> ## Documentation Index
> Fetch the complete documentation index at: https://docs.phala.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create CVM (two-phase on one path)

> Single entry point for CVM creation. Send a provision payload (compose_file + name) to prepare: validates the configuration, caches it for 14 days, and returns app_id, compose_hash, the env-encryption pubkey, and a commit token. Then send the token back with the encrypted environment to create the CVM. The legacy pair (POST /cvms/provision then POST /cvms with app_id + compose_hash) keeps working during the deprecation window.



## OpenAPI

````yaml /openapi.json post /api/v1/cvms
openapi: 3.1.0
info:
  title: Phala Cloud API
  version: 0.1.0
servers:
  - url: https://cloud-api.phala.com
security: []
tags:
  - name: CVMs
    description: Confidential Virtual Machine (CVM) lifecycle management on Phala Network
    x-mint:
      href: https://cloud.phala.network/api-reference/cvms
  - name: Apps
    description: App template management and CVM deployment from app blueprints
    x-mint:
      href: https://cloud.phala.network/api-reference/apps
  - name: Webhooks
    description: Manage webhook endpoints and monitor delivery history
    x-mint:
      href: https://cloud.phala.network/api-reference/webhooks
  - name: SSH Keys
    description: SSH public key management for CVM access
    x-mint:
      href: https://cloud.phala.network/api-reference/ssh-keys
  - name: KMS
    description: >-
      Key Management Service — key derivation, on-chain anchoring, and
      inspection
    x-mint:
      href: https://cloud.phala.network/api-reference/kms
  - name: Instance Types
    description: Available hardware configurations for CVM deployment
    x-mint:
      href: https://cloud.phala.network/api-reference/instance-types
  - name: Attestations
    description: Remote attestation and TEE verification endpoints
    x-mint:
      href: https://cloud.phala.network/api-reference/attestations
paths:
  /api/v1/cvms:
    post:
      tags:
        - CVMs
      summary: Create CVM (two-phase on one path)
      description: >-
        Single entry point for CVM creation. Send a provision payload
        (compose_file + name) to prepare: validates the configuration, caches it
        for 14 days, and returns app_id, compose_hash, the env-encryption
        pubkey, and a commit token. Then send the token back with the encrypted
        environment to create the CVM. The legacy pair (POST /cvms/provision
        then POST /cvms with app_id + compose_hash) keeps working during the
        deprecation window.
      operationId: handle_create_cvm_api_v1_cvms_post
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/ProvisionDstackAppRequestV2'
                - $ref: '#/components/schemas/CommitCvmCreateRequest'
                - $ref: '#/components/schemas/CreateTappRequest'
      responses:
        '200':
          description: >-
            Prepare returns provision data with a token; commit returns the
            created CVM
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/ProvisionDstackAppResponseV2'
                  - $ref: '#/components/schemas/CreatedVM'
        '400':
          description: Invalid payload or provision data expired
        '401':
          description: Authentication required or invalid token
        '403':
          description: Commit token belongs to another workspace
        '409':
          description: Commit token is already being processed
        '413':
          description: CVM create request exceeds the byte limit
        '422':
          description: Validation error or provision data not found
components:
  schemas:
    ProvisionDstackAppRequestV2:
      oneOf:
        - required:
            - compose_file
        - required:
            - compose_file_raw
      properties:
        compose_file:
          $ref: '#/components/schemas/AppComposeV2-Input'
        compose_file_raw:
          type: string
          title: Compose File Raw
          description: >-
            A whole app-compose JSON file, sent instead of compose_file. Phala
            Cloud parses it with the same rules as compose_file and serializes
            it the same way, so the deployed bytes and compose hash match the
            structured form, not the sent bytes. Needs the compose_advanced
            feature flag.
        name:
          type: string
          title: Name
          description: >-
            CVM name (used as hostname): 5-63 chars, must start with letter, can
            contain letters/numbers/hyphens
        instance_type:
          anyOf:
            - type: string
            - type: 'null'
          title: Instance Type
        vcpu:
          anyOf:
            - type: integer
            - type: 'null'
          title: Vcpu
        memory:
          anyOf:
            - type: integer
            - type: 'null'
          title: Memory
        disk_size:
          anyOf:
            - type: integer
            - type: 'null'
          title: Disk Size
        image:
          anyOf:
            - type: string
            - type: 'null'
          title: Image
        prefer_dev:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Prefer Dev
          description: >-
            For OS images before 0.6.0, True selects dev and False selects
            non-dev. Ignored for unified images (0.6.0 or later). When None,
            inferred from the image name or defaults to dev.
        node:
          anyOf:
            - type: string
              minLength: 1
            - type: 'null'
          title: Node
          description: Physical node name
        region:
          anyOf:
            - type: string
            - type: 'null'
          title: Region
        listed:
          type: boolean
          title: Listed
          default: false
        kms_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Kms Id
        kms:
          anyOf:
            - $ref: '#/components/schemas/KmsType'
            - type: 'null'
          default: phala
        kms_contract_id:
          anyOf:
            - type: string
              pattern: ^kc_.+
              format: hashid
              title: HashedId[kms_contracts]
              description: A hashed identifier that maps to an internal database ID
              examples:
                - kc_0123abcd
            - type: 'null'
          title: Kms Contract Id
        kms_contract:
          anyOf:
            - type: string
            - type: 'null'
          title: Kms Contract
        nonce:
          anyOf:
            - type: integer
            - type: 'null'
          title: Nonce
          description: >-
            Optional nonce for deterministic app_id generation. When provided,
            app_id must also be provided. System will verify: app_id ==
            get_create_address(team_wallet, nonce)
        app_id:
          anyOf:
            - type: string
            - type: 'null'
          title: App Id
          description: >-
            Optional app_id for manual specification. Required when nonce is
            provided. Only works with PHALA KMS.
        env_keys:
          items:
            type: string
          type: array
          title: Env Keys
          description: >-
            Allowed encrypted environment variable names. When compose_file does
            not declare allowed_envs, or sends an empty list, these names
            populate compose_file.allowed_envs for the guest allowlist.
        ports:
          anyOf:
            - items:
                $ref: '#/components/schemas/CreateTimePortMappingEntry'
              type: array
            - type: 'null'
          title: Ports
        encrypted_env:
          anyOf:
            - type: string
            - type: 'null'
          title: Encrypted Env
        user_config:
          anyOf:
            - type: string
            - type: 'null'
          title: User Config
        hugepages:
          type: boolean
          title: Hugepages
          default: false
        pin_numa:
          type: boolean
          title: Pin Numa
          default: false
        gpus:
          anyOf:
            - $ref: '#/components/schemas/GpuConfig'
            - type: 'null'
        kms_urls:
          items:
            type: string
          type: array
          title: Kms Urls
        gateway_urls:
          items:
            type: string
          type: array
          title: Gateway Urls
        skip_gateway:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Skip Gateway
          description: >-
            Deploy without dstack-gateway. Turns the gateway off in compose_file
            when it does not set gateway_enabled/tproxy_enabled; rejected when
            compose_file enables the gateway.
        key_provider_mode:
          anyOf:
            - type: string
              enum:
                - kms
                - local
            - type: 'null'
          title: Key Provider Mode
          description: >-
            Key provider mode. 'local' enables the local key provider in
            compose_file (and turns off KMS and the gateway where compose_file
            does not set them); rejected when compose_file sets key_provider or
            local_key_provider_enabled the other way.
        init_scripts:
          items:
            type: string
            enum:
              - docker_cleanup
              - env_merge
          type: array
          title: Init Scripts
          description: >-
            Platform-owned init scripts to run on every boot, as slugs:
            docker_cleanup erases all local container-runtime stores (images,
            volumes, all containerd namespaces) and needs OS 0.6.x, ext4 storage
            and the docker-compose runner; env_merge merges encrypted env on
            boot, needs OS 0.6.0 or newer and the managed_env_create feature
            flag. Phala Cloud fixes the run order (docker_cleanup, then
            env_merge). The deprecated object form {"env_merge": bool} is still
            accepted. GET /cvms/{cvm_id}/init-scripts shows what an existing CVM
            runs.
        enabled_init_scripts_docker_cleanup:
          type: boolean
          title: Enabled Init Scripts Docker Cleanup
          description: >-
            Deprecated: send init_scripts: ["docker_cleanup"]. True adds
            docker_cleanup to init_scripts.
          default: false
          deprecated: true
        launch_token:
          anyOf:
            - type: string
            - type: 'null'
          title: Launch Token
          description: >-
            Launch token (at least 32 bytes) the guest requires on every boot
            before key provisioning. Phala Cloud writes its hash into
            compose_file.requirements.launch_token_hash and stores the token on
            the app. For an existing app it must equal the app's token. Needs
            dstack OS 0.6.0 or newer. Phala Cloud and the node operator can read
            the token: it protects only against parties who know the public
            compose.
        generate_launch_token:
          type: boolean
          title: Generate Launch Token
          description: >-
            Gate the CVM with a launch token Phala Cloud generates for a new
            app, or with the app's existing token. A newly generated token is
            returned once, in the create (commit) response.
          default: false
        enabled_guest_agent_access:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Enabled Guest Agent Access
          description: >-
            Restrict the guest agent (port 8090) to Phala Cloud by sending
            false. Omit it to leave the app unchanged; a new app starts
            unrestricted. Sending true never relaxes an existing restriction: it
            is rejected with ERR-03-030 when the app is already restricted,
            because relaxing requires Phala Cloud support.
        ssh_key_ids:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Ssh Key Ids
          description: >-
            SSH key hashids to authorize on the new CVM. Must belong to a member
            of the workspace. Omit to authorize all of your own active keys.
        annotations:
          additionalProperties:
            type: string
          type: object
          title: Annotations
          description: >-
            Opaque key/value metadata for host-side tooling, stored by the
            dstack VMM with the VM. Not passed to the guest, not measured, and
            not part of the compose hash: attestation does not cover it, so do
            not rely on it for security. A non-empty map requires the
            cvm_annotations feature flag (ERR-03-049) and a node running dstack
            VMM 0.6.1 or newer (ERR-03-050). Keys must not be empty. Phala Cloud
            keeps no copy as CVM state and never copies or restores it (a
            replica starts without it, a relocated CVM keeps what its VMM
            manifest carries); this create request is recorded in the audit log.
      type: object
      required:
        - name
      title: ProvisionDstackAppRequestV2
      description: >-
        Request for provisioning a DStack app with automatic resource matching.


        Most fields are optional and will be automatically determined by the
        resource

        matching logic in preflight_dstack_app. Only compose_file and name are
        required.
    CommitCvmCreateRequest:
      properties:
        token:
          type: string
          title: Token
        encrypted_env:
          anyOf:
            - type: string
            - type: 'null'
          title: Encrypted Env
        transaction_hash:
          anyOf:
            - type: string
            - type: 'null'
          title: Transaction Hash
        compose_hash:
          anyOf:
            - type: string
            - type: 'null'
          title: Compose Hash
        app_id:
          anyOf:
            - type: string
            - type: 'null'
          title: App Id
        kms_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Kms Id
        contract_address:
          anyOf:
            - type: string
            - type: 'null'
          title: Contract Address
        deployer_address:
          anyOf:
            - type: string
            - type: 'null'
          title: Deployer Address
        env_keys:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Env Keys
      type: object
      required:
        - token
      title: CommitCvmCreateRequest
      description: Second-phase create request identified by a prepare token.
    CreateTappRequest:
      properties:
        app_id:
          type: string
          title: App Id
          description: The calculated app ID from compose file.
        compose_hash:
          type: string
          title: Compose Hash
          description: The compose hash of the app compose file.
        encrypted_env:
          anyOf:
            - type: string
            - type: 'null'
          title: Encrypted Env
          description: The encrypted environment variables.
        kms_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Kms Id
          description: The KMS ID.
        contract_address:
          anyOf:
            - type: string
            - type: 'null'
          title: Contract Address
          description: The contract address.
        deployer_address:
          anyOf:
            - type: string
            - type: 'null'
          title: Deployer Address
          description: The deployer address.
        env_keys:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Env Keys
          description: The environment variables to use for the app.
      type: object
      required:
        - app_id
        - compose_hash
      title: CreateTappRequest
    ProvisionDstackAppResponseV2:
      properties:
        app_id:
          anyOf:
            - type: string
            - type: 'null'
          title: App Id
        app_env_encrypt_pubkey:
          anyOf:
            - type: string
            - type: 'null'
          title: App Env Encrypt Pubkey
        compose_hash:
          type: string
          title: Compose Hash
        compose_file:
          type: string
          title: Compose File
          description: Exact final app-compose JSON bound to compose_hash
        os_image_version:
          type: string
          title: Os Image Version
        teepod_version:
          anyOf:
            - type: string
            - type: 'null'
          title: Teepod Version
        requires_gpu:
          type: boolean
          title: Requires Gpu
        kms_info:
          anyOf:
            - $ref: '#/components/schemas/KMSInfo'
            - type: 'null'
        fmspc:
          anyOf:
            - type: string
            - type: 'null'
          title: Fmspc
        device_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Device Id
        os_image_hash:
          anyOf:
            - type: string
            - type: 'null'
          title: Os Image Hash
        instance_type:
          anyOf:
            - type: string
            - type: 'null'
          title: Instance Type
        token:
          anyOf:
            - type: string
            - type: 'null'
          title: Token
          description: Commit token for POST /cvms. Present for same-path two-phase create.
      type: object
      required:
        - compose_hash
        - compose_file
        - os_image_version
        - requires_gpu
      title: ProvisionDstackAppResponseV2
      description: >-
        Response from DStack app preflight checks containing provisioning
        details.
    CreatedVM:
      properties:
        id:
          anyOf:
            - type: integer
            - type: string
              pattern: ^cvm_.+
              format: hashid
              title: HashedId[cvms]
              description: A hashed identifier that maps to an internal database ID
              examples:
                - cvm_0123abcd
          title: Id
        name:
          type: string
          title: Name
        status:
          type: string
          title: Status
        teepod_id:
          type: integer
          title: Teepod Id
        teepod:
          anyOf:
            - $ref: '#/components/schemas/TeepodMeta'
            - type: 'null'
        user_id:
          anyOf:
            - type: integer
            - type: string
              pattern: ^usr_.+
              format: hashid
              title: HashedId[users]
              description: A hashed identifier that maps to an internal database ID
              examples:
                - usr_0123abcd
            - type: 'null'
          title: User Id
        app_id:
          type: string
          title: App Id
        vm_uuid:
          anyOf:
            - type: string
            - type: 'null'
          title: Vm Uuid
        instance_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Instance Id
        app_url:
          anyOf:
            - type: string
            - type: 'null'
          title: App Url
        base_image:
          anyOf:
            - type: string
            - type: 'null'
          title: Base Image
        vcpu:
          type: integer
          title: Vcpu
        memory:
          type: integer
          title: Memory
        disk_size:
          type: integer
          title: Disk Size
        manifest_version:
          anyOf:
            - type: integer
            - type: 'null'
          title: Manifest Version
        version:
          anyOf:
            - type: string
            - type: 'null'
          title: Version
        runner:
          anyOf:
            - type: string
            - type: 'null'
          title: Runner
        docker_compose_file:
          anyOf:
            - type: string
            - type: 'null'
          title: Docker Compose File
        features:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Features
        created_at:
          type: string
          format: date-time
          title: Created At
        encrypted_env_pubkey:
          anyOf:
            - type: string
            - type: 'null'
          title: Encrypted Env Pubkey
        launch_token:
          anyOf:
            - type: string
            - type: 'null'
          title: Launch Token
          description: >-
            Plaintext launch token this create stored on a new app (requested
            with launch_token or generate_launch_token). Returned only here,
            once; store it. Phala Cloud and the node operator can read it, so it
            protects only against parties who know the public compose.
      type: object
      required:
        - id
        - name
        - status
        - teepod_id
        - app_id
        - vcpu
        - memory
        - disk_size
        - created_at
      title: CreatedVM
      description: >-
        POST /cvms commit response: the created CVM, plus a launch token issued
        by this create.
    AppComposeV2-Input:
      properties:
        allowed_envs:
          items:
            type: string
          type: array
          title: Allowed Envs
        bash_script:
          anyOf:
            - type: string
            - type: 'null'
          title: Bash Script
        default_gateway_domain:
          anyOf:
            - type: string
            - type: 'null'
          title: Default Gateway Domain
        docker_compose_file:
          anyOf:
            - type: string
            - type: 'null'
          title: Docker Compose File
        init_script:
          items:
            type: string
          type: array
          title: Init Script
        key_provider:
          anyOf:
            - type: string
              enum:
                - none
                - kms
                - local
                - tpm
            - type: 'null'
          title: Key Provider
        key_provider_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Key Provider Id
        kms_enabled:
          type: boolean
          title: Kms Enabled
          default: true
        local_key_provider_enabled:
          type: boolean
          title: Local Key Provider Enabled
          default: false
        manifest_version:
          anyOf:
            - type: integer
            - type: string
          title: Manifest Version
          default: 2
        name:
          type: string
          title: Name
        no_instance_id:
          type: boolean
          title: No Instance Id
          default: false
        port_policy:
          anyOf:
            - $ref: '#/components/schemas/PortPolicy'
            - type: 'null'
        pre_launch_script:
          anyOf:
            - type: string
            - type: 'null'
          title: Pre Launch Script
        public_logs:
          type: boolean
          title: Public Logs
          default: true
        public_sysinfo:
          type: boolean
          title: Public Sysinfo
          default: true
        public_tcbinfo:
          type: boolean
          title: Public Tcbinfo
          default: true
        runner:
          type: string
          title: Runner
          default: docker-compose
        requirements:
          anyOf:
            - $ref: '#/components/schemas/Requirements'
            - type: 'null'
        storage_discard:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Storage Discard
        event_log_version:
          anyOf:
            - type: integer
              enum:
                - 1
                - 2
            - type: 'null'
          title: Event Log Version
        snapshotter:
          anyOf:
            - type: string
              enum:
                - overlayfs
                - stargz
            - type: 'null'
          title: Snapshotter
        verity_volumes:
          anyOf:
            - items:
                $ref: '#/components/schemas/VerityVolume'
              type: array
            - type: 'null'
          title: Verity Volumes
        gateway_enabled:
          type: boolean
          title: Gateway Enabled
          default: true
        features:
          items:
            type: string
          type: array
          title: Features
          default:
            - kms
            - tproxy-net
        salt:
          anyOf:
            - type: string
            - type: 'null'
          title: Salt
        secure_time:
          type: boolean
          title: Secure Time
          default: false
        storage_fs:
          anyOf:
            - type: string
              const: ext4
            - type: string
              const: zfs
            - type: 'null'
          title: Storage Fs
          default: zfs
        swap_size:
          anyOf:
            - type: string
            - type: 'null'
          title: Swap Size
        tproxy_enabled:
          type: boolean
          title: Tproxy Enabled
          default: true
      additionalProperties: false
      type: object
      required:
        - name
      title: AppComposeV2
    KmsType:
      type: string
      enum:
        - phala
        - ethereum
        - base
        - local
        - legacy
      title: KmsType
    CreateTimePortMappingEntry:
      properties:
        vm_port:
          type: integer
          maximum: 65535
          minimum: 1
          title: Vm Port
        protocol:
          type: string
          pattern: ^(tcp|udp)$
          title: Protocol
          default: tcp
        source_cidrs:
          items:
            type: string
          type: array
          title: Source Cidrs
          description: >-
            IPv4 CIDR allowlist; empty = allow all sources. A list containing
            0.0.0.0/0 also allows all sources and is stored as empty. Bare IPs
            are normalized to /32. Max 50 entries.
        description:
          anyOf:
            - type: string
              maxLength: 255
            - type: 'null'
          title: Description
          description: Optional audit text for this rule. Max 255 chars.
      additionalProperties: false
      type: object
      required:
        - vm_port
      title: CreateTimePortMappingEntry
      description: >-
        Create-time port mapping intent. host_port is server-allocated from

        the node's managed range, so callers declare vm_port, protocol, and the

        optional source_cidrs / description. NIC 0 is the only NIC a new CVM
        has,

        so nic_index is not accepted. Unknown keys are rejected so a client and

        server disagreeing on the shape fails loudly instead of dropping fields.
    GpuConfig:
      properties:
        gpus:
          items:
            $ref: '#/components/schemas/GpuSpec'
          type: array
          title: Gpus
        attach_mode:
          anyOf:
            - type: string
              enum:
                - listed
                - all
            - type: string
          title: Attach Mode
          default: listed
      type: object
      required:
        - gpus
      title: GpuConfig
    KMSInfo:
      properties:
        id:
          type: string
          pattern: ^kms_.+
          format: hashid
          title: HashedId[kms]
          description: Hashed KMS identifier (kms_xxxxx)
          examples:
            - kms_0123abcd
        slug:
          anyOf:
            - type: string
            - type: 'null'
          title: Slug
          description: Human-readable KMS name
        url:
          type: string
          title: Url
          description: KMS endpoint URL
        version:
          type: string
          title: Version
          description: KMS software version
        chain_id:
          anyOf:
            - type: integer
            - type: 'null'
          title: Chain Id
          description: Blockchain chain ID if onchain
        kms_contract_address:
          anyOf:
            - type: string
            - type: 'null'
          title: Kms Contract Address
          description: Smart contract address if onchain
        gateway_app_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Gateway App Id
          description: Gateway application ID
        ca_pubkey:
          anyOf:
            - type: string
            - type: 'null'
          title: Ca Pubkey
          description: KMS CA public key used as key_provider_id
        k256_pubkey:
          anyOf:
            - type: string
            - type: 'null'
          title: K256 Pubkey
          description: KMS k256 public key used to verify env encryption pubkey signatures
      type: object
      required:
        - id
        - url
        - version
      title: KMSInfo
      description: KMS instance information.
    TeepodMeta:
      properties:
        id:
          type: integer
          title: Id
        name:
          type: string
          title: Name
      type: object
      required:
        - id
        - name
      title: TeepodMeta
    PortPolicy:
      properties:
        ports:
          items:
            $ref: '#/components/schemas/PortAttrs'
          type: array
          title: Ports
        restrict_mode:
          type: boolean
          title: Restrict Mode
          default: false
      type: object
      title: PortPolicy
      description: |-
        Per-instance port policy declared in app-compose. >= v0.5.9.

        ``restrict_mode=True`` with an empty ``ports`` list is a valid lockdown.
        Field order is alphabetical for compose_hash stability.
    Requirements:
      properties:
        ephemeral_data_disk:
          type: boolean
          title: Ephemeral Data Disk
          default: false
        gpu_policy:
          $ref: '#/components/schemas/GpuPolicy'
        health_check:
          type: boolean
          title: Health Check
          default: false
        health_status_file:
          anyOf:
            - type: string
            - type: 'null'
          title: Health Status File
        launch_token_hash:
          anyOf:
            - type: string
            - type: 'null'
          title: Launch Token Hash
        platforms:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Platforms
        tdx_measure_acpi_tables:
          anyOf:
            - type: boolean
            - type: 'null'
          title: Tdx Measure Acpi Tables
      additionalProperties: false
      type: object
      title: Requirements
      description: >-
        Guest requirements (dstack >= 0.6.0), mirroring
        ``dstack_types::Requirements``.


        Only keys the caller sent are serialized (see
        ``AppComposeV2._serialize_requirements``),

        so a default-valued key sent explicitly is measured and an unsent key is
        never added.

        Fields are declared alphabetically to match the canonical JSON layout.
    VerityVolume:
      properties:
        source:
          type: string
          minLength: 1
          pattern: ^[^/]+$
          title: Source
        target:
          type: string
          title: Target
        verity_root:
          type: string
          title: Verity Root
      additionalProperties: false
      type: object
      required:
        - source
        - target
        - verity_root
      title: VerityVolume
      description: |-
        Read-only dm-verity volume pre-seeded into the CVM (dstack >= 0.6.0).

        Fields are declared alphabetically to match the canonical JSON layout.
    GpuSpec:
      properties:
        slot:
          type: string
          title: Slot
        product_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Product Id
      type: object
      required:
        - slot
      title: GpuSpec
    PortAttrs:
      properties:
        port:
          type: integer
          title: Port
        pp:
          type: boolean
          title: Pp
          default: false
      type: object
      required:
        - port
      title: PortAttrs
      description: |-
        Per-port gateway attribute. Matches dstack_types::PortAttrs.

        Field order is alphabetical to match the normalized-compose JSON layout
        the gateway and KMS use for compose_hash.
    GpuPolicy:
      properties:
        allow_debug:
          type: boolean
          title: Allow Debug
          default: false
        allow_devtools:
          type: boolean
          title: Allow Devtools
          default: false
        allow_insecure_boot:
          type: boolean
          title: Allow Insecure Boot
          default: false
        attest_gpu:
          type: boolean
          title: Attest Gpu
          default: true
        rego:
          anyOf:
            - type: string
            - type: 'null'
          title: Rego
      additionalProperties: false
      type: object
      title: GpuPolicy
      description: >-
        Guest-enforced GPU policy; defaults describe behavior, not serialized
        bytes.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.