dstack v0.5.6

Added

• guest-agent: Attest API for generating versioned attestations
• gateway: WaveKV backend with peer discovery, bootnode support, periodic persistence, and improved cluster orchestration
• gateway: multi-domain certificate management with SNI-based resolution, cert configuration UI, ACME account attestation, and configurable DNS TXT TTL/max wait
• gateway: multi-port TCP listening via port ranges and deployment script support for multi-port serving
• gateway: per-app connection rate limiting
• vmm: bridge networking support, DHCP lease PRPC API, and userspace port forwarding
• vmm: management APIs UpdateVm and ReloadVms, plus additional metadata in CLI output
• vmm-cli: config file support and new update subcommand
• vmm-ui: revamped UI (now default), improved layout, device/TEE state display, log follow, git rev display, and dedicated IP UI
• guest-agent: systemd socket activation and compatibility socket proxy
• kms: auth-simple configuration-based authorization server
• sdk: Verifiable Message Signing (Sign/Verify) with signature chain and public key fields
• docs: conntrack tuning guide for high-concurrency gateways
• docs: bridge networking guide updates and cluster deployment documentation
• vmm: OpenAPI documentation output

Changed

• gateway: deployment scripts refactored to externalize config and add bootstrap flow
• gateway: IP allocation scheme updated for larger address space
• gateway: DNS configuration defaults and UI settings refined (TTL, max wait, default port behaviors)
• toolchain: Rust pinned to 1.92 and additional no_std target added for CI
• attestation: refactored for multi-provider support
• vmm: default shared mode set to 9p
• dependencies: updated dcap-qvl to 0.3.10 and various dependency bumps (lodash, hono, go-ethereum, tracing-subscriber, etc.)
• docs: reorganized and consolidated (confidential AI, verification tutorial, GPU TEE guide, FAQ, SDK docs, main index)
• vmm-ui: regenerated and synchronized UI assets

Fixed

• vmm: VM config loading issues and multiple UI display bugs
• host-api: forbid listening on non-vsock addresses
• vmm: trigger port forward reconfiguration on update-ports
• runtime: Docker mount socket path compatibility (/run vs /var/run)
• runtime: create mount points before rbind mount
• sdk/js: isReachable behavior for v0.5.x
• gateway: improved error messages for client registration and cert flows
• ct_monitor: TLS certificate verification behavior
• tooling: clippy warnings, formatting, and CI stability fixes

Security

• upgraded dcap-qvl to 0.3.10 to address CVE-2026-22696

KMS Release v0.5.6

Docker Image Information

Image: docker.io/dstacktee/dstack-kms:0.5.6

Digest (SHA256): sha256:6f8ae87eb685679bf77844b38fdda867dd591a6470543574b92ab9b71bf4c849

Verification: Verify on Sigstore

Contract ABIs

This release includes the compiled contract ABIs:

• DstackKms.json - Main KMS contract ABI
• DstackApp.json - Application contract ABI

Gateway Release v0.5.6

Docker Image Information

Image: docker.io/dstacktee/dstack-gateway:0.5.6

Digest (SHA256): sha256:bce223277fc354da7fd8addd5a07247360828007fee2f4537619ef460e2a10bb

Verification: Verify on Sigstore

dstack v0.5.5

What's Changed

• fix: reuse lint by @h4x3rotab in #316
• Add dstack-sdk-type version in Cargo.toml by @kvinwang in #319
• ra-tls: Add KeyCertSign and CrlSign usages for CA certs by @kvinwang in #320
• IMP: Typing & schema for TcbInfo in SDK by @Leechael in #317
• Fix gateway dockerfile by @kvinwang in #323
• build(deps): bump hono from 4.8.5 to 4.9.6 in /kms/auth-eth-bun by @dependabot[bot] in #322
• build(deps): bump undici in /kms/auth-eth by @dependabot[bot] in #324
• Read qemu path from /etc/dstack/client.conf by @kvinwang in #332
• attestation.md: no rootfs hash in RTMR3 by @kvinwang in #333
• fix: dstack-sdk fails build due to alloy by @DSharifi in #335
• rust-sdk v0.1.1 by @kvinwang in #336
• build(deps): bump hono from 4.9.6 to 4.9.7 in /kms/auth-eth-bun by @dependabot[bot] in #329
• build(deps): bump hono from 4.8.5 to 4.9.6 in /kms/auth-mock by @dependabot[bot] in #327
• Revert the cert subject changes by @kvinwang in #338
• Add init_script in app-compose.json by @kvinwang in #337
• dstack-mr: Add qemu_version in VmConfig by @kvinwang in #340
• Add rust implementation of dstack-verifier by @kvinwang in #341
• Update GH workflow to push images to org by @kvinwang in #342
• Update attestation.md to use latest dstack-mr by @kvinwang in #344
• sdks: set roofs_hash optional in TcbInfo & increase default timeout in Python SDK by @Leechael in #339
• dstack-mr: Fix potential panic due to int overflow by @kvinwang in #345
• Fix deployment.md by @kvinwang in #346
• imp: when formatting app_url, skip port if it's 443 by @Leechael in #326
• Replace kvin.wang with dstack.org by @kvinwang in #343
• vmm: Fix VmConfig decode error by @kvinwang in #347
• cvm: Set max app compose size to 256K by @kvinwang in #349
• cvm: Auto reconnect when wg get stucked by @kvinwang in #350
• Update gatewa/deploy-to-vmm.sh by @kvinwang in #354
• Create crate size-parser by @kvinwang in #355
• vmm: Refactor sys-config generation code by @kvinwang in #351
• User size-parser in vmm config by @kvinwang in #357
• cvm: Support for ext4 by @kvinwang in #348
• Add gateway registration on the KMS by @Evrard-Nil in #359
• cvm: Add built-in swap config by @kvinwang in #358
• dstack v0.5.5 by @kvinwang in #362
• doc for min ver of each compose field by @kvinwang in #363
• fix(sdk): sync all SDKs with protobuf schema by @h4x3rotab in #366
• build(deps): bump esbuild and vitest in /sdk/js by @dependabot[bot] in #367
• chore: python sdk bump to 0.5.3 & js sdk bump to 0.5.7 by @Leechael in #368
• Rust sdk v0.1.2 by @kvinwang in #369
• Add rust sdk release workflow by @kvinwang in #370
• guest-agent: Request demo cert lazily by @kvinwang in #371
• cvm: Remove docker config from app compose by @kvinwang in #374

New Contributors

• @Evrard-Nil made their first contribution in #359

Full Changelog: v0.5.4...v0.5.5

Verifier Release v0.5.5

Docker Image Information

Image: docker.io/dstacktee/dstack-verifier:0.5.5

Digest (SHA256): sha256:4f73795d1a8b20d7e168b311f83a1906c28b4610c59dfa74983bf15f28d9aae4

Verification: Verify on Sigstore

KMS Release v0.5.5

Docker Image Information

Image: docker.io/dstacktee/dstack-kms:0.5.5

Digest (SHA256): sha256:11ac59f524a22462ccd2152219b0bec48a28ceb734e32500152d4abefab7a62a

Verification: Verify on Sigstore

Contract ABIs

This release includes the compiled contract ABIs:

• DstackKms.json - Main KMS contract ABI
• DstackApp.json - Application contract ABI

Gateway Release v0.5.5

Docker Image Information

Image: docker.io/dstacktee/dstack-gateway:0.5.5

Digest (SHA256): sha256:a7b7e3144371b053ba21d6ac18141afd49e3cd767ca2715599aa0e2703b3a11a

Verification: Verify on Sigstore

Verifier Release v0.5.4

Docker Image Information

Image: docker.io/dstacktee/dstack-verifier:0.5.4

Digest (SHA256): sha256:3f36162ca8dd2d4207601a6302881de6b497e610eb44050bb0874776fc8ded07

Verification: Verify on Sigstore

Gateway Release v0.5.4

Docker Image Information

Image: docker.io/dstacktee/dstack-gateway:0.5.4

Digest (SHA256): sha256:72973d8dc3577bd325392898681cba2eb727f86db1fecbd8e72134f2b00609f6

Verification: Verify on Sigstore

KMS Release v0.5.4

Docker Image Information

Image: docker.io/dstacktee/dstack-kms:0.5.4

Digest (SHA256): sha256:56dfd86424a3473dc75a11876687aa62ceee03e031e02a9ab1aad494dcabd19c

Verification: Verify on Sigstore

Contract ABIs

This release includes the compiled contract ABIs:

• DstackKms.json - Main KMS contract ABI
• DstackApp.json - Application contract ABI