Gateway Release v0.5.8

Docker Image Information

Image: docker.io/dstacktee/dstack-gateway:0.5.8

Digest (SHA256): sha256:6eb1dc1a5000f37cc5b0322d3fdb71e7f2e31859b5e3a611634919278cee2411

Verification: Verify on Sigstore

v0.5.8

Changes since v0.5.7

Features

• Support wildcard custom domains in gateway TXT resolution (#545)

Fixes

• Include SNI in gateway TLS passthrough error messages (#547)
• Allow wildcard fallback in non-compat mode (#545)
• Patch report_data in simulator RA-TLS certificates to bind to actual TLS key (#541)
• Set user-agent for KMS auth API requests and improve error logging (#525)
• Pin apt package versions in key-provider Dockerfile (#533)

Refactoring

• Extract TDX quote report_data offset as a named constant (#542)
• Extract generic http_get/http_post helpers in KMS (#525)
• Switch key-provider to upstream repo and update deps (#533)

Documentation

• Add self-host tutorial series (#540)
• Add encrypted environment variables technical spec (#506)
• Add security considerations for encrypted env authenticity (#506)
• Clarify normalized app_id input and runtime file path contract (#506)

Dependencies

• Update Rust dependencies for security fixes
• Bump quinn-proto, hono, fastify, minimatch, immutable, serialize-javascript, hardhat, fast-xml-parser

Verifier Release v0.5.8

Docker Image Information

Image: docker.io/dstacktee/dstack-verifier:0.5.8

Digest (SHA256): sha256:038e6b828528fbfecccfc8f95381a83fa8be8c18ec5fee9aaee7df03c4990ac9

Verification: Verify on Sigstore

KMS Release v0.5.8

Docker Image Information

Image: docker.io/dstacktee/dstack-kms:0.5.8

Digest (SHA256): sha256:9650dcb47dad0065470f432f00e78e012912214ef1a5b1d7272918817e61a26d

Verification: Verify on Sigstore

Contract ABIs

This release includes the compiled contract ABIs:

• DstackKms.json - Main KMS contract ABI
• DstackApp.json - Application contract ABI

v0.5.7

What's Changed

Features

• feat(guest-agent): add Version() RPC to DstackGuest and Tappd services
• feat(sdk): add version() API to all SDKs (Rust, Go, Python, JS)
• feat(sdk): validate algorithm in getKey by checking OS version
• feat(kms): add GetAttestationInfo RPC to onboard service
• feat: add sysbox persistent storage mount alongside docker/containerd
• Add supervisor process manager UI
• Add VM removing state for reliable lifecycle cleanup

Bug Fixes

• fix: wait for RPC nonce sync between multi-step deployments
• fix: correct kms:add-device success message
• fix(auth-eth): retry verifyDeployment for public RPC latency
• fix(kms): auto-append /prpc to onboard source_url if missing
• fix(guest-agent): normalize algorithm before passing to GetKey in Sign
• fix(guest-agent): accept "k256" as alias for "secp256k1" algorithm
• fix: remove secp256k1_prehashed from GetKey (meaningless for key derivation)
• fix(vmm): display network addresses on separate lines in UI

Other

• refactor: rename hardhat network "test" to "custom"
• Remove passt networking mode support

Full Changelog: v0.5.6...v0.5.7

dstack v0.5.6

Added

• guest-agent: Attest API for generating versioned attestations
• gateway: WaveKV backend with peer discovery, bootnode support, periodic persistence, and improved cluster orchestration
• gateway: multi-domain certificate management with SNI-based resolution, cert configuration UI, ACME account attestation, and configurable DNS TXT TTL/max wait
• gateway: multi-port TCP listening via port ranges and deployment script support for multi-port serving
• gateway: per-app connection rate limiting
• vmm: bridge networking support, DHCP lease PRPC API, and userspace port forwarding
• vmm: management APIs UpdateVm and ReloadVms, plus additional metadata in CLI output
• vmm-cli: config file support and new update subcommand
• vmm-ui: revamped UI (now default), improved layout, device/TEE state display, log follow, git rev display, and dedicated IP UI
• guest-agent: systemd socket activation and compatibility socket proxy
• kms: auth-simple configuration-based authorization server
• sdk: Verifiable Message Signing (Sign/Verify) with signature chain and public key fields
• docs: conntrack tuning guide for high-concurrency gateways
• docs: bridge networking guide updates and cluster deployment documentation
• vmm: OpenAPI documentation output

Changed

• gateway: deployment scripts refactored to externalize config and add bootstrap flow
• gateway: IP allocation scheme updated for larger address space
• gateway: DNS configuration defaults and UI settings refined (TTL, max wait, default port behaviors)
• toolchain: Rust pinned to 1.92 and additional no_std target added for CI
• attestation: refactored for multi-provider support
• vmm: default shared mode set to 9p
• dependencies: updated dcap-qvl to 0.3.10 and various dependency bumps (lodash, hono, go-ethereum, tracing-subscriber, etc.)
• docs: reorganized and consolidated (confidential AI, verification tutorial, GPU TEE guide, FAQ, SDK docs, main index)
• vmm-ui: regenerated and synchronized UI assets

Fixed

• vmm: VM config loading issues and multiple UI display bugs
• host-api: forbid listening on non-vsock addresses
• vmm: trigger port forward reconfiguration on update-ports
• runtime: Docker mount socket path compatibility (/run vs /var/run)
• runtime: create mount points before rbind mount
• sdk/js: isReachable behavior for v0.5.x
• gateway: improved error messages for client registration and cert flows
• ct_monitor: TLS certificate verification behavior
• tooling: clippy warnings, formatting, and CI stability fixes

Security

• upgraded dcap-qvl to 0.3.10 to address CVE-2026-22696

KMS Release v0.5.6

Docker Image Information

Image: docker.io/dstacktee/dstack-kms:0.5.6

Digest (SHA256): sha256:6f8ae87eb685679bf77844b38fdda867dd591a6470543574b92ab9b71bf4c849

Verification: Verify on Sigstore

Contract ABIs

This release includes the compiled contract ABIs:

• DstackKms.json - Main KMS contract ABI
• DstackApp.json - Application contract ABI

Gateway Release v0.5.6

Docker Image Information

Image: docker.io/dstacktee/dstack-gateway:0.5.6

Digest (SHA256): sha256:bce223277fc354da7fd8addd5a07247360828007fee2f4537619ef460e2a10bb

Verification: Verify on Sigstore

dstack v0.5.5

What's Changed

• fix: reuse lint by @h4x3rotab in #316
• Add dstack-sdk-type version in Cargo.toml by @kvinwang in #319
• ra-tls: Add KeyCertSign and CrlSign usages for CA certs by @kvinwang in #320
• IMP: Typing & schema for TcbInfo in SDK by @Leechael in #317
• Fix gateway dockerfile by @kvinwang in #323
• build(deps): bump hono from 4.8.5 to 4.9.6 in /kms/auth-eth-bun by @dependabot[bot] in #322
• build(deps): bump undici in /kms/auth-eth by @dependabot[bot] in #324
• Read qemu path from /etc/dstack/client.conf by @kvinwang in #332
• attestation.md: no rootfs hash in RTMR3 by @kvinwang in #333
• fix: dstack-sdk fails build due to alloy by @DSharifi in #335
• rust-sdk v0.1.1 by @kvinwang in #336
• build(deps): bump hono from 4.9.6 to 4.9.7 in /kms/auth-eth-bun by @dependabot[bot] in #329
• build(deps): bump hono from 4.8.5 to 4.9.6 in /kms/auth-mock by @dependabot[bot] in #327
• Revert the cert subject changes by @kvinwang in #338
• Add init_script in app-compose.json by @kvinwang in #337
• dstack-mr: Add qemu_version in VmConfig by @kvinwang in #340
• Add rust implementation of dstack-verifier by @kvinwang in #341
• Update GH workflow to push images to org by @kvinwang in #342
• Update attestation.md to use latest dstack-mr by @kvinwang in #344
• sdks: set roofs_hash optional in TcbInfo & increase default timeout in Python SDK by @Leechael in #339
• dstack-mr: Fix potential panic due to int overflow by @kvinwang in #345
• Fix deployment.md by @kvinwang in #346
• imp: when formatting app_url, skip port if it's 443 by @Leechael in #326
• Replace kvin.wang with dstack.org by @kvinwang in #343
• vmm: Fix VmConfig decode error by @kvinwang in #347
• cvm: Set max app compose size to 256K by @kvinwang in #349
• cvm: Auto reconnect when wg get stucked by @kvinwang in #350
• Update gatewa/deploy-to-vmm.sh by @kvinwang in #354
• Create crate size-parser by @kvinwang in #355
• vmm: Refactor sys-config generation code by @kvinwang in #351
• User size-parser in vmm config by @kvinwang in #357
• cvm: Support for ext4 by @kvinwang in #348
• Add gateway registration on the KMS by @Evrard-Nil in #359
• cvm: Add built-in swap config by @kvinwang in #358
• dstack v0.5.5 by @kvinwang in #362
• doc for min ver of each compose field by @kvinwang in #363
• fix(sdk): sync all SDKs with protobuf schema by @h4x3rotab in #366
• build(deps): bump esbuild and vitest in /sdk/js by @dependabot[bot] in #367
• chore: python sdk bump to 0.5.3 & js sdk bump to 0.5.7 by @Leechael in #368
• Rust sdk v0.1.2 by @kvinwang in #369
• Add rust sdk release workflow by @kvinwang in #370
• guest-agent: Request demo cert lazily by @kvinwang in #371
• cvm: Remove docker config from app compose by @kvinwang in #374

New Contributors

• @Evrard-Nil made their first contribution in #359

Full Changelog: v0.5.4...v0.5.5

Verifier Release v0.5.5

Docker Image Information

Image: docker.io/dstacktee/dstack-verifier:0.5.5

Digest (SHA256): sha256:4f73795d1a8b20d7e168b311f83a1906c28b4610c59dfa74983bf15f28d9aae4

Verification: Verify on Sigstore