Node Information

App Name
App ID
29f044f3d4231dd09dd4aa8c6a643a45fd99c654
Instance ID
af03c1ccdd4d1bb6bab8a3343978513a5c7ffcb4
Device ID
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Key Provider Info
{"name":"kms","id":"3059301306072a8648ce3d020106082a8648ce3d030107034200048bf84f52911056474c207cb50b4e8010d984f8975ea57b8f0c8b17502181c283e93a68a9864ad19f629508cc699f125be3871ec2e26ab0597e5bca4e29b7425f"}
Machine Provider
dstack (dstack)
Operating System
DStack 0.5.8
Kernel Version
6.9.0-dstack
CPU
cpu0 @2400 MHz (1 cores)
Memory Usage
Used: 382.15 MB / Total: 1.81 GB (Available: 1.44 GB)
Swap Usage
Used: 0.00 B / Total: 0.00 B (Free: 0.00 B)
Load Average
1min: 0.82%, 5min: 0.98%, 15min: 0.99%
System Uptime
208115
Disk 0
Free: 37.63 GB / Total: 38.28 GB
Deployed Containers

Name	Status	Logs
dstack-gw-1	Up 2 days	View Logs
dstack-mux-1	Up 2 days	View Logs
TCB Info

{
  "mrtd": "f06dfda6dce1cf904d4e2bab1dc370634cf95cefa2ceb2de2eee127c9382698090d7a4a13e14c536ec6c9c3c8fa87077",
  "rtmr0": "68102e7b524af310f7b7d426ce75481e36c40f5d513a9009c046e9d37e31551f0134d954b496a3357fd61d03f07ffe96",
  "rtmr1": "b598fde9491427341bc4683b75d10d3e36770af3a36a6954d8b6b7b22aa66358f13e1f172e51b7d6e6710d99a8d8532f",
  "rtmr2": "9284cde236231d5ddace01104a440fd504df5182a2ad1ac3d2138b80c6a7864bd2c30f69041d8264217f3d24541580cf",
  "rtmr3": "b41195ad4627c9268eacda8ca015ef1e364522c66bee9d16d3ed23e0c89fe06ceaa0b174678c09b7ac64aa25ae157621",
  "mr_aggregated": "76a3271c9e5485d117408c18591ae5decd3773b11eb359101e22a31d47b12b1e",
  "os_image_hash": "6427f4f5ded88b72d326bd973e581c1689c5080c6444a0cf90fec7d9e4c8b92a",
  "compose_hash": "021262abdc18990acba082fa0ac249c8c8ce0b41c9be9be970f1a42627ff3c7e",
  "device_id": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "event_log": [
    {
      "imr": 0,
      "event_type": 2147483659,
      "digest": "0b8772e5b0b41b83e6044a68397e02f49fb47066b4fbe4917ea2c45c64f323fdacbb37948f821ebaf8bc9c938ba8a749",
      "event": "",
      "event_payload": "095464785461626c65000100000000000000af96bb93f2b9b84e9462e0ba745642360090800000000000"
    },
    {
      "imr": 0,
      "event_type": 2147483658,
      "digest": "344bc51c980ba621aaa00da3ed7436f7d6e549197dfe699515dfa2c6583d95e6412af21c097d473155875ffd561d6790",
      "event": "",
      "event_payload": "2946762858585858585858582d585858582d585858582d585858582d58585858585858585858585829000000c0ff000000000040080000000000"
    },
    {
      "imr": 0,
      "event_type": 2147483649,
      "digest": "9dc3a1f80bcec915391dcda5ffbb15e7419f77eab462bbf72b42166fb70d50325e37b36f93537a863769bcf9bedae6fb",
      "event": "",
      "event_payload": "61dfe48bca93d211aa0d00e098032b8c0a00000000000000000000000000000053006500630075007200650042006f006f007400"
    },
    {
      "imr": 0,
      "event_type": 2147483649,
      "digest": "6f2e3cbc14f9def86980f5f66fd85e99d63e69a73014ed8a5633ce56eca5b64b692108c56110e22acadcef58c3250f1b",
      "event": "",
      "event_payload": "61dfe48bca93d211aa0d00e098032b8c0200000000000000000000000000000050004b00"
    },
    {
      "imr": 0,
      "event_type": 2147483649,
      "digest": "d607c0efb41c0d757d69bca0615c3a9ac0b1db06c557d992e906c6b7dee40e0e031640c7bfd7bcd35844ef9edeadc6f9",
      "event": "",
      "event_payload": "61dfe48bca93d211aa0d00e098032b8c030000000000000000000000000000004b0045004b00"
    },
    {
      "imr": 0,
      "event_type": 2147483649,
      "digest": "08a74f8963b337acb6c93682f934496373679dd26af1089cb4eaf0c30cf260a12e814856385ab8843e56a9acea19e127",
      "event": "",
      "event_payload": "cbb219d73a3d9645a3bcdad00e67656f0200000000000000000000000000000064006200"
    },
    {
      "imr": 0,
      "event_type": 2147483649,
      "digest": "18cc6e01f0c6ea99aa23f8a280423e94ad81d96d0aeb5180504fc0f7a40cb3619dd39bd6a95ec1680a86ed6ab0f9828d",
      "event": "",
      "event_payload": "cbb219d73a3d9645a3bcdad00e67656f03000000000000000000000000000000640062007800"
    },
    {
      "imr": 0,
      "event_type": 4,
      "digest": "394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0",
      "event": "",
      "event_payload": "00000000"
    },
    {
      "imr": 0,
      "event_type": 10,
      "digest": "39740da2ea1e7e6c69e5e6569755b2ad6d622a8a9983a2c5b32d5574659dbdc4ca8b95b1c766bd610bc5c26dcde842f8",
      "event": "",
      "event_payload": "414350492044415441"
    },
    {
      "imr": 0,
      "event_type": 10,
      "digest": "6385b89d2decb3de678d51faba0ff3506835915818fd3ee53a739aa678cd9c76bdd755adfa0aa714cf35a1abe062b253",
      "event": "",
      "event_payload": "414350492044415441"
    },
    {
      "imr": 0,
      "event_type": 10,
      "digest": "05705c3ca9d71e908d5ce70d4331b6aadce5331b9a6a546f222f017fb0e1797b951a3dac72f59cb197a0c897a201ca07",
      "event": "",
      "event_payload": "414350492044415441"
    },
    {
      "imr": 1,
      "event_type": 2147483651,
      "digest": "69e0bbb3861d993ddd4b79b40bb31cdc58ed540c754574e3c8af2432c5ac88e751a3b37bcf55a2352bad236b6ff4dc5c",
      "event": "",
      "event_payload": "18e0fd7a00000000008485000000000000000000000000002a000000000000000403140072f728144ab61e44b8c39ebdd7f893c7040412006b00650072006e0065006c0000007fff0400"
    },
    {
      "imr": 0,
      "event_type": 2147483650,
      "digest": "1dd6f7b457ad880d840d41c961283bab688e94e4b59359ea45686581e90feccea3c624b1226113f824f315eb60ae0a7c",
      "event": "",
      "event_payload": "61dfe48bca93d211aa0d00e098032b8c0900000000000000020000000000000042006f006f0074004f0072006400650072000000"
    },
    {
      "imr": 0,
      "event_type": 2147483650,
      "digest": "23ada07f5261f12f34a0bd8e46760962d6b4d576a416f1fea1c64bc656b1d28eacf7047ae6e967c58fd2a98bfa74c298",
      "event": "",
      "event_payload": "61dfe48bca93d211aa0d00e098032b8c08000000000000003e0000000000000042006f006f0074003000300030003000090100002c0055006900410070007000000004071400c9bdb87cebf8344faaea3ee4af6516a10406140021aa2c4614760345836e8ab6f46623317fff0400"
    },
    {
      "imr": 1,
      "event_type": 2147483655,
      "digest": "77a0dab2312b4e1e57a84d865a21e5b2ee8d677a21012ada819d0a98988078d3d740f6346bfe0abaa938ca20439a8d71",
      "event": "",
      "event_payload": "43616c6c696e6720454649204170706c69636174696f6e2066726f6d20426f6f74204f7074696f6e"
    },
    {
      "imr": 1,
      "event_type": 4,
      "digest": "394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0",
      "event": "",
      "event_payload": "00000000"
    },
    {
      "imr": 2,
      "event_type": 6,
      "digest": "b9c214a020aaa317e6b62a6a7d2adfa14fd5b871849c714f747f8728cefda6d3c566e332044051aeac30bfa1fc9916a0",
      "event": "",
      "event_payload": "ed223b8f1a0000004c4f414445445f494d4147453a3a4c6f61644f7074696f6e7300"
    },
    {
      "imr": 2,
      "event_type": 6,
      "digest": "dbfb59810302b3564182a02ae2fc5dcda5f8207380a7b18a9e6dd6fb648c33b1612eb10fb95ec620fb70b9c240ffda1c",
      "event": "",
      "event_payload": "ec223b8f0d0000004c696e757820696e6974726400"
    },
    {
      "imr": 1,
      "event_type": 2147483655,
      "digest": "214b0bef1379756011344877743fdc2a5382bac6e70362d624ccf3f654407c1b4badf7d8f9295dd3dabdef65b27677e0",
      "event": "",
      "event_payload": "4578697420426f6f7420536572766963657320496e766f636174696f6e"
    },
    {
      "imr": 1,
      "event_type": 2147483655,
      "digest": "0a2e01c85deae718a530ad8c6d20a84009babe6c8989269e950d8cf440c6e997695e64d455c4174a652cd080f6230b74",
      "event": "",
      "event_payload": "4578697420426f6f742053657276696365732052657475726e656420776974682053756363657373"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "f9974020ef507068183313d0ca808e0d1ca9b2d1ad0c61f5784e7157c362c06536f5ddacdad4451693f48fcc72fff624",
      "event": "system-preparing",
      "event_payload": ""
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "9dfc090950e6a6454e4b2d4a348f6bc7b93eb564fff21b149e064b8c8749e27a4fb6d1899b4500835b5e0ab922f5cf17",
      "event": "app-id",
      "event_payload": "29f044f3d4231dd09dd4aa8c6a643a45fd99c654"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "614acad485bf21c4b99d7441859128c88e35ef6170bcd45ba6bb1820591b784f278587d9d51d3cc28c7f37ea4df3035b",
      "event": "compose-hash",
      "event_payload": "021262abdc18990acba082fa0ac249c8c8ce0b41c9be9be970f1a42627ff3c7e"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "72ebf57942d4fc9edc6267a3d6bff0709a55092ab30bc9b193667d5117fe53171aee1ee1591d5e304771d3a33f0fc725",
      "event": "instance-id",
      "event_payload": "af03c1ccdd4d1bb6bab8a3343978513a5c7ffcb4"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "98bd7e6bd3952720b65027fd494834045d06b4a714bf737a06b874638b3ea00ff402f7f583e3e3b05e921c8570433ac6",
      "event": "boot-mr-done",
      "event_payload": ""
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "8820ba96a084463e8f7db4d177f11e18f9ba675e242124bcd21deb800051c1d9bbeb454f4dd2df6aae8fa0eb948bb6ab",
      "event": "mr-kms",
      "event_payload": "cfc40c1ff5019b172ec9be8ba2a53b92045aac693d27cb9ec6c9bb3105127e0b"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "dc15768ace33ac7ecd2f86dc032917ed0674d8218a8e138db68e16a4985b2fc4c4576a4b2c8697b83d2a88c990b6f855",
      "event": "os-image-hash",
      "event_payload": "6427f4f5ded88b72d326bd973e581c1689c5080c6444a0cf90fec7d9e4c8b92a"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "f3a83287b84a2356a91901582ff1654035f2de7a628d3a230332b8294b157143686db4fbf2b7d002c082a025e2adf595",
      "event": "key-provider",
      "event_payload": "7b226e616d65223a226b6d73222c226964223a223330353933303133303630373261383634386365336430323031303630383261383634386365336430333031303730333432303030343862663834663532393131303536343734633230376362353062346538303130643938346638393735656135376238663063386231373530323138316332383365393361363861393836346164313966363239353038636336393966313235626533383731656332653236616230353937653562636134653239623734323566227d"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "ba51104636900268b0e059fa3d266419d079d1e94aea26fb9fcbb8d764bf4c89a67ac271b8a0d1a3989945132a111fc7",
      "event": "storage-fs",
      "event_payload": "7a6673"
    },
    {
      "imr": 3,
      "event_type": 134217729,
      "digest": "1a76b2a80a0be71eae59f80945d876351a7a3fb8e9fd1ff1cede5734aa84ea11fd72b4edfbb6f04e5a85edd114c751bd",
      "event": "system-ready",
      "event_payload": ""
    }
  ],
  "app_compose": "{\"allowed_envs\":[\"GW_CATALOG_URL\",\"GW_DATA_DIR\",\"GW_DEPOSITS_ADDR\",\"GW_HMAC_SECRET\",\"GW_HOST\",\"GW_PORT\",\"GW_SITE_ORIGIN\",\"GW_USDC_ADDR\",\"MUX_DATA_DIR\",\"MUX_INTERNAL_TOKEN\",\"MUX_LISTEN_HOST\",\"MUX_LISTEN_PORT\",\"MUX_MASTER_KEY\",\"MUX_RPC_FALLBACKS\",\"MUX_RPC_URL\",\"MUX_SELLER_ADDRESS\",\"MUX_SELLER_CAPS\",\"MUX_SELLER_PEER_ID\",\"MUX_URL\",\"GAS_FUNDER_KEY\",\"MUX_CATALOG_URL\",\"GW_KEY_PREFIX\",\"GW_PRICES_URL\",\"MUX_MAX_RESERVE_USDC\",\"MUX_MAX_PER_REQUEST_USDC\"],\"docker_compose_file\":\"# Source compose (tags). CI builds from this; deploy uses docker-compose.pinned.yml\\n# with sha256 digests — that pinned file is what the TEE measurement covers.\\nservices:\\n  mux:\\n    image: apexant/mux@sha256:3abac3f822249d633245d9a2f665625bc3d139a40e58ce617916b5f19e8483f3\\n    restart: unless-stopped\\n    volumes:\\n      - mux-data:/data\\n    environment:\\n      - MUX_DATA_DIR=${MUX_DATA_DIR}\\n      - MUX_INTERNAL_TOKEN=${MUX_INTERNAL_TOKEN}\\n      - MUX_LISTEN_HOST=${MUX_LISTEN_HOST}\\n      - MUX_LISTEN_PORT=${MUX_LISTEN_PORT}\\n      - MUX_MASTER_KEY=${MUX_MASTER_KEY}\\n      - GAS_FUNDER_KEY=${GAS_FUNDER_KEY}\\n      - MUX_RPC_FALLBACKS=${MUX_RPC_FALLBACKS}\\n      - MUX_RPC_URL=${MUX_RPC_URL}\\n      - MUX_SELLER_ADDRESS=${MUX_SELLER_ADDRESS}\\n      - MUX_SELLER_CAPS=${MUX_SELLER_CAPS}\\n      - MUX_SELLER_PEER_ID=${MUX_SELLER_PEER_ID}\\n      - MUX_CATALOG_URL=${MUX_CATALOG_URL}\\n      - MUX_MAX_RESERVE_USDC=${MUX_MAX_RESERVE_USDC:-}\\n      - MUX_MAX_PER_REQUEST_USDC=${MUX_MAX_PER_REQUEST_USDC:-}\\n      - ANTSEED_DEBUG=${ANTSEED_DEBUG:-}\\n    expose:\\n      - \\\"8410\\\"\\n  gw:\\n    image: apexant/gw@sha256:e86d32c416df8fb52ffb9016c49a1150bcdc27972a2644eb16d45315b7ea2521\\n    restart: unless-stopped\\n    depends_on:\\n      - mux\\n    environment:\\n      - GW_CATALOG_URL=${GW_CATALOG_URL}\\n      - GW_DATA_DIR=${GW_DATA_DIR}\\n      - GW_DEPOSITS_ADDR=${GW_DEPOSITS_ADDR}\\n      - GW_HMAC_SECRET=${GW_HMAC_SECRET}\\n      - GW_HOST=${GW_HOST}\\n      - GW_PORT=${GW_PORT}\\n      - GW_SITE_ORIGIN=${GW_SITE_ORIGIN}\\n      - GW_USDC_ADDR=${GW_USDC_ADDR}\\n      - MUX_INTERNAL_TOKEN=${MUX_INTERNAL_TOKEN}\\n      - MUX_URL=${MUX_URL}\\n    volumes:\\n      - gw-data:/data-gw\\n    ports:\\n      - \\\"8420:8420\\\"\\nvolumes:\\n  mux-data:\\n  gw-data:\\n\",\"features\":[\"kms\",\"tproxy-net\"],\"gateway_enabled\":true,\"kms_enabled\":true,\"local_key_provider_enabled\":false,\"manifest_version\":2,\"name\":\"\",\"no_instance_id\":false,\"pre_launch_script\":\"#!/bin/bash\\necho \\\"----------------------------------------------\\\"\\necho \\\"Running Phala Cloud Pre-Launch Script v0.0.20\\\"\\necho \\\"----------------------------------------------\\\"\\nset -e\\n\\n# Function: notify host\\n\\nnotify_host() {\\n    if command -v dstack-util >/dev/null 2>&1; then\\n        dstack-util notify-host -e \\\"$1\\\" -d \\\"$2\\\"\\n    else\\n        tdxctl notify-host -e \\\"$1\\\" -d \\\"$2\\\"\\n    fi\\n}\\n\\nnotify_host_hoot_info() {\\n    notify_host \\\"boot.progress\\\" \\\"$1\\\"\\n}\\n\\nnotify_host_hoot_error() {\\n    notify_host \\\"boot.error\\\" \\\"$1\\\"\\n}\\n\\n# Function: Perform Docker cleanup\\nperform_cleanup() {\\n    echo \\\"Pruning unused images\\\"\\n    docker image prune -af\\n    echo \\\"Pruning unused volumes\\\"\\n    docker volume prune -f\\n    notify_host_hoot_info \\\"docker cleanup completed\\\"\\n}\\n\\n# Function: Check Docker login status without exposing credentials\\ncheck_docker_login() {\\n    local registry=\\\"${1-}\\\"\\n\\n    # When registry is specified, check auth entry for that registry in Docker config\\n    if [[ -n \\\"$registry\\\" ]]; then\\n        local docker_config_path=\\\"${DOCKER_CONFIG:-${HOME:-}/.docker}/config.json\\\"\\n        if [[ -f \\\"$docker_config_path\\\" ]] && grep -q \\\"$registry\\\" \\\"$docker_config_path\\\"; then\\n            return 0\\n        else\\n            return 1\\n        fi\\n    fi\\n\\n    # Fallback check when no explicit registry is provided\\n    if docker info 2>/dev/null | grep -q \\\"Username\\\"; then\\n        return 0\\n    else\\n        return 1\\n    fi\\n}\\n\\n# Function: print the SHA256 fingerprint of every authorized key\\n#\\n# Output matches `ssh-keygen -lf` and the fingerprints GitHub and Phala Cloud\\n# display, so an operator can match the boot log against the account's key list.\\n# The guest image ships neither ssh-keygen nor a base64 applet (BusyBox has\\n# base32 only), so openssl does both the decode and the digest.\\nprint_authorized_key_fingerprints() {\\n    local file=\\\"$1\\\"\\n    if ! command -v openssl >/dev/null 2>&1; then\\n        echo \\\"openssl not available; skipping SSH key fingerprints\\\"\\n        return 0\\n    fi\\n\\n    # Locals start unset under bash; initialize so set -u (inherited from\\n    # dstack app-compose.sh source) does not trip the read loop guard.\\n    local key_type=\\\"\\\" blob=\\\"\\\" comment=\\\"\\\" decoded_bytes=\\\"\\\" fingerprint=\\\"\\\"\\n    # `|| [[ -n \\\"$key_type\\\" ]]` keeps the final line when the file does not end\\n    # with a newline; read returns non-zero there but still fills the variables.\\n    while read -r key_type blob comment || [[ -n \\\"$key_type\\\" ]]; do\\n        if [[ -z \\\"$blob\\\" ]]; then\\n            continue\\n        fi\\n        # openssl exits 0 on undecodable input and emits nothing, which would\\n        # otherwise print the SHA256 of the empty string as a real fingerprint.\\n        decoded_bytes=$(printf '%s' \\\"$blob\\\" | openssl base64 -d -A 2>/dev/null | wc -c || true)\\n        if [[ \\\"$decoded_bytes\\\" -eq 0 ]]; then\\n            echo \\\"  $key_type <unreadable key>\\\"\\n            continue\\n        fi\\n        fingerprint=$(printf '%s' \\\"$blob\\\" | openssl base64 -d -A 2>/dev/null | openssl dgst -sha256 -binary 2>/dev/null | openssl base64 -A 2>/dev/null | tr -d '=' || true)\\n        echo \\\"  $key_type SHA256:$fingerprint\\\"\\n    done < \\\"$file\\\"\\n}\\n\\n# Main logic starts here\\necho \\\"Starting login process...\\\"\\n\\n# Optional env vars below use ${VAR-} / ${VAR:-} so this script stays safe when\\n# app-compose.sh sources it under `set -euo pipefail` without registry/SSH/root\\n# credentials set. Bare \\\"$VAR\\\" throws \\\"unbound variable\\\" under nounset.\\nDOCKER_REGISTRY_TARGET=\\\"${DSTACK_DOCKER_REGISTRY:-docker.io}\\\"\\n\\n# Check if Docker credentials exist\\nif [[ -n \\\"${DSTACK_DOCKER_USERNAME-}\\\" && -n \\\"${DSTACK_DOCKER_PASSWORD-}\\\" ]]; then\\n    echo \\\"Docker credentials found\\\"\\n    echo \\\"Target Docker registry: $DOCKER_REGISTRY_TARGET\\\"\\n\\n    # Check if already logged in\\n    if check_docker_login \\\"${DSTACK_DOCKER_REGISTRY-}\\\"; then\\n        echo \\\"Already logged in to Docker registry: $DOCKER_REGISTRY_TARGET\\\"\\n    else\\n        echo \\\"Logging in to Docker registry: $DOCKER_REGISTRY_TARGET\\\"\\n        # Login without exposing password in process list\\n        if [[ -n \\\"${DSTACK_DOCKER_REGISTRY-}\\\" ]]; then\\n            if ! echo \\\"$DSTACK_DOCKER_PASSWORD\\\" | docker login -u \\\"$DSTACK_DOCKER_USERNAME\\\" --password-stdin \\\"$DSTACK_DOCKER_REGISTRY\\\"; then\\n                echo \\\"Docker login failed: $DOCKER_REGISTRY_TARGET\\\"\\n                notify_host_hoot_error \\\"docker login failed\\\"\\n                exit 1\\n            fi\\n        elif ! echo \\\"$DSTACK_DOCKER_PASSWORD\\\" | docker login -u \\\"$DSTACK_DOCKER_USERNAME\\\" --password-stdin; then\\n            echo \\\"Docker login failed: $DOCKER_REGISTRY_TARGET\\\"\\n            notify_host_hoot_error \\\"docker login failed\\\"\\n            exit 1\\n        fi\\n        echo \\\"Docker login successful: $DOCKER_REGISTRY_TARGET\\\"\\n    fi\\n# Check if AWS ECR credentials exist\\nelif [[ -n \\\"${DSTACK_AWS_ACCESS_KEY_ID-}\\\" && -n \\\"${DSTACK_AWS_SECRET_ACCESS_KEY-}\\\" && -n \\\"${DSTACK_AWS_REGION-}\\\" && -n \\\"${DSTACK_AWS_ECR_REGISTRY-}\\\" ]]; then\\n    echo \\\"AWS ECR credentials found\\\"\\n\\n    # Check if AWS CLI is installed\\n    if [ ! -f \\\"./aws/dist/aws\\\" ]; then\\n        notify_host_hoot_info \\\"awscli not installed, installing...\\\"\\n        echo \\\"AWS CLI not installed, installing...\\\"\\n        if ! curl \\\"https://awscli.amazonaws.com/awscli-exe-linux-x86_64-2.24.14.zip\\\" -o \\\"awscliv2.zip\\\"; then\\n            echo \\\"AWS CLI download failed\\\"\\n            notify_host_hoot_error \\\"awscli install failed\\\"\\n            exit 1\\n        fi\\n        if ! echo \\\"6ff031a26df7daebbfa3ccddc9af1450 awscliv2.zip\\\" | md5sum -c; then\\n            echo \\\"MD5 checksum failed\\\"\\n            notify_host_hoot_error \\\"awscli install failed\\\"\\n            exit 1\\n        fi\\n        unzip awscliv2.zip &> /dev/null\\n    else\\n        echo \\\"AWS CLI is already installed: ./aws/dist/aws\\\"\\n    fi\\n\\n    # Set AWS credentials as environment variables\\n    export AWS_ACCESS_KEY_ID=\\\"$DSTACK_AWS_ACCESS_KEY_ID\\\"\\n    export AWS_SECRET_ACCESS_KEY=\\\"$DSTACK_AWS_SECRET_ACCESS_KEY\\\"\\n    export AWS_DEFAULT_REGION=\\\"$DSTACK_AWS_REGION\\\"\\n\\n    # Set session token if provided (for temporary credentials)\\n    if [[ -n \\\"${DSTACK_AWS_SESSION_TOKEN-}\\\" ]]; then\\n        echo \\\"AWS session token found, using temporary credentials\\\"\\n        export AWS_SESSION_TOKEN=\\\"$DSTACK_AWS_SESSION_TOKEN\\\"\\n    fi\\n\\n    # Test AWS credentials before attempting ECR login\\n    echo \\\"Testing AWS credentials...\\\"\\n    if ! ./aws/dist/aws sts get-caller-identity &> /dev/null; then\\n        echo \\\"AWS credentials test failed\\\"\\n        # For session token credentials, this might be expected if they're expired\\n        # Log warning but don't fail startup\\n        if [[ -n \\\"${DSTACK_AWS_SESSION_TOKEN-}\\\" ]]; then\\n            echo \\\"Warning: AWS temporary credentials may have expired, continuing startup\\\"\\n            notify_host_hoot_info \\\"AWS temporary credentials may have expired\\\"\\n        else\\n            echo \\\"AWS credentials test failed\\\"\\n            notify_host_hoot_error \\\"Invalid AWS credentials\\\"\\n            exit 1\\n        fi\\n    else\\n        echo \\\"Logging in to AWS ECR...\\\"\\n        if ./aws/dist/aws ecr get-login-password --region \\\"$DSTACK_AWS_REGION\\\" | docker login --username AWS --password-stdin \\\"$DSTACK_AWS_ECR_REGISTRY\\\"; then\\n            echo \\\"AWS ECR login successful\\\"\\n            notify_host_hoot_info \\\"AWS ECR login successful\\\"\\n        else\\n            echo \\\"AWS ECR login failed\\\"\\n            # For session token credentials, don't fail startup if login fails\\n            if [[ -n \\\"${DSTACK_AWS_SESSION_TOKEN-}\\\" ]]; then\\n                echo \\\"Warning: AWS ECR login failed with temporary credentials, continuing startup\\\"\\n                notify_host_hoot_info \\\"AWS ECR login failed with temporary credentials\\\"\\n            else\\n                notify_host_hoot_error \\\"AWS ECR login failed\\\"\\n                exit 1\\n            fi\\n        fi\\n    fi\\nfi\\n\\nperform_cleanup\\n\\n#\\n# GHCR image pull access verification (pure HTTP, no docker daemon)\\n#\\nif [[ \\\"$DOCKER_REGISTRY_TARGET\\\" == \\\"ghcr.io\\\" && -n \\\"${DSTACK_DOCKER_USERNAME-}\\\" && -n \\\"${DSTACK_DOCKER_PASSWORD-}\\\" ]]; then\\n    # Strip surrounding quotes from compose image refs. Two tr calls keep the\\n    # intent obvious inside this Python string (no quote-concatenation idiom).\\n    COMPOSE_IMAGES=$(grep 'image:' /dstack/docker-compose.yaml 2>/dev/null | awk '{print $2}' | tr -d '\\\"' | tr -d \\\"'\\\" || true)\\n    HEADER=\\\"Accept: application/vnd.oci.image.index.v1+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.docker.distribution.manifest.v2+json\\\"\\n    for img in $COMPOSE_IMAGES; do\\n        [[ \\\"$img\\\" != ghcr.io/* ]] && continue\\n        ref=\\\"${img#ghcr.io/}\\\"\\n        # Digest-pinned refs (repo@sha256:...) use the digest as the manifest\\n        # reference; tag refs (repo:tag) use the tag, defaulting to latest.\\n        if [[ \\\"$ref\\\" == *@* ]]; then\\n            repo=\\\"${ref%%@*}\\\"\\n            reference=\\\"${ref#*@}\\\"\\n        else\\n            repo=\\\"${ref%%:*}\\\"\\n            reference=\\\"${ref##*:}\\\"\\n            [[ \\\"$reference\\\" == \\\"$ref\\\" ]] && reference=\\\"latest\\\"\\n        fi\\n        echo \\\"Verifying GHCR pull access: $img\\\"\\n        token=$(curl -sf -u \\\"$DSTACK_DOCKER_USERNAME:$DSTACK_DOCKER_PASSWORD\\\" \\\"https://ghcr.io/token?service=ghcr.io&scope=repository:${repo}:pull\\\" | jq -r '.token // empty' || true)\\n        if [[ -z \\\"${token-}\\\" ]]; then\\n            echo \\\"ERROR: GHCR token exchange failed for $img\\\"\\n            notify_host_hoot_error \\\"GHCR token exchange failed: $img\\\"\\n            exit 1\\n        fi\\n        http_code=$(curl -s -o /dev/null -w \\\"%{http_code}\\\" -H \\\"Authorization: Bearer $token\\\" -H \\\"$HEADER\\\" \\\"https://ghcr.io/v2/${repo}/manifests/${reference}\\\")\\n        if [[ \\\"$http_code\\\" != \\\"200\\\" ]]; then\\n            echo \\\"ERROR: GHCR pull access denied for $img (HTTP $http_code)\\\"\\n            notify_host_hoot_error \\\"GHCR pull access denied: $img (HTTP $http_code)\\\"\\n            exit 1\\n        fi\\n        echo \\\"GHCR pull access OK: $img\\\"\\n    done\\nfi\\n\\n#\\n# Pull latest images from docker-compose.yaml so existing CVMs pick up new tags.\\n# Pull is fail-soft: short-lived tokens may expire between login and pull, but\\n# falling back to already-cached images is preferable to blocking boot.\\n#\\necho \\\"Images before pull:\\\"\\ndocker images --format '{{.Repository}}:{{.Tag}} {{.ID}} ({{.CreatedSince}})'\\n\\necho \\\"Pulling latest images from /dstack/docker-compose.yaml...\\\"\\nif docker compose -f /dstack/docker-compose.yaml pull; then\\n    echo \\\"docker compose pull completed\\\"\\n    notify_host_hoot_info \\\"docker compose pull completed\\\"\\nelse\\n    echo \\\"WARNING: docker compose pull failed; continuing with existing images\\\"\\n    notify_host_hoot_info \\\"docker compose pull failed; using existing images\\\"\\nfi\\n\\necho \\\"Images after pull:\\\"\\ndocker images --format '{{.Repository}}:{{.Tag}} {{.ID}} ({{.CreatedSince}})'\\n\\n#\\n# Set root password.\\n#\\necho \\\"Setting root password..\\\"\\n\\n# Check if password files are writable\\nPASSWD_WRITABLE=true\\nif [ ! -w /etc/passwd ]; then\\n    echo \\\"Warning: /etc/passwd is read-only\\\"\\n    PASSWD_WRITABLE=false\\nfi\\nif [ ! -w /etc/shadow ]; then\\n    echo \\\"Warning: /etc/shadow is read-only\\\"\\n    PASSWD_WRITABLE=false\\nfi\\n\\nif [ \\\"$PASSWD_WRITABLE\\\" = \\\"false\\\" ]; then\\n    echo \\\"Skipping password setup due to read-only file system\\\"\\nelse\\n    # Check if chpasswd is available\\n    if command -v chpasswd >/dev/null 2>&1; then\\n        echo \\\"Using chpasswd method\\\"\\n\\n        if [ -n \\\"${DSTACK_ROOT_PASSWORD-}\\\" ]; then\\n            echo \\\"Setting root password from user..\\\"\\n            echo \\\"root:$DSTACK_ROOT_PASSWORD\\\" | chpasswd\\n            unset DSTACK_ROOT_PASSWORD\\n            echo \\\"Root password set/updated from DSTACK_ROOT_PASSWORD\\\"\\n        elif [ -z \\\"$(grep '^root:' /etc/shadow 2>/dev/null | cut -d: -f2)\\\" ]; then\\n            echo \\\"Setting random root password..\\\"\\n            # dstack guest busybox lacks head -c (FANCY_HEAD off); dd is the\\n            # last pipeline command, so its 0 status masks tr's SIGPIPE exit.\\n            DSTACK_ROOT_PASSWORD=$(LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | dd bs=1 count=32 2>/dev/null)\\n            echo \\\"root:$DSTACK_ROOT_PASSWORD\\\" | chpasswd\\n            unset DSTACK_ROOT_PASSWORD\\n            echo \\\"Root password set (random auto-init)\\\"\\n        else\\n            echo \\\"Root password already set; no changes.\\\"\\n        fi\\n    else\\n        # No chpasswd: do not pipe into interactive passwd(1). It often reads\\n        # /dev/tty and fails with \\\"password for root is unchanged\\\" during boot.\\n        echo \\\"Using passwd method\\\"\\n\\n        if [ -n \\\"${DSTACK_ROOT_PASSWORD-}\\\" ]; then\\n            echo \\\"Setting root password from user..\\\"\\n            if command -v passwd >/dev/null 2>&1 && passwd --help 2>&1 | grep -q -- '--stdin'; then\\n                echo \\\"$DSTACK_ROOT_PASSWORD\\\" | passwd --stdin root\\n            elif command -v openssl >/dev/null 2>&1; then\\n                # busybox passwd has no --stdin; write the SHA-512 crypt hash\\n                # into /etc/shadow directly instead of driving interactive passwd.\\n                HASHED_ROOT_PASSWORD=$(openssl passwd -6 \\\"$DSTACK_ROOT_PASSWORD\\\")\\n                sed -i \\\"s|^root:[^:]*:|root:${HASHED_ROOT_PASSWORD}:|\\\" /etc/shadow\\n                unset HASHED_ROOT_PASSWORD\\n            else\\n                echo \\\"Error: cannot set DSTACK_ROOT_PASSWORD non-interactively\\\"\\n                echo \\\"Need chpasswd, passwd --stdin, or openssl\\\"\\n                exit 1\\n            fi\\n            unset DSTACK_ROOT_PASSWORD\\n            echo \\\"Root password set/updated from DSTACK_ROOT_PASSWORD\\\"\\n        elif [ -z \\\"$(grep '^root:' /etc/shadow 2>/dev/null | cut -d: -f2)\\\" ]; then\\n            # Never lock the account here: sshd built without PAM (dstack dev\\n            # images) treats a locked account as \\\"deny all authentication\\\",\\n            # which breaks public-key SSH too. Set a discarded random password\\n            # by writing its crypt hash into /etc/shadow directly.\\n            if command -v openssl >/dev/null 2>&1; then\\n                echo \\\"Setting random root password..\\\"\\n                DSTACK_ROOT_PASSWORD=$(LC_ALL=C tr -dc 'A-Za-z0-9' < /dev/urandom | dd bs=1 count=32 2>/dev/null)\\n                HASHED_ROOT_PASSWORD=$(openssl passwd -6 \\\"$DSTACK_ROOT_PASSWORD\\\")\\n                sed -i \\\"s|^root:[^:]*:|root:${HASHED_ROOT_PASSWORD}:|\\\" /etc/shadow\\n                unset DSTACK_ROOT_PASSWORD HASHED_ROOT_PASSWORD\\n                echo \\\"Root password set (random auto-init)\\\"\\n            else\\n                echo \\\"Warning: no openssl to hash a random password; leaving root password empty\\\"\\n            fi\\n        else\\n            echo \\\"Root password already set; no changes.\\\"\\n        fi\\n    fi\\nfi\\n\\n#\\n# Set SSH authorized keys\\n#\\nif mkdir -p /home/root/.ssh 2>/dev/null; then\\n    if [[ -n \\\"${DSTACK_ROOT_PUBLIC_KEY-}\\\" ]]; then\\n        echo \\\"$DSTACK_ROOT_PUBLIC_KEY\\\" > /home/root/.ssh/authorized_keys\\n        unset DSTACK_ROOT_PUBLIC_KEY\\n        echo \\\"Root public key set\\\"\\n    fi\\n    if [[ -n \\\"${DSTACK_AUTHORIZED_KEYS-}\\\" ]]; then\\n        echo \\\"$DSTACK_AUTHORIZED_KEYS\\\" > /home/root/.ssh/authorized_keys\\n        unset DSTACK_AUTHORIZED_KEYS\\n        echo \\\"Root authorized_keys set\\\"\\n    fi\\n\\n    if [[ -f /dstack/user_config ]] && jq empty /dstack/user_config 2>/dev/null; then\\n        if [[ $(jq 'has(\\\"ssh_authorized_keys\\\")' /dstack/user_config 2>/dev/null) == \\\"true\\\" ]]; then\\n            # jq -r terminates the value with a newline; jq -j does not, which\\n            # both concatenated the next appended key onto the same line and\\n            # made line-based counting report one key fewer than the file holds.\\n            jq -r '.ssh_authorized_keys' /dstack/user_config >> /home/root/.ssh/authorized_keys\\n            # Drop duplicates and the blank line an empty key list produces.\\n            sort -u /home/root/.ssh/authorized_keys > /home/root/.ssh/authorized_keys.tmp\\n            mv /home/root/.ssh/authorized_keys.tmp /home/root/.ssh/authorized_keys\\n            KEY_COUNT=$(grep -c '^[^[:space:]]' /home/root/.ssh/authorized_keys || true)\\n            echo \\\"Set root authorized_keys from user preferences, total $KEY_COUNT keys\\\"\\n            print_authorized_key_fingerprints /home/root/.ssh/authorized_keys\\n        fi\\n    fi\\nelse\\n    echo \\\"Warning: Cannot create /home/root/.ssh directory (read-only file system?)\\\"\\n    echo \\\"Skipping SSH key setup\\\"\\nfi\\n\\nif [[ -S /var/run/dstack.sock ]]; then\\n    export DSTACK_APP_ID=$(curl -s --unix-socket /var/run/dstack.sock http://dstack/Info | jq -j .app_id)\\nelif [[ -S /var/run/tappd.sock ]]; then\\n    export DSTACK_APP_ID=$(curl -s --unix-socket /var/run/tappd.sock http://dstack/prpc/Tappd.Info | jq -j .app_id)\\nfi\\n# Check if DSTACK_GATEWAY_DOMAIN is not set, try to get it from user_config or app-compose.json\\n# Priority: user_config > app-compose.json\\nif [[ -z \\\"${DSTACK_GATEWAY_DOMAIN-}\\\" ]]; then\\n    # First try to get from /dstack/user_config if it exists and is valid JSON\\n    if [[ -f /dstack/user_config ]] && jq empty /dstack/user_config 2>/dev/null; then\\n        if [[ $(jq 'has(\\\"default_gateway_domain\\\")' /dstack/user_config 2>/dev/null) == \\\"true\\\" ]]; then\\n            export DSTACK_GATEWAY_DOMAIN=$(jq -j '.default_gateway_domain' /dstack/user_config)\\n        fi\\n    fi\\n\\n    # If still not set, try to get from app-compose.json\\n    if [[ -z \\\"${DSTACK_GATEWAY_DOMAIN-}\\\" ]] && [[ -f app-compose.json ]] && [[ $(jq 'has(\\\"default_gateway_domain\\\")' app-compose.json) == \\\"true\\\" ]]; then\\n        export DSTACK_GATEWAY_DOMAIN=$(jq -j '.default_gateway_domain' app-compose.json)\\n    fi\\nfi\\nif [[ -n \\\"${DSTACK_GATEWAY_DOMAIN-}\\\" && -n \\\"${DSTACK_APP_ID-}\\\" ]]; then\\n    export DSTACK_APP_DOMAIN=$DSTACK_APP_ID\\\".\\\"$DSTACK_GATEWAY_DOMAIN\\nfi\\n\\necho \\\"----------------------------------------------\\\"\\necho \\\"Script execution completed\\\"\\necho \\\"----------------------------------------------\\\"\\n\",\"public_logs\":true,\"public_sysinfo\":true,\"public_tcbinfo\":true,\"runner\":\"docker-compose\",\"secure_time\":false,\"storage_fs\":\"zfs\",\"tproxy_enabled\":true}"
}