Overview

​

Phala Command Line Interface (CLI) Reference

​

Usage

• Dstack-TEE: Dstack
• Bun for runtime and package management
• TypeScript for type safety
• Commander.js for CLI interface
• Zod for runtime validation

​

🚀 Quick Start (5 Minutes)

​

Install Prerequisites:

# Install Bun
curl -fsSL https://bun.sh/install | bash

# Verify Docker is installed
docker --version

​

Install TEE Cloud CLI:

# Install the CLI globally
npm install -g phala

​

Sign Up and Get API Key:

• Visit Phala Cloud to log into your Phala Cloud account. If you do not have an account, register here.
• After logging in, navigate to the “API Keys” section in your profile
• Create a new API key with an appropriate name (e.g., “CLI Access”)
• Copy the generated API key - you’ll need it for authentication
• You can verify your API key using:
  Copy

  Ask AI

  phala auth login [your-phala-cloud-api-key]
  phala auth status
  

​

Deploy Your First Confidential App:

# Deploy the webshell Dstack example
phala cvms create

# ? Enter a name for the CVM: webshell
# ? Choose a Docker Compose example or enter a custom path:

#  lightclient
#   private-docker-image-deployment
#   ❯ webshell
#   custom-domain
#   prelaunch-script
#   timelock-nts
#   ssh-over-tproxy
#   Using example: webshell (~/phala-cloud-cli/examples/webshell/docker-compose.yaml)
#   ✔ Enter number of vCPUs (default: 1): 1

#   ✔ Enter memory in MB (default: 2048): 2048
#   ✔ Enter disk size in GB (default: 20): 20
#   ⟳ Fetching available TEEPods... ✓
#   ? Select a TEEPod: (Use arrow keys)
#   ❯ prod5 (online)
#   prod2 (online)
#   ℹ Selected TEEPod: prod5

#   ✔ Select an image: dstack-dev-0.3.5
#   ⟳ Getting public key from CVM... ✓
#   ⟳ Encrypting environment variables... ✓
#   ⟳ Creating CVM... ✓
#   ✓ CVM created successfully
#   ℹ CVM ID: 2755
#   ℹ Name: webshell
#   ℹ Status: creating
#   ℹ App ID: e15c1a29a9dfb522da528464a8d5ce40ac28039f
#   ℹ App URL: <https://cloud.phala.network/dashboard/cvms/app_e15c1a29a9dfb522da528464a8d5ce40ac28039f>
#    ℹ
#    ℹ Your CVM is being created. You can check its status with:
#    ℹ phala cvms status e15c1a29a9dfb522da528464a8d5ce40ac28039f

​

Check the CVM’s Attestation:

phala cvms attestation

# ℹ No CVM specified, fetching available CVMs...
# ⟳ Fetching available CVMs... ✓
# ✔ Select a CVM: testing (88721d1685bcd57166a8cbe957cd16f733b3da34) - Status: running
# ℹ Fetching attestation information for CVM 88721d1685bcd57166a8cbe957cd16f733b3da34...
# ⟳ Fetching attestation information... ✓
# ✓ Attestation Summary:

# or list the app-id
phala cvms attestation 88721d1685bcd57166a8cbe957cd16f733b3da34

​

🏗️ Development Workflow

​

1️⃣ Local Development

# Start the TEE simulator
phala simulator start

# Build your Docker image
phala docker build --image my-tee-app --tag v1.0.0

# Create an environment file
echo "API_KEY=test-key" > .env
echo "DEBUG=true" >> .env

# Generate and run Docker Compose
phala docker build-compose --image my-tee-app --tag v1.0.0 --env-file ./.env
phala docker run -c ./phala-compose.yaml -e ./.env

​

2️⃣ Cloud Deployment

# Set your Phala Cloud API key
phala auth login

# Login to Docker and Push your image to Docker Hub
phala docker login
phala docker build --image my-tee-app --tag v1.0.0
phala docker push --image my-tee-app --tag v1.0.0

# Deploy to Phala Cloud
phala cvms create --name my-tee-app --compose ./docker-compose.yml --env-file ./.env

# Access your app via the provided URL

​

💼 Real-World Use Cases for Confidential Computing

​

🏦 Financial Services

• Private Trading Algorithms: Execute proprietary trading strategies without revealing algorithms
• Secure Multi-Party Computation: Perform financial calculations across organizations without exposing sensitive data
• Compliant Data Processing: Process regulated financial data with provable security guarantees

​

🏥 Healthcare

• Medical Research: Analyze sensitive patient data while preserving privacy
• Drug Discovery: Collaborate on pharmaceutical research without exposing intellectual property
• Health Record Processing: Process electronic health records with HIPAA-compliant confidentiality

​

🔐 Cybersecurity

• Secure Key Management: Generate and store cryptographic keys in hardware-protected environments
• Threat Intelligence Sharing: Share cyber threat data across organizations without exposing sensitive details
• Password Verification: Perform credential validation without exposing password databases

​

🏢 Enterprise Applications

• Confidential Analytics: Process sensitive business data without exposure to cloud providers
• IP Protection: Run proprietary algorithms and software while preventing reverse engineering
• Secure Supply Chain: Validate and process sensitive supply chain data across multiple organizations

​

🌐 Web3 and Blockchain

• Private Smart Contracts: Execute contracts with confidential logic and data
• Decentralized Identity: Process identity verification without exposing personal information
• Trustless Oracles: Provide verified external data to blockchain applications

​

🧩 Project Structure

1. Authentication: Connect to your Phala Cloud account
2. TEEPod Info: Fetch information about TEEPods (TEEPods are where your docker apps deploy to)
3. Docker Management: Build and manage Docker images for TEE
4. TEE Simulation: Local development environment
5. Cloud Deployment: Deploy to production and manage TEE Cloud deployments

​

📋 Example Dstack Applications

• Timelock Encryption: Encrypt messages that can only be decrypted after a specified time
• Light Client: A lightweight blockchain client implementation
• SSH Over TEE Proxy: Secure SSH tunneling through a TEE
• Web Shell: Browser-based secure terminal
• Custom Domain: Deploy with your own domain name
• Private Docker Image: Deploy using private Docker registries

​

🔒 Security

1. Encrypted Credentials: API keys and Docker credentials are stored with encryption using a machine-specific key
2. Restricted Permissions: All credential files are stored with 0600 permissions (user-only access)
3. No Validation Storage: API keys are not validated during login, preventing unnecessary transmission
4. Local Storage: All credentials are stored locally in the ~/.phala-cloud/ directory

​

🔍 Troubleshooting

1. Docker Build Fails
   • Verify Docker daemon is running
   • Check Dockerfile path
   • Ensure proper permissions
2. Simulator Issues
   • Check if port 8090 is available
   • Verify Docker permissions
3. Cloud Deployment Fails
   • Validate API key
   • Confirm image exists on Docker Hub
   • Check environment variables

phala --help
phala <command> --help