"mrtd": "f06dfda6dce1cf904d4e2bab1dc370634cf95cefa2ceb2de2eee127c9382698090d7a4a13e14c536ec6c9c3c8fa87077",
"rtmr0": "68102e7b524af310f7b7d426ce75481e36c40f5d513a9009c046e9d37e31551f0134d954b496a3357fd61d03f07ffe96",
"rtmr1": "b598fde9491427341bc4683b75d10d3e36770af3a36a6954d8b6b7b22aa66358f13e1f172e51b7d6e6710d99a8d8532f",
"rtmr2": "9284cde236231d5ddace01104a440fd504df5182a2ad1ac3d2138b80c6a7864bd2c30f69041d8264217f3d24541580cf",
"rtmr3": "e1d86a03be616105ccb99ea52506b8ffefba6e125b8d4ce446181f06eb93251b8de2a5e6bf1ddeb8bad64124b7d60545",
"device_id": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
"event_log": [{"imr": 0,
"event": "",
"digest": "0b8772e5b0b41b83e6044a68397e02f49fb47066b4fbe4917ea2c45c64f323fdacbb37948f821ebaf8bc9c938ba8a749",
"event_type": 2147483659,
"event_payload": "095464785461626c65000100000000000000af96bb93f2b9b84e9462e0ba745642360090800000000000"
},
{"imr": 0,
"event": "",
"digest": "344bc51c980ba621aaa00da3ed7436f7d6e549197dfe699515dfa2c6583d95e6412af21c097d473155875ffd561d6790",
"event_type": 2147483658,
"event_payload": "2946762858585858585858582d585858582d585858582d585858582d58585858585858585858585829000000c0ff000000000040080000000000"
},
{"imr": 0,
"event": "",
"digest": "9dc3a1f80bcec915391dcda5ffbb15e7419f77eab462bbf72b42166fb70d50325e37b36f93537a863769bcf9bedae6fb",
"event_type": 2147483649,
"event_payload": "61dfe48bca93d211aa0d00e098032b8c0a00000000000000000000000000000053006500630075007200650042006f006f007400"
},
{"imr": 0,
"event": "",
"digest": "6f2e3cbc14f9def86980f5f66fd85e99d63e69a73014ed8a5633ce56eca5b64b692108c56110e22acadcef58c3250f1b",
"event_type": 2147483649,
"event_payload": "61dfe48bca93d211aa0d00e098032b8c0200000000000000000000000000000050004b00"
},
{"imr": 0,
"event": "",
"digest": "d607c0efb41c0d757d69bca0615c3a9ac0b1db06c557d992e906c6b7dee40e0e031640c7bfd7bcd35844ef9edeadc6f9",
"event_type": 2147483649,
"event_payload": "61dfe48bca93d211aa0d00e098032b8c030000000000000000000000000000004b0045004b00"
},
{"imr": 0,
"event": "",
"digest": "08a74f8963b337acb6c93682f934496373679dd26af1089cb4eaf0c30cf260a12e814856385ab8843e56a9acea19e127",
"event_type": 2147483649,
"event_payload": "cbb219d73a3d9645a3bcdad00e67656f0200000000000000000000000000000064006200"
},
{"imr": 0,
"event": "",
"digest": "18cc6e01f0c6ea99aa23f8a280423e94ad81d96d0aeb5180504fc0f7a40cb3619dd39bd6a95ec1680a86ed6ab0f9828d",
"event_type": 2147483649,
"event_payload": "cbb219d73a3d9645a3bcdad00e67656f03000000000000000000000000000000640062007800"
},
{"imr": 0,
"event": "",
"digest": "394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0",
"event_type": 4,
"event_payload": "00000000"
},
{"imr": 0,
"event": "",
"digest": "39740da2ea1e7e6c69e5e6569755b2ad6d622a8a9983a2c5b32d5574659dbdc4ca8b95b1c766bd610bc5c26dcde842f8",
"event_type": 10,
"event_payload": "414350492044415441"
},
{"imr": 0,
"event": "",
"digest": "6385b89d2decb3de678d51faba0ff3506835915818fd3ee53a739aa678cd9c76bdd755adfa0aa714cf35a1abe062b253",
"event_type": 10,
"event_payload": "414350492044415441"
},
{"imr": 0,
"event": "",
"digest": "05705c3ca9d71e908d5ce70d4331b6aadce5331b9a6a546f222f017fb0e1797b951a3dac72f59cb197a0c897a201ca07",
"event_type": 10,
"event_payload": "414350492044415441"
},
{"imr": 1,
"event": "",
"digest": "69e0bbb3861d993ddd4b79b40bb31cdc58ed540c754574e3c8af2432c5ac88e751a3b37bcf55a2352bad236b6ff4dc5c",
"event_type": 2147483651,
"event_payload": "18e0fd7a00000000008485000000000000000000000000002a000000000000000403140072f728144ab61e44b8c39ebdd7f893c7040412006b00650072006e0065006c0000007fff0400"
},
{"imr": 0,
"event": "",
"digest": "1dd6f7b457ad880d840d41c961283bab688e94e4b59359ea45686581e90feccea3c624b1226113f824f315eb60ae0a7c",
"event_type": 2147483650,
"event_payload": "61dfe48bca93d211aa0d00e098032b8c0900000000000000020000000000000042006f006f0074004f0072006400650072000000"
},
{"imr": 0,
"event": "",
"digest": "23ada07f5261f12f34a0bd8e46760962d6b4d576a416f1fea1c64bc656b1d28eacf7047ae6e967c58fd2a98bfa74c298",
"event_type": 2147483650,
"event_payload": "61dfe48bca93d211aa0d00e098032b8c08000000000000003e0000000000000042006f006f0074003000300030003000090100002c0055006900410070007000000004071400c9bdb87cebf8344faaea3ee4af6516a10406140021aa2c4614760345836e8ab6f46623317fff0400"
},
{"imr": 1,
"event": "",
"digest": "77a0dab2312b4e1e57a84d865a21e5b2ee8d677a21012ada819d0a98988078d3d740f6346bfe0abaa938ca20439a8d71",
"event_type": 2147483655,
"event_payload": "43616c6c696e6720454649204170706c69636174696f6e2066726f6d20426f6f74204f7074696f6e"
},
{"imr": 1,
"event": "",
"digest": "394341b7182cd227c5c6b07ef8000cdfd86136c4292b8e576573ad7ed9ae41019f5818b4b971c9effc60e1ad9f1289f0",
"event_type": 4,
"event_payload": "00000000"
},
{"imr": 2,
"event": "",
"digest": "b9c214a020aaa317e6b62a6a7d2adfa14fd5b871849c714f747f8728cefda6d3c566e332044051aeac30bfa1fc9916a0",
"event_type": 6,
"event_payload": "ed223b8f1a0000004c4f414445445f494d4147453a3a4c6f61644f7074696f6e7300"
},
{"imr": 2,
"event": "",
"digest": "dbfb59810302b3564182a02ae2fc5dcda5f8207380a7b18a9e6dd6fb648c33b1612eb10fb95ec620fb70b9c240ffda1c",
"event_type": 6,
"event_payload": "ec223b8f0d0000004c696e757820696e6974726400"
},
{"imr": 1,
"event": "",
"digest": "214b0bef1379756011344877743fdc2a5382bac6e70362d624ccf3f654407c1b4badf7d8f9295dd3dabdef65b27677e0",
"event_type": 2147483655,
"event_payload": "4578697420426f6f7420536572766963657320496e766f636174696f6e"
},
{"imr": 1,
"event": "",
"digest": "0a2e01c85deae718a530ad8c6d20a84009babe6c8989269e950d8cf440c6e997695e64d455c4174a652cd080f6230b74",
"event_type": 2147483655,
"event_payload": "4578697420426f6f742053657276696365732052657475726e656420776974682053756363657373"
},
{"imr": 3,
"event": "system-preparing",
"digest": "f9974020ef507068183313d0ca808e0d1ca9b2d1ad0c61f5784e7157c362c06536f5ddacdad4451693f48fcc72fff624",
"event_type": 134217729,
"event_payload": ""
},
{"imr": 3,
"event": "app-id",
"digest": "7b0f295443d7c7dfe1a9ba5902aa5551f6e077a27f23b124f35abbd6afee883099f79bf7dfc8fc9df0deaeff82246b6f",
"event_type": 134217729,
"event_payload": "d474756add4ca01161c9e373ca2142b2639e8460"
},
{"imr": 3,
"event": "compose-hash",
"digest": "e467b129f78eb48e8a7afe2551245789cf131b4e60f6aeaa97981df9985a2344937da3f4eec0aff90786c94ccddc9860",
"event_type": 134217729,
"event_payload": "794c8b1d3646b5d694374083d9957e4e7e7218fb2f88020e84a04b04cf4329d0"
},
{"imr": 3,
"event": "instance-id",
"digest": "613cae8fdf1776660f19ae73c46db886c75b8b7bb1205476dc55cd93dd29be7ec9ca5cace49240bbd9394848b3836497",
"event_type": 134217729,
"event_payload": "283aea2d0117bcef17732b725b698e5af8e91f97"
},
{"imr": 3,
"event": "boot-mr-done",
"digest": "98bd7e6bd3952720b65027fd494834045d06b4a714bf737a06b874638b3ea00ff402f7f583e3e3b05e921c8570433ac6",
"event_type": 134217729,
"event_payload": ""
},
{"imr": 3,
"event": "mr-kms",
"digest": "88a0f9aaddbfdbd2ff2c8b3c71daab7925f651d9d8e944ab97f9305fd532aac83900f9cae96e6fc5a7cc9c8632a5a218",
"event_type": 134217729,
"event_payload": "0861346ee77d6394f70282b486fa17b16d610f0c4b62f674d589f49a3ec8895e"
},
{"imr": 3,
"event": "os-image-hash",
"digest": "dc15768ace33ac7ecd2f86dc032917ed0674d8218a8e138db68e16a4985b2fc4c4576a4b2c8697b83d2a88c990b6f855",
"event_type": 134217729,
"event_payload": "6427f4f5ded88b72d326bd973e581c1689c5080c6444a0cf90fec7d9e4c8b92a"
},
{"imr": 3,
"event": "key-provider",
"digest": "83368b43a0fc6f824f5a9220592df85fd30e2d405ecbd253a5c6354af63e6c9b41aec557c38a38e348ab87f9ac8fc68c",
"event_type": 134217729,
"event_payload": "7b226e616d65223a226b6d73222c226964223a223330353933303133303630373261383634386365336430323031303630383261383634386365336430333031303730333432303030343838343465623432636364663863353266643466313734663336326663623962626431396334356664343866316564656332643866316361323335333665633161373430323162346365653631306330373466383239346434333162326237666565326333396535333333666461663061343532326434336662313539643966227d"
},
{"imr": 3,
"event": "storage-fs",
"digest": "ba51104636900268b0e059fa3d266419d079d1e94aea26fb9fcbb8d764bf4c89a67ac271b8a0d1a3989945132a111fc7",
"event_type": 134217729,
"event_payload": "7a6673"
},
{"imr": 3,
"event": "system-ready",
"digest": "1a76b2a80a0be71eae59f80945d876351a7a3fb8e9fd1ff1cede5734aa84ea11fd72b4edfbb6f04e5a85edd114c751bd",
"event_type": 134217729,
"event_payload": ""
}
],
"app_compose": "{\\\"allowed_envs\\\":[\\\"AGENT_CONTRACT_ID\\\",\\\"SPONSOR_ACCOUNT_ID\\\",\\\"SPONSOR_PRIVATE_KEY\\\"],\\\"docker_compose_file\\\":\\\"services:\\\\n shade-agent-app:\\\\n environment:\\\\n AGENT_CONTRACT_ID: ${AGENT_CONTRACT_ID}\\\\n SPONSOR_ACCOUNT_ID: ${SPONSOR_ACCOUNT_ID}\\\\n SPONSOR_PRIVATE_KEY: ${SPONSOR_PRIVATE_KEY}\\\\n platform: linux/amd64\\\\n image: pivortex/my-first-agent@sha256:e352d147ed02b05fecd51c09aab873fd0f1a415a512827abfabc707b2bfd90c4\\\\n container_name: shade-agent-app\\\\n ports:\\\\n - 3000:3000\\\\n volumes:\\\\n - /var/run/dstack.sock:/var/run/dstack.sock\\\\n restart: always\\\\n\\\",\\\"features\\\":[\\\"kms\\\",\\\"tproxy-net\\\"],\\\"gateway_enabled\\\":true,\\\"kms_enabled\\\":true,\\\"local_key_provider_enabled\\\":false,\\\"manifest_version\\\":2,\\\"name\\\":\\\"\\\",\\\"no_instance_id\\\":false,\\\"pre_launch_script\\\":\\\"echo \\\\\\\"----------------------------------------------\\\\\\\"\\\\necho \\\\\\\"Running Phala Cloud Pre-Launch Script v0.0.14\\\\\\\"\\\\necho \\\\\\\"----------------------------------------------\\\\\\\"\\\\nset -e\\\\n\\\\n# Function: notify host\\\\n\\\\nnotify_host() {\\\\n if command -v dstack-util >/dev/null 2>&1; then\\\\n dstack-util notify-host -e \\\\\\\"$1\\\\\\\" -d \\\\\\\"$2\\\\\\\"\\\\n else\\\\n tdxctl notify-host -e \\\\\\\"$1\\\\\\\" -d \\\\\\\"$2\\\\\\\"\\\\n fi\\\\n}\\\\n\\\\nnotify_host_hoot_info() {\\\\n notify_host \\\\\\\"boot.progress\\\\\\\" \\\\\\\"$1\\\\\\\"\\\\n}\\\\n\\\\nnotify_host_hoot_error() {\\\\n notify_host \\\\\\\"boot.error\\\\\\\" \\\\\\\"$1\\\\\\\"\\\\n}\\\\n\\\\n# Function: Perform Docker cleanup\\\\nperform_cleanup() {\\\\n echo \\\\\\\"Pruning unused images\\\\\\\"\\\\n docker image prune -af\\\\n echo \\\\\\\"Pruning unused volumes\\\\\\\"\\\\n docker volume prune -f\\\\n notify_host_hoot_info \\\\\\\"docker cleanup completed\\\\\\\"\\\\n}\\\\n\\\\n# Function: Check Docker login status without exposing credentials\\\\ncheck_docker_login() {\\\\n local registry=\\\\\\\"$1\\\\\\\"\\\\n\\\\n # When registry is specified, check auth entry for that registry in Docker config\\\\n if [[ -n \\\\\\\"$registry\\\\\\\" ]]; then\\\\n local docker_config_path=\\\\\\\"${DOCKER_CONFIG:-$HOME/.docker}/config.json\\\\\\\"\\\\n if [[ -f \\\\\\\"$docker_config_path\\\\\\\" ]] && grep -q \\\\\\\"$registry\\\\\\\" \\\\\\\"$docker_config_path\\\\\\\"; then\\\\n return 0\\\\n else\\\\n return 1\\\\n fi\\\\n fi\\\\n\\\\n # Fallback check when no explicit registry is provided\\\\n if docker info 2>/dev/null | grep -q \\\\\\\"Username\\\\\\\"; then\\\\n return 0\\\\n else\\\\n return 1\\\\n fi\\\\n}\\\\n\\\\n# Main logic starts here\\\\necho \\\\\\\"Starting login process...\\\\\\\"\\\\n\\\\n# Check if Docker credentials exist\\\\nif [[ -n \\\\\\\"$DSTACK_DOCKER_USERNAME\\\\\\\" && -n \\\\\\\"$DSTACK_DOCKER_PASSWORD\\\\\\\" ]]; then\\\\n echo \\\\\\\"Docker credentials found\\\\\\\"\\\\n DOCKER_REGISTRY_TARGET=\\\\\\\"${DSTACK_DOCKER_REGISTRY:-docker.io}\\\\\\\"\\\\n echo \\\\\\\"Target Docker registry: $DOCKER_REGISTRY_TARGET\\\\\\\"\\\\n\\\\n # Check if already logged in\\\\n if check_docker_login \\\\\\\"$DSTACK_DOCKER_REGISTRY\\\\\\\"; then\\\\n echo \\\\\\\"Already logged in to Docker registry: $DOCKER_REGISTRY_TARGET\\\\\\\"\\\\n else\\\\n echo \\\\\\\"Logging in to Docker registry: $DOCKER_REGISTRY_TARGET\\\\\\\"\\\\n # Login without exposing password in process list\\\\n if [[ -n \\\\\\\"$DSTACK_DOCKER_REGISTRY\\\\\\\" ]]; then\\\\n echo \\\\\\\"$DSTACK_DOCKER_PASSWORD\\\\\\\" | docker login -u \\\\\\\"$DSTACK_DOCKER_USERNAME\\\\\\\" --password-stdin \\\\\\\"$DSTACK_DOCKER_REGISTRY\\\\\\\"\\\\n else\\\\n echo \\\\\\\"$DSTACK_DOCKER_PASSWORD\\\\\\\" | docker login -u \\\\\\\"$DSTACK_DOCKER_USERNAME\\\\\\\" --password-stdin\\\\n fi\\\\n\\\\n if [ $? -eq 0 ]; then\\\\n echo \\\\\\\"Docker login successful: $DOCKER_REGISTRY_TARGET\\\\\\\"\\\\n else\\\\n echo \\\\\\\"Docker login failed: $DOCKER_REGISTRY_TARGET\\\\\\\"\\\\n notify_host_hoot_error \\\\\\\"docker login failed\\\\\\\"\\\\n exit 1\\\\n fi\\\\n fi\\\\n# Check if AWS ECR credentials exist\\\\nelif [[ -n \\\\\\\"$DSTACK_AWS_ACCESS_KEY_ID\\\\\\\" && -n \\\\\\\"$DSTACK_AWS_SECRET_ACCESS_KEY\\\\\\\" && -n \\\\\\\"$DSTACK_AWS_REGION\\\\\\\" && -n \\\\\\\"$DSTACK_AWS_ECR_REGISTRY\\\\\\\" ]]; then\\\\n echo \\\\\\\"AWS ECR credentials found\\\\\\\"\\\\n\\\\n # Check if AWS CLI is installed\\\\n if [ ! -f \\\\\\\"./aws/dist/aws\\\\\\\" ]; then\\\\n notify_host_hoot_info \\\\\\\"awscli not installed, installing...\\\\\\\"\\\\n echo \\\\\\\"AWS CLI not installed, installing...\\\\\\\"\\\\n curl \\\\\\\"https://awscli.amazonaws.com/awscli-exe-linux-x86_64-2.24.14.zip\\\\\\\" -o \\\\\\\"awscliv2.zip\\\\\\\"\\\\n echo \\\\\\\"6ff031a26df7daebbfa3ccddc9af1450 awscliv2.zip\\\\\\\" | md5sum -c\\\\n if [ $? -ne 0 ]; then\\\\n echo \\\\\\\"MD5 checksum failed\\\\\\\"\\\\n notify_host_hoot_error \\\\\\\"awscli install failed\\\\\\\"\\\\n exit 1\\\\n fi\\\\n unzip awscliv2.zip &> /dev/null\\\\n else\\\\n echo \\\\\\\"AWS CLI is already installed: ./aws/dist/aws\\\\\\\"\\\\n fi\\\\n\\\\n # Set AWS credentials as environment variables\\\\n export AWS_ACCESS_KEY_ID=\\\\\\\"$DSTACK_AWS_ACCESS_KEY_ID\\\\\\\"\\\\n export AWS_SECRET_ACCESS_KEY=\\\\\\\"$DSTACK_AWS_SECRET_ACCESS_KEY\\\\\\\"\\\\n export AWS_DEFAULT_REGION=\\\\\\\"$DSTACK_AWS_REGION\\\\\\\"\\\\n\\\\n # Set session token if provided (for temporary credentials)\\\\n if [[ -n \\\\\\\"$DSTACK_AWS_SESSION_TOKEN\\\\\\\" ]]; then\\\\n echo \\\\\\\"AWS session token found, using temporary credentials\\\\\\\"\\\\n export AWS_SESSION_TOKEN=\\\\\\\"$DSTACK_AWS_SESSION_TOKEN\\\\\\\"\\\\n fi\\\\n\\\\n # Test AWS credentials before attempting ECR login\\\\n echo \\\\\\\"Testing AWS credentials...\\\\\\\"\\\\n if ! ./aws/dist/aws sts get-caller-identity &> /dev/null; then\\\\n echo \\\\\\\"AWS credentials test failed\\\\\\\"\\\\n # For session token credentials, this might be expected if they\\\'re expired\\\\n # Log warning but don\\\'t fail startup\\\\n if [[ -n \\\\\\\"$DSTACK_AWS_SESSION_TOKEN\\\\\\\" ]]; then\\\\n echo \\\\\\\"Warning: AWS temporary credentials may have expired, continuing startup\\\\\\\"\\\\n notify_host_hoot_info \\\\\\\"AWS temporary credentials may have expired\\\\\\\"\\\\n else\\\\n echo \\\\\\\"AWS credentials test failed\\\\\\\"\\\\n notify_host_hoot_error \\\\\\\"Invalid AWS credentials\\\\\\\"\\\\n exit 1\\\\n fi\\\\n else\\\\n echo \\\\\\\"Logging in to AWS ECR...\\\\\\\"\\\\n ./aws/dist/aws ecr get-login-password --region $DSTACK_AWS_REGION | docker login --username AWS --password-stdin \\\\\\\"$DSTACK_AWS_ECR_REGISTRY\\\\\\\"\\\\n if [ $? -eq 0 ]; then\\\\n echo \\\\\\\"AWS ECR login successful\\\\\\\"\\\\n notify_host_hoot_info \\\\\\\"AWS ECR login successful\\\\\\\"\\\\n else\\\\n echo \\\\\\\"AWS ECR login failed\\\\\\\"\\\\n # For session token credentials, don\\\'t fail startup if login fails\\\\n if [[ -n \\\\\\\"$DSTACK_AWS_SESSION_TOKEN\\\\\\\" ]]; then\\\\n echo \\\\\\\"Warning: AWS ECR login failed with temporary credentials, continuing startup\\\\\\\"\\\\n notify_host_hoot_info \\\\\\\"AWS ECR login failed with temporary credentials\\\\\\\"\\\\n else\\\\n notify_host_hoot_error \\\\\\\"AWS ECR login failed\\\\\\\"\\\\n exit 1\\\\n fi\\\\n fi\\\\n fi\\\\nfi\\\\n\\\\nperform_cleanup\\\\n\\\\n#\\\\n# GHCR image pull access verification (pure HTTP, no docker daemon)\\\\n#\\\\nif [[ \\\\\\\"$DOCKER_REGISTRY_TARGET\\\\\\\" == \\\\\\\"ghcr.io\\\\\\\" && -n \\\\\\\"$DSTACK_DOCKER_USERNAME\\\\\\\" && -n \\\\\\\"$DSTACK_DOCKER_PASSWORD\\\\\\\" ]]; then\\\\n COMPOSE_IMAGES=$(grep \\\'image:\\\' /dstack/docker-compose.yaml 2>/dev/null | awk \\\'{print $2}\\\' | tr -d \\\'\\\\\\\"\\\'\\\\\\\"\\\'\\\\\\\" || true)\\\\n for img in $COMPOSE_IMAGES; do\\\\n [[ \\\\\\\"$img\\\\\\\" != ghcr.io/* ]] && continue\\\\n repo=\\\\\\\"${img#ghcr.io/}\\\\\\\"; repo=\\\\\\\"${repo%%:*}\\\\\\\"\\\\n tag=\\\\\\\"${img##*:}\\\\\\\"; [[ \\\\\\\"$tag\\\\\\\" == \\\\\\\"$img\\\\\\\" || \\\\\\\"$tag\\\\\\\" == \\\\\\\"$repo\\\\\\\" ]] && tag=\\\\\\\"latest\\\\\\\"\\\\n echo \\\\\\\"Verifying GHCR pull access: $img\\\\\\\"\\\\n token=$(curl -sf -u \\\\\\\"$DSTACK_DOCKER_USERNAME:$DSTACK_DOCKER_PASSWORD\\\\\\\" \\\\\\\\\\\\n \\\\\\\"https://ghcr.io/token?service=ghcr.io&scope=repository:${repo}:pull\\\\\\\" | jq -r \\\'.token // empty\\\' || true)\\\\n if [[ -z \\\\\\\"$token\\\\\\\" ]]; then\\\\n echo \\\\\\\"ERROR: GHCR token exchange failed for $img\\\\\\\"\\\\n notify_host_hoot_error \\\\\\\"GHCR token exchange failed: $img\\\\\\\"\\\\n exit 1\\\\n fi\\\\n http_code=$(curl -s -o /dev/null -w \\\\\\\"%{http_code}\\\\\\\" -H \\\\\\\"Authorization: Bearer $token\\\\\\\" \\\\\\\\\\\\n -H \\\\\\\"Accept: application/vnd.oci.image.index.v1+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.docker.distribution.manifest.v2+json\\\\\\\" \\\\\\\\\\\\n \\\\\\\"https://ghcr.io/v2/${repo}/manifests/${tag}\\\\\\\")\\\\n if [[ \\\\\\\"$http_code\\\\\\\" != \\\\\\\"200\\\\\\\" ]]; then\\\\n echo \\\\\\\"ERROR: GHCR pull access denied for $img (HTTP $http_code)\\\\\\\"\\\\n notify_host_hoot_error \\\\\\\"GHCR pull access denied: $img (HTTP $http_code)\\\\\\\"\\\\n exit 1\\\\n fi\\\\n echo \\\\\\\"GHCR pull access OK: $img\\\\\\\"\\\\n done\\\\nfi\\\\n\\\\n#\\\\n# Set root password.\\\\n#\\\\necho \\\\\\\"Setting root password..\\\\\\\"\\\\n\\\\n# Check if password files are writable\\\\nPASSWD_WRITABLE=true\\\\nif [ ! -w /etc/passwd ]; then\\\\n echo \\\\\\\"Warning: /etc/passwd is read-only\\\\\\\"\\\\n PASSWD_WRITABLE=false\\\\nfi\\\\nif [ ! -w /etc/shadow ]; then\\\\n echo \\\\\\\"Warning: /etc/shadow is read-only\\\\\\\"\\\\n PASSWD_WRITABLE=false\\\\nfi\\\\n\\\\nif [ \\\\\\\"$PASSWD_WRITABLE\\\\\\\" = \\\\\\\"false\\\\\\\" ]; then\\\\n echo \\\\\\\"Skipping password setup due to read-only file system\\\\\\\"\\\\nelse\\\\n # Check if chpasswd is available\\\\n if command -v chpasswd >/dev/null 2>&1; then\\\\n echo \\\\\\\"Using chpasswd method\\\\\\\"\\\\n\\\\n if [ -n \\\\\\\"$DSTACK_ROOT_PASSWORD\\\\\\\" ]; then\\\\n echo \\\\\\\"Setting root password from user..\\\\\\\"\\\\n echo \\\\\\\"root:$DSTACK_ROOT_PASSWORD\\\\\\\" | chpasswd\\\\n unset DSTACK_ROOT_PASSWORD\\\\n echo \\\\\\\"Root password set/updated from DSTACK_ROOT_PASSWORD\\\\\\\"\\\\n elif [ -z \\\\\\\"$(grep \\\'^root:\\\' /etc/shadow 2>/dev/null | cut -d: -f2)\\\\\\\" ]; then\\\\n echo \\\\\\\"Setting random root password..\\\\\\\"\\\\n DSTACK_ROOT_PASSWORD=$(\\\\n LC_ALL=C tr -dc \\\'A-Za-z0-9\\\' < /dev/urandom | dd bs=1 count=32 2>/dev/null\\\\n )\\\\n echo \\\\\\\"root:$DSTACK_ROOT_PASSWORD\\\\\\\" | chpasswd\\\\n unset DSTACK_ROOT_PASSWORD\\\\n echo \\\\\\\"Root password set (random auto-init)\\\\\\\"\\\\n else\\\\n echo \\\\\\\"Root password already set; no changes.\\\\\\\"\\\\n fi\\\\n else\\\\n echo \\\\\\\"Using passwd method\\\\\\\"\\\\n\\\\n if [ -n \\\\\\\"$DSTACK_ROOT_PASSWORD\\\\\\\" ]; then\\\\n echo \\\\\\\"Setting root password from user..\\\\\\\"\\\\n echo \\\\\\\"$DSTACK_ROOT_PASSWORD\\\\\\\" | passwd --stdin root 2>/dev/null \\\\\\\\\\\\n || printf \\\'%s\\\\\\\\n%s\\\\\\\\n\\\' \\\\\\\"$DSTACK_ROOT_PASSWORD\\\\\\\" \\\\\\\"$DSTACK_ROOT_PASSWORD\\\\\\\" | passwd root\\\\n unset DSTACK_ROOT_PASSWORD\\\\n echo \\\\\\\"Root password set/updated from DSTACK_ROOT_PASSWORD\\\\\\\"\\\\n elif [ -z \\\\\\\"$(grep \\\'^root:\\\' /etc/shadow 2>/dev/null | cut -d: -f2)\\\\\\\" ]; then\\\\n echo \\\\\\\"Setting random root password..\\\\\\\"\\\\n DSTACK_ROOT_PASSWORD=$(\\\\n LC_ALL=C tr -dc \\\'A-Za-z0-9\\\' < /dev/urandom | dd bs=1 count=32 2>/dev/null\\\\n )\\\\n echo \\\\\\\"$DSTACK_ROOT_PASSWORD\\\\\\\" | passwd --stdin root 2>/dev/null \\\\\\\\\\\\n || printf \\\'%s\\\\\\\\n%s\\\\\\\\n\\\' \\\\\\\"$DSTACK_ROOT_PASSWORD\\\\\\\" \\\\\\\"$DSTACK_ROOT_PASSWORD\\\\\\\" | passwd root\\\\n unset DSTACK_ROOT_PASSWORD\\\\n echo \\\\\\\"Root password set (random auto-init)\\\\\\\"\\\\n else\\\\n echo \\\\\\\"Root password already set; no changes.\\\\\\\"\\\\n fi\\\\n fi\\\\nfi\\\\n\\\\n#\\\\n# Set SSH authorized keys\\\\n#\\\\nif mkdir -p /home/root/.ssh 2>/dev/null; then\\\\n if [[ -n \\\\\\\"$DSTACK_ROOT_PUBLIC_KEY\\\\\\\" ]]; then\\\\n echo \\\\\\\"$DSTACK_ROOT_PUBLIC_KEY\\\\\\\" > /home/root/.ssh/authorized_keys\\\\n unset $DSTACK_ROOT_PUBLIC_KEY\\\\n echo \\\\\\\"Root public key set\\\\\\\"\\\\n fi\\\\n if [[ -n \\\\\\\"$DSTACK_AUTHORIZED_KEYS\\\\\\\" ]]; then\\\\n echo \\\\\\\"$DSTACK_AUTHORIZED_KEYS\\\\\\\" > /home/root/.ssh/authorized_keys\\\\n unset $DSTACK_AUTHORIZED_KEYS\\\\n echo \\\\\\\"Root authorized_keys set\\\\\\\"\\\\n fi\\\\n\\\\n if [[ -f /dstack/user_config ]] && jq empty /dstack/user_config 2>/dev/null; then\\\\n if [[ $(jq \\\'has(\\\\\\\"ssh_authorized_keys\\\\\\\")\\\' /dstack/user_config 2>/dev/null) == \\\\\\\"true\\\\\\\" ]]; then\\\\n jq -j \\\'.ssh_authorized_keys\\\' /dstack/user_config >> /home/root/.ssh/authorized_keys\\\\n # Remove duplicates if there are multiple keys\\\\n if [[ $(cat /home/root/.ssh/authorized_keys | wc -l) -gt 1 ]]; then\\\\n sort -u /home/root/.ssh/authorized_keys > /home/root/.ssh/authorized_keys.tmp\\\\n mv /home/root/.ssh/authorized_keys.tmp /home/root/.ssh/authorized_keys\\\\n fi\\\\n echo \\\\\\\"Set root authorized_keys from user preferences, total\\\\\\\" $(cat /home/root/.ssh/authorized_keys | wc -l) \\\\\\\"keys\\\\\\\"\\\\n fi\\\\n fi\\\\nelse\\\\n echo \\\\\\\"Warning: Cannot create /home/root/.ssh directory (read-only file system?)\\\\\\\"\\\\n echo \\\\\\\"Skipping SSH key setup\\\\\\\"\\\\nfi\\\\n\\\\nif [[ -S /var/run/dstack.sock ]]; then\\\\n export DSTACK_APP_ID=$(curl -s --unix-socket /var/run/dstack.sock http://dstack/Info | jq -j .app_id)\\\\nelif [[ -S /var/run/tappd.sock ]]; then\\\\n export DSTACK_APP_ID=$(curl -s --unix-socket /var/run/tappd.sock http://dstack/prpc/Tappd.Info | jq -j .app_id)\\\\nfi\\\\n# Check if DSTACK_GATEWAY_DOMAIN is not set, try to get it from user_config or app-compose.json\\\\n# Priority: user_config > app-compose.json\\\\nif [[ -z \\\\\\\"$DSTACK_GATEWAY_DOMAIN\\\\\\\" ]]; then\\\\n # First try to get from /dstack/user_config if it exists and is valid JSON\\\\n if [[ -f /dstack/user_config ]] && jq empty /dstack/user_config 2>/dev/null; then\\\\n if [[ $(jq \\\'has(\\\\\\\"default_gateway_domain\\\\\\\")\\\' /dstack/user_config 2>/dev/null) == \\\\\\\"true\\\\\\\" ]]; then\\\\n export DSTACK_GATEWAY_DOMAIN=$(jq -j \\\'.default_gateway_domain\\\' /dstack/user_config)\\\\n fi\\\\n fi\\\\n\\\\n # If still not set, try to get from app-compose.json\\\\n if [[ -z \\\\\\\"$DSTACK_GATEWAY_DOMAIN\\\\\\\" ]] && [[ $(jq \\\'has(\\\\\\\"default_gateway_domain\\\\\\\")\\\' app-compose.json) == \\\\\\\"true\\\\\\\" ]]; then\\\\n export DSTACK_GATEWAY_DOMAIN=$(jq -j \\\'.default_gateway_domain\\\' app-compose.json)\\\\n fi\\\\nfi\\\\nif [[ -n \\\\\\\"$DSTACK_GATEWAY_DOMAIN\\\\\\\" ]]; then\\\\n export DSTACK_APP_DOMAIN=$DSTACK_APP_ID\\\\\\\".\\\\\\\"$DSTACK_GATEWAY_DOMAIN\\\\nfi\\\\n\\\\necho \\\\\\\"----------------------------------------------\\\\\\\"\\\\necho \\\\\\\"Script execution completed\\\\\\\"\\\\necho \\\\\\\"----------------------------------------------\\\\\\\"\\\\n\\\",\\\"public_logs\\\":false,\\\"public_sysinfo\\\":false,\\\"public_tcbinfo\\\":true,\\\"runner\\\":\\\"docker-compose\\\",\\\"secure_time\\\":false,\\\"storage_fs\\\":\\\"zfs\\\",\\\"tproxy_enabled\\\":true}",
"compose_hash": "794c8b1d3646b5d694374083d9957e4e7e7218fb2f88020e84a04b04cf4329d0",
"os_image_hash": "6427f4f5ded88b72d326bd973e581c1689c5080c6444a0cf90fec7d9e4c8b92a"