# Dstack: A Zero Trust Framework for Confidential Containers

arXiv: https://arxiv.org/abs/2509.11555 · HTML: https://mlsanity.com/paper/2509.11555/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 24 references that are in the map.
- First posted on arXiv 15 Sep 2025.

## Builds on (most cited first, 4 of 4)

- [Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardware](https://mlsanity.com/paper/1806.03287/) (2018)
- [Chiron: Privacy-preserving Machine Learning as a Service](https://mlsanity.com/paper/1803.05961/) (2018)
- [Ekiden: A Platform for Confidentiality-Preserving, Trustworthy, and Performant Smart Contract Execution](https://mlsanity.com/paper/1804.05141/) (2018)
- [Reproducible Builds: Increasing the Integrity of Software Supply Chains](https://mlsanity.com/paper/2104.06020/) (2021)

## Built on by (most cited first, 2 of 2)

- [AGNT2: Autonomous Agent Economies on Interaction-Optimized Layer 2 Infrastructure](https://mlsanity.com/paper/2604.21129/) (2026)
- [Implement Kubernetes Pod-Level Remote Attestation for Confidential Workloads on dstack](https://mlsanity.com/paper/2606.03323/) (2026)

## Abstract (arXiv)

Web3 applications require execution platforms that maintain confidentiality and integrity without relying on centralized trust authorities. While Trusted Execution Environments (TEEs) offer promising capabilities for confidential computing, current implementations face significant limitations when applied to Web3 contexts, particularly in security reliability, censorship resistance, and vendor independence. This paper presents dstack, a comprehensive framework that transforms raw TEE technology into a true Zero Trust platform. We introduce three key innovations: (1) Portable Confidential Containers that enable seamless workload migration across heterogeneous TEE environments while maintaining security guarantees, (2) Decentralized Code Management that leverages smart contracts for transparent governance of TEE applications, and (3) Verifiable Domain Management that ensures secure and verifiable application identity without centralized authorities. These innovations are implemented through three core components: dstack-OS, dstack-KMS, and dstack-Gateway. Together, they demonstrate how to achieve both the performance advantages of VM-level TEE solutions and the trustless guarantees required by Web3 applications. Our evaluation shows that dstack provides comprehensive security guarantees while maintaining practical usability for real-world applications.