Phala Cloud CLI

Secure. Confidential. Verifiable.

A command-line tool for managing Trusted Execution Environment (TEE) deployments on Phala Cloud, from local development to cloud deployment.
___

👥 Community & Support

Usage

- Dstack-TEE: Dstack
- Bun for runtime and package management
- TypeScript for type safety
- Commander.js for CLI interface
- Zod for runtime validation

🚀 Quick Start (5 Minutes)

1. Install Prerequisites:
``bash
# Install Bun
curl -fsSL https://bun.sh/install | bash

# Verify Docker is installed
docker --version
`

2. Install TEE Cloud CLI:

Install via npm or use npx/bunx
`bash
# Install the CLI globally
npm install -g phala
`

> NOTE
>
> You can use npx or bunx to call the phala command
>
> `bash
> # Use npx/bunx
>
> npx phala help
> bunx phala help
> `

`bash
# Phala CLI help menu
npx phala help
`

3. Sign Up and Get API Key:

To deploy applications to Phala Cloud, you'll need an API key:

- Visit Phala Cloud to log into your Phala Cloud account. If you do not have an account, registe here.
- After logging in, navigate to the "API Keys" section in your profile
- Create a new API key with an appropriate name (e.g., "CLI Access")
- Copy the generated API key - you'll need it for authentication
- You can verify your API key using:
`bash
phala auth login [your-phala-cloud-api-key]
phala auth status
`

4. Deploy Your First Confidential App:
Clone the Dstack Examples repo and cd into the webshell directory
`bash
git clone https://github.com/Dstack-TEE/dstack-examples.git && cd dstack-examples/webshell
`

`bash
# Deploy the webshell Dstack example
phala cvms create
`

Provide a name and select from the drop down of examples

`bash
# ? Enter a name for the CVM: webshell
# ℹ Detected docker compose file: ./docker-compose.yml

# ? Enter the path to your Docker Compose file:(docker-compose.yml)
# ✔ Enter number of vCPUs (default: 1): 1

# ✔ Enter memory in MB (default: 2048): 2048
# ✔ Enter disk size in GB (default: 20): 20
# ⟳ Fetching available TEEPods... ✓
# ⟳ Getting public key from CVM... ✓
# ⟳ Encrypting environment variables... ✓
# ⟳ Creating CVM... ✓
# ✓ CVM created successfully
# ℹ CVM ID: 2755
# ℹ Name: webshell
# ℹ Status: creating
# ℹ App ID: e15c1a29a9dfb522da528464a8d5ce40ac28039f
# ℹ App URL:
# ℹ
# ℹ Your CVM is being created. You can check its status with:
# ℹ phala cvms status e15c1a29a9dfb522da528464a8d5ce40ac28039f
`

Now interact with your application in Phala Cloud by going to the url on port 7681 (Example of what a url at port 7681 would look like https://e15c1a29a9dfb522da528464a8d5ce40ac28039f-7681.dstack-prod5.phala.network)

5. Check the CVM's Attestation:
`bash
phala cvms attestation

# ℹ No CVM specified, fetching available CVMs...
# ⟳ Fetching available CVMs... ✓
# ✔ Select a CVM: testing (88721d1685bcd57166a8cbe957cd16f733b3da34) - Status: running
# ℹ Fetching attestation information for CVM 88721d1685bcd57166a8cbe957cd16f733b3da34...
# ⟳ Fetching attestation information... ✓
# ✓ Attestation Summary:

# or list the app-id
phala cvms attestation 88721d1685bcd57166a8cbe957cd16f733b3da34
`




🏗️ Development Workflow

$3

Develop and test your application locally with the built-in TEE simulator:

`bash


Start the TEE simulator

phala simulator start

Build your Docker image

phala docker build --image my-tee-app --tag v1.0.0

Create an environment file

echo "API_KEY=test-key" > .env
echo "DEBUG=true" >> .env
`

$3

Deploy your application to Phala's decentralized TEE Cloud:

`bash


Set your Phala Cloud API key

phala auth login

Login to Docker and Push your image to Docker Hub

phala docker login
phala docker build --image my-tee-app --tag v1.0.0
phala docker push --image my-tee-app --tag v1.0.0

Deploy to Phala Cloud

phala cvms create --name my-tee-app --compose ./docker-compose.yml --env-file ./.env

Access your app via the provided URL

`

💼 Real-World Use Cases for Confidential Computing

$3

- Private Trading Algorithms: Execute proprietary trading strategies without revealing algorithms
- Secure Multi-Party Computation: Perform financial calculations across organizations without exposing sensitive data
- Compliant Data Processing: Process regulated financial data with provable security guarantees

$3

- Medical Research: Analyze sensitive patient data while preserving privacy
- Drug Discovery: Collaborate on pharmaceutical research without exposing intellectual property
- Health Record Processing: Process electronic health records with HIPAA-compliant confidentiality

$3

- Secure Key Management: Generate and store cryptographic keys in hardware-protected environments
- Threat Intelligence Sharing: Share cyber threat data across organizations without exposing sensitive details
- Password Verification: Perform credential validation without exposing password databases

$3

- Confidential Analytics: Process sensitive business data without exposure to cloud providers
- IP Protection: Run proprietary algorithms and software while preventing reverse engineering
- Secure Supply Chain: Validate and process sensitive supply chain data across multiple organizations

$3

- Private Smart Contracts: Execute contracts with confidential logic and data
- Decentralized Identity: Process identity verification without exposing personal information
- Trustless Oracles: Provide verified external data to blockchain applications

🧩 Project Structure

The Phala Cloud CLI is organized around core workflows:

1. Authentication: Connect to your Phala Cloud account
2. TEEPod Info: Fetch information about TEEPods (TEEPods are where your docker apps deploy to)
3. Docker Management: Build and manage Docker images for TEE
4. TEE Simulation: Local development environment
5. Cloud Deployment: Deploy to production and manage TEE Cloud deployments

📚 Command Reference

The Phala Cloud CLI provides a comprehensive set of commands for managing your TEE deployments. Below is a detailed reference for each command category.

$3

Commands for managing authentication with the Phala Cloud API.

#### Login

`bash
phala auth login [options]
`

Set the API key for authentication with Phala Cloud. The API key is stored with encryption for enhanced security.

Options:

- [api-key]: Phala Cloud API key to set

Example:
`bash
phala auth login [your-phala-cloud-api-key]
`

#### Logout

`bash
phala auth logout
`

Remove the stored API key.

Example:
`bash
phala auth logout
`

#### Status

`bash
phala status [options]
`

Check your authentication status with Phala Cloud. Displays user information including API endpoint, username, and current workspace.

> Note: phala auth status is still available for backward compatibility, but it's recommended to use phala status instead.

Options:
- -j, --json: Output in JSON format
- -d, --debug: Enable debug output

Example:
`bash
phala status
phala status --json
`

#### Environment Variable Override

You can override the stored API key using the PHALA_CLOUD_API_KEY environment variable. This is useful for CI/CD workflows or testing with different accounts.

Example:
`bash


Temporarily use a different API key

PHALA_CLOUD_API_KEY="phak_your_api_key_here" phala cvms list

In CI/CD pipelines

export PHALA_CLOUD_API_KEY="phak_your_api_key_here"
phala deploy --name my-app
`

You can also override the API endpoint using the PHALA_CLOUD_API_PREFIX environment variable.

Example:
`bash
PHALA_CLOUD_API_PREFIX="https://cloud-api.phala.ai" phala cvms list
`

#### JSON Output Mode

All commands support the --json flag for machine-readable output, useful for automation and CI/CD pipelines.

Example:
`bash


Get CVM list as JSON

phala cvms list --json

Parse with jq

phala status --json | jq '.username'
`

$3

Commands for managing Docker images for TEE deployments.

#### Docker Login

`bash
phala docker login [options]
`

Login to Docker Hub to enable pushing and pulling images.

Options:

- -u, --username : Docker Hub username (if not provided, you will be prompted)
- -p, --password : Docker Hub password (if not provided, you will be prompted)
- -r, --registry : Docker registry URL (optional, defaults to Docker Hub)

Example:
`bash
phala docker login --username your-dockerhub-username
`

#### Build Docker Image

`bash
phala docker build [options]
`

Build a Docker image for your TEE application.

Options:
- -i, --image : Image name (required)
- -t, --tag : Image tag (required)
- -f, --file : Path to Dockerfile (defaults to 'Dockerfile')

Example:
`bash
phala docker build --image my-tee-app --tag v1.0.0 --file ./Dockerfile
`

#### Push Docker Image

`bash
phala docker push [options]
`

Push a Docker image to Docker Hub.

Options:
- -i, --image : Image name (required)
- -t, --tag : Image tag (required)

Example:
`bash
phala docker push --image my-tee-app --tag v1.0.0
`

#### Build Docker Compose File

`bash
phala docker generate [options]
`

Build a Docker Compose file for your TEE application.

Options:
- -i, --image Docker image name to use in the compose file
- -t, --tag Docker image tag to use in the compose file
- -e, --env-file Path to environment variables file
- -o, --output

Output path for generated docker-compose.yml
- --template