verity volumes: pre-load docker images and data into CVMs

dstack/Cargo.toml

@@ -63,6 +63,7 @@ members = [
     "port-forward",
     "crates/dstack-cli-core",
     "crates/dstack-cli",
+    "crates/dstack-verity",
     "crates/dstackup",
     "crates/dstack-auth",
 ]
@@ -77,6 +78,7 @@ dstack-kms-rpc = { path = "kms/rpc" }
 dstack-guest-agent-rpc = { path = "guest-agent/rpc" }
 dstack-vmm-rpc = { path = "vmm/rpc" }
 dstack-cli-core = { path = "crates/dstack-cli-core" }
+dstack-verity = { path = "crates/dstack-verity" }
 dstack-port-forward = { path = "port-forward" }
 cc-eventlog = { path = "cc-eventlog" }
 supervisor = { path = "supervisor" }

dstack/crates/dstack-cli-core/src/compose.rs

@@ -12,8 +12,17 @@ use serde_json::json;
 ///
 /// `kms_enabled` selects KMS mode (deterministic, upgradeable per-app keys);
 /// gateway and local-key-provider are off for the direct-port single-node flow.
-pub fn build_app_compose(name: &str, docker_compose_yaml: &str, kms_enabled: bool) -> String {
-    let manifest = json!({
+///
+/// `verity_volumes` is a list of `(verity_root, target)` pairs. Each becomes a
+/// measured `verity_volumes` entry, so the CVM only seeds content matching the
+/// attested root. Empty for a normal deploy.
+pub fn build_app_compose(
+    name: &str,
+    docker_compose_yaml: &str,
+    kms_enabled: bool,
+    verity_volumes: &[(String, String)],
+) -> String {
+    let mut manifest = json!({
         "manifest_version": 2,
         "name": name,
         "runner": "docker-compose",
@@ -31,6 +40,12 @@ pub fn build_app_compose(name: &str, docker_compose_yaml: &str, kms_enabled: boo
         // (NTS is also currently broken in guest images — see dstack#745.)
         "secure_time": false,
     });
+    if !verity_volumes.is_empty() {
+        manifest["verity_volumes"] = json!(verity_volumes
+            .iter()
+            .map(|(root, target)| json!({ "verity_root": root, "target": target }))
+            .collect::<Vec<_>>());
+    }
     // pretty-print via Value's Display (`{:#}`) — infallible, and byte-identical
     // to serde_json::to_string_pretty (avoids an expect on an unfailable Result).
     format!("{manifest:#}")

dstack/crates/dstack-cli/Cargo.toml

@@ -18,5 +18,9 @@ path = "src/main.rs"
 anyhow.workspace = true
 clap.workspace = true
 dstack-cli-core.workspace = true
+dstack-verity.workspace = true
+fs-err.workspace = true
 serde_json.workspace = true
 tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
+tracing.workspace = true
+tracing-subscriber = { workspace = true }