# Digest-aware fix: upstream v0.0.14 splits the ref on `:` only, so a\\n# digest-pinned ref `ghcr.io/owner/repo@sha256:...` is mis-parsed\\n# (`repo@sha256` taken as the repo, `...` as the tag) and the manifest\\n# request 404s. The `@`-vs-`:` split below handles both digest-pinned and\\n# tag-pinned refs.\\n#\\nif [[ \\\"$DOCKER_REGISTRY_TARGET\\\" == \\\"ghcr.io\\\" && -n \\\"$DSTACK_DOCKER_USERNAME\\\" && -n \\\"$DSTACK_DOCKER_PASSWORD\\\" ]]; then\\n  COMPOSE_IMAGES=$(grep 'image:' /dstack/docker-compose.yaml 2>/dev/null | awk '{print $2}' | tr -d '\\\"'\\\\' || true)\\n  for img in $COMPOSE_IMAGES; do\\n    [[ \\\"$img\\\" != ghcr.io/* ]] && continue\\n    ref=\\\"${img#ghcr.io/}\\\"\\n    if [[ \\\"$ref\\\" == *@* ]]; then\\n      repo=\\\"${ref%%@*}\\\"\\n      tag=\\\"${ref#*@}\\\"\\n    else\\n      repo=\\\"${ref%%:*}\\\"\\n      tag=\\\"${ref##*:}\\\"\\n      [[ \\\"$tag\\\" == \\\"$ref\\\" || \\\"$tag\\\" == \\\"$repo\\\" ]] && tag=\\\"latest\\\"\\n    fi\\n    echo \\\"Verifying GHCR pull access: $img\\\"\\n    token=$(curl -sf -u \\\"$DSTACK_DOCKER_USERNAME:$DSTACK_DOCKER_PASSWORD\\\" \\\\\\n      \\\"https://ghcr.io/token?service=ghcr.io&scope=repository:${repo}:pull\\\" | jq -r '.token // empty' || true)\\n    if [[ -z \\\"$token\\\" ]]; then\\n      echo \\\"ERROR: GHCR token exchange failed for $img\\\"\\n      notify_host_hoot_error \\\"GHCR token exchange failed: $img\\\"\\n      exit 1\\n    fi\\n    http_code=$(curl -s -o /dev/null -w \\\"%{http_code}\\\" -H \\\"Authorization: Bearer $token\\\" \\\\\\n      -H \\\"Accept: application/vnd.oci.image.index.v1+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.docker.distribution.manifest.v2+json\\\" \\\\\\n      \\\"https://ghcr.io/v2/${repo}/manifests/${tag}\\\")\\n    if [[ \\\"$http_code\\\" != \\\"200\\\" ]]; then\\n      echo \\\"ERROR: GHCR pull access denied for $img (HTTP $http_code)\\\"\\n      notify_host_hoot_error \\\"GHCR pull access denied: $img (HTTP $http_code)\\\"\\n      exit 1\\n    fi\\n    echo \\\"GHCR pull access OK: $img\\\"\\n  done\\nfi\\n\\n#\\n# Set root password.\\n#\\necho \\\"Setting root password..\\\"\\n\\n# Check if password files are writable\\nPASSWD_WRITABLE=true\\nif [ ! -w /etc/passwd ]; then\\n  echo \\\"Warning: /etc/passwd is read-only\\\"\\n  PASSWD_WRITABLE=false\\nfi\\nif [ ! -w /etc/shadow ]; then\\n  echo \\\"Warning: /etc/shadow is read-only\\\"\\n  PASSWD_WRITABLE=false\\nfi\\n\\nif [ \\\"$PASSWD_WRITABLE\\\" = \\\"false\\\" ]; then\\n  echo \\\"Skipping password setup due to read-only file system\\\"\\nelse\\n  # Check if chpasswd is available\\n  if command -v chpasswd >/dev/null 2>&1; then\\n    echo \\\"Using chpasswd method\\\"\\n\\n    if [ -n \\\"$DSTACK_ROOT_PASSWORD\\\" ]; then\\n      echo \\\"Setting root password from user..\\\"\\n      echo \\\"root:$DSTACK_ROOT_PASSWORD\\\" | chpasswd\\n      unset DSTACK_ROOT_PASSWORD\\n      echo \\\"Root password set/updated from DSTACK_ROOT_PASSWORD\\\"\\n    elif [ -z \\\"$(grep '^root:' /etc/shadow 2>/dev/null | cut -d: -f2)\\\" ]; then\\n      echo \\\"Setting random root password..\\\"\\n      DSTACK_ROOT_PASSWORD=$(\\n        LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | dd bs=1 count=32 2>/dev/null\\n      )\\n      echo \\\"root:$DSTACK_ROOT_PASSWORD\\\" | chpasswd\\n      unset DSTACK_ROOT_PASSWORD\\n      echo \\\"Root password set (random auto-init)\\\"\\n    else\\n      echo \\\"Root password already set; no changes.\\\"\\n    fi\\n  else\\n    echo \\\"Using passwd method\\\"\\n\\n    if [ -n \\\"$DSTACK_ROOT_PASSWORD\\\" ]; then\\n      echo \\\"Setting root password from user..\\\"\\n      echo \\\"$DSTACK_ROOT_PASSWORD\\\" | passwd --stdin root 2>/dev/null ||\\n        printf '%s\\\\n%s\\\\n' \\\"$DSTACK_ROOT_PASSWORD\\\" \\\"$DSTACK_ROOT_PASSWORD\\\" | passwd root\\n      unset DSTACK_ROOT_PASSWORD\\n      echo \\\"Root password set/updated from DSTACK_ROOT_PASSWORD\\\"\\n    elif [ -z \\\"$(grep '^root:' /etc/shadow 2>/dev/null | cut -d: -f2)\\\" ]; then\\n      echo \\\"Setting random root password..\\\"\\n      DSTACK_ROOT_PASSWORD=$(\\n        LC_ALL=C tr -dc 'A-Za-z0-9' </dev/urandom | dd bs=1 count=32 2>/dev/null\\n      )\\n      echo \\\"$DSTACK_ROOT_PASSWORD\\\" | passwd --stdin root 2>/dev/null ||\\n        printf '%s\\\\n%s\\\\n' \\\"$DSTACK_ROOT_PASSWORD\\\" \\\"$DSTACK_ROOT_PASSWORD\\\" | passwd root\\n      unset DSTACK_ROOT_PASSWORD\\n      echo \\\"Root password set (random auto-init)\\\"\\n    else\\n      echo \\\"Root password already set; no changes.\\\"\\n    fi\\n  fi\\nfi\\n\\n#\\n# Set SSH authorized keys\\n#\\nif mkdir -p /home/root/.ssh 2>/dev/null; then\\n  if [[ -n \\\"$DSTACK_ROOT_PUBLIC_KEY\\\" ]]; then\\n    echo \\\"$DSTACK_ROOT_PUBLIC_KEY\\\" >/home/root/.ssh/authorized_keys\\n    unset DSTACK_ROOT_PUBLIC_KEY\\n    echo \\\"Root public key set\\\"\\n  fi\\n  if [[ -n \\\"$DSTACK_AUTHORIZED_KEYS\\\" ]]; then\\n    echo \\\"$DSTACK_AUTHORIZED_KEYS\\\" >/home/root/.ssh/authorized_keys\\n    unset DSTACK_AUTHORIZED_KEYS\\n    echo \\\"Root authorized_keys set\\\"\\n  fi\\n\\n  if [[ -f /dstack/user_config ]] && jq empty /dstack/user_config 2>/dev/null; then\\n    if [[ $(jq 'has(\\\"ssh_authorized_keys\\\")' /dstack/user_config 2>/dev/null) == \\\"true\\\" ]]; then\\n      jq -j '.ssh_authorized_keys' /dstack/user_config >>/home/root/.ssh/authorized_keys\\n      # Remove duplicates if there are multiple keys\\n      if [[ $(wc -l <\\\"/home/root/.ssh/authorized_keys\\\") -gt 1 ]]; then\\n        sort -u /home/root/.ssh/authorized_keys >/home/root/.ssh/authorized_keys.tmp\\n        mv /home/root/.ssh/authorized_keys.tmp /home/root/.ssh/authorized_keys\\n      fi\\n      echo \\\"Set root authorized_keys from user preferences, total\\\" \\\"$(wc -l <\\\"/home/root/.ssh/authorized_keys\\\")\\\" \\\"keys\\\"\\n    fi\\n  fi\\nelse\\n  echo \\\"Warning: Cannot create /home/root/.ssh directory (read-only file system?)\\\"\\n  echo \\\"Skipping SSH key setup\\\"\\nfi\\n\\nif [[ -S /var/run/dstack.sock ]]; then\\n  DSTACK_APP_ID=$(curl -s --unix-socket /var/run/dstack.sock http://dstack/Info | jq -j .app_id)\\n  export DSTACK_APP_ID\\nelif [[ -S /var/run/tappd.sock ]]; then\\n  DSTACK_APP_ID=$(curl -s --unix-socket /var/run/tappd.sock http://dstack/prpc/Tappd.Info | jq -j .app_id)\\n  export DSTACK_APP_ID\\nfi\\n# Check if DSTACK_GATEWAY_DOMAIN is not set, try to get it from user_config or app-compose.json\\n# Priority: user_config > app-compose.json\\nif [[ -z \\\"$DSTACK_GATEWAY_DOMAIN\\\" ]]; then\\n  # First try to get from /dstack/user_config if it exists and is valid JSON\\n  if [[ -f /dstack/user_config ]] && jq empty /dstack/user_config 2>/dev/null; then\\n    if [[ $(jq 'has(\\\"default_gateway_domain\\\")' /dstack/user_config 2>/dev/null) == \\\"true\\\" ]]; then\\n      DSTACK_GATEWAY_DOMAIN=$(jq -j '.default_gateway_domain' /dstack/user_config)\\n      export DSTACK_GATEWAY_DOMAIN\\n    fi\\n  fi\\n\\n  # If still not set, try to get from app-compose.json\\n  if [[ -z \\\"$DSTACK_GATEWAY_DOMAIN\\\" ]] && [[ $(jq 'has(\\\"default_gateway_domain\\\")' app-compose.json) == \\\"true\\\" ]]; then\\n    DSTACK_GATEWAY_DOMAIN=$(jq -j '.default_gateway_domain' app-compose.json)\\n    export DSTACK_GATEWAY_DOMAIN\\n  fi\\nfi\\nif [[ -n \\\"$DSTACK_GATEWAY_DOMAIN\\\" ]]; then\\n  export DSTACK_APP_DOMAIN=\\\"$DSTACK_APP_ID.$DSTACK_GATEWAY_DOMAIN\\\"\\nfi\\n\\necho \\\"----------------------------------------------\\\"\\necho \\\"Script execution completed\\\"\\necho \\\"----------------------------------------------\\\"\\n\",\"public_logs\":true,\"public_sysinfo\":true,\"public_tcbinfo\":true,\"runner\":\"docker-compose\",\"secure_time\":false,\"storage_fs\":\"zfs\",\"tproxy_enabled\":true}"
}