Dstack-TEE/dstack

What it solves

dstack addresses the trust gap between AI providers and users by providing cryptographic privacy guarantees. It prevents AI providers (and the host operators) from accessing sensitive user data or model weights, replacing blind trust with hardware-rooted verification.

How it works

dstack deploys AI applications inside Confidential VMs (CVMs) using technologies like Intel TDX and AMD SEV-SNP. It integrates with NVIDIA Confidential Computing (H100, Blackwell) to protect GPU memory. The system uses a Guest Agent for attestation and key provisioning, a KMS running in its own TEE to manage keys based on smart contract policies, and a VMM that allows users to deploy existing Docker Compose files without modifying their code.

Who it’s for

It is designed for AI developers and providers who need to deploy private AI applications (inference, agents, or training) where data privacy and verifiable security are critical requirements.

Highlights

• Docker Native: Supports existing docker-compose.yaml files with no SDK or code changes required for deployment.
• Hardware-Rooted Security: Uses TEEs (Intel TDX, AMD SEV-SNP) and Confidential GPUs to ensure data is encrypted in memory and inaccessible to the host.
• Cryptographic Verification: Provides attestation quotes that allow users to verify exactly what code and OS image are running.
• Trustless Key Management: Per-app keys are derived in a TEE and managed via on-chain governance, ensuring operators cannot access secrets.