deploy

Deploy new CVM or update existing one

Command: phala deploy

Syntax

phala deploy [options]

Description

Deploy new CVM or update existing one

Options

Option	Description
--cvm-id <value>	CVM identifier (UUID, app_id, instance_id, or name)
-i, --interactive	Enable interactive mode
-n, --name <value>	CVM name (defaults to directory name)
-c, --compose <value>	Path to Docker Compose file (default: docker-compose.yml)
-t, --instance-type <value>	Instance type (e.g., tdx.small, auto-selected if omitted)
-r, --region <value>	Preferred region (e.g., us-west, auto-selected if omitted)
-e, --env <value>	Environment variable (KEY=VALUE) or env file path (repeatable)
--kms <value>	KMS type: phala (default), ethereum/eth, or base
--wait	Wait for deployment/update completion
--ssh-pubkey <value>	SSH public key path (default: ~/.ssh/id_rsa.pub)
--dev-os, --no-dev-os	Use dev OS image (requires SSH key)
--public-logs, --no-public-logs	Make CVM logs publicly accessible (default: true)
--public-sysinfo, --no-public-sysinfo	Make CVM system info publicly accessible (default: true)
--listed, --no-listed	List CVM on the public Trust Center (default: false)

Multisig / Two-Phase Options

For on-chain KMS (Ethereum/Base) with multisig contract owners. See Multisig Update Flow.

Option	Description
--prepare-only	Prepare update without on-chain operations. Outputs compose hash and commit token for multisig approval.
--commit	Commit a previously prepared update using a commit token.
--token <value>	Commit token from --prepare-only output
--compose-hash <value>	Compose hash (optional, auto-read from token)
--transaction-hash <value>	Transaction hash proving on-chain registration (optional, defaults to state-only check)

Advanced Options

Option	Description
--debug	Enable debug logging
--disk-size <value>	Disk size with unit (e.g., 50G, default: 40GB)
--fs <value>	Filesystem type (ext4 or zfs, default: zfs)
--image <value>	OS image version (auto-selected if omitted)
--node-id <value>	Node ID (auto-selected if omitted)
--custom-app-id <value>	Custom App ID (requires —nonce for PHALA KMS)
--nonce <value>	Nonce for deterministic app_id (requires —custom-app-id, PHALA KMS only)
--pre-launch-script <value>	Path to pre-launch script
--private-key <value>	Private key for signing transactions.
--rpc-url <value>	RPC URL for the blockchain.

Deprecated Options

Option	Description
--uuid <value>	[DEPRECATED] Use —cvm-id instead. CVM UUID.
--vcpu <value>	Use —instance-type instead
--memory <value>	Use —instance-type instead
--env-file <value>	Use -e instead
--kms-id <value>	Use —kms instead

Global Options

Option	Description
-h, --help	Show help information for the current command
-v, --version	Show CLI version
--api-token TOKEN, --api-key TOKEN	API token used for authentication
-j, --json, --no-json	Output in JSON format
--api-version <value>	API version to use (e.g. 2025-10-28, 2026-01-21)

Examples

• Deploy new CVM

phala deploy

• Deploy with environment variables

phala deploy -e NODE_ENV=production -e DEBUG=true

• Deploy with env file

phala deploy -e .env

• Deploy with specific instance type

phala deploy --instance-type tdx.medium

• Deploy to specific region

phala deploy --region us-west

• Deploy with Ethereum KMS

phala deploy --kms ethereum --private-key <key> --rpc-url <url>

• Update existing CVM by ID

phala deploy --cvm-id app_abc123

• Update CVM with new compose file and env

phala deploy --cvm-id my-app --compose ./new-docker-compose.yml -e .env

• Update CVM and wait for completion

phala deploy --cvm-id app_abc123 --wait

• Update CVM from phala.toml

phala deploy

• Deploy with logs and sysinfo disabled

phala deploy --no-public-logs --no-public-sysinfo

• Deploy and list on Trust Center

phala deploy --listed

• Update existing CVM to disable logs

phala deploy --cvm-id app_123 --no-public-logs

Multisig Update Flow

When the on-chain KMS contract owner is a multisig wallet, the CLI cannot complete the on-chain transaction in a single operation. Use the two-phase flow:

• Phase 1: Prepare the update (generate commit token)

phala deploy --cvm-id app_abc123 --prepare-only -c docker-compose.yml -e .env

This outputs the compose hash, on-chain status, and a commit token. The token is valid for 7 days.

• Phase 2: After multisig approval and on-chain registration, commit the update

phala deploy --cvm-id app_abc123 \
  --commit \
  --token <commit-token>

If the compose hash is already registered on-chain, --transaction-hash can be omitted (defaults to state-only check).

• With explicit transaction hash

phala deploy --cvm-id app_abc123 \
  --commit \
  --token <commit-token> \
  --transaction-hash 0x...

• You can also commit via the API directly

curl -X POST 'https://cloud-api.phala.com/api/v1/cvms/<uuid>/commit-update?token=<commit-token>'

Or use the Confirm Update page in the dashboard (link provided in --prepare-only output).