Example configs

Minimal config

tinfoil-config.yml

cvm-version: "<CVM_VERSION>" # TODO: Use latest version from https://github.com/tinfoilsh/cvmimage
cpus: 2
memory: 8192

containers:
  - name: "api"
    image: "ghcr.io/myorg/api-server:v1.0.0@sha256:abc123..."
    command: ["--port", "8000"]

shim:
  upstream-port: 8000
  paths:
    - /health
    - /api/*

With environment variables and secrets

tinfoil-config.yml

cvm-version: "<CVM_VERSION>" # TODO: Use latest version from https://github.com/tinfoilsh/cvmimage
cpus: 4
memory: 16384

containers:
  - name: "api"
    image: "ghcr.io/myorg/api-server:v2.1.0@sha256:def456..."
    env:
      - PORT: "8080"
      - LOG_LEVEL: "info"
      - NODE_ENV: "production"
    secrets:
      - DATABASE_URL
      - STRIPE_SECRET_KEY
    command: ["--port", "8080"]

shim:
  upstream-port: 8080
  paths:
    - /health
    - /api/*
    - /webhooks/*

With outbound network access

tinfoil-config.yml

cvm-version: "<CVM_VERSION>" # TODO: Use latest version from https://github.com/tinfoilsh/cvmimage
cpus: 4
memory: 16384

networks:
  backend:
    egress: allowlist
    allow:
      - api.stripe.com

containers:
  - name: "api"
    image: "ghcr.io/myorg/api-server:v2.1.0@sha256:def456..."
    networks: [backend]
    secrets:
      - STRIPE_SECRET_KEY
    command: ["--port", "8080"]

shim:
  upstream-port: 8080
  paths:
    - /api/*

GPU inference server (vLLM)

Use a vLLM image that supports your model, with curl available for the healthcheck. See Model weights for preparing the weights.

tinfoil-config.yml

cvm-version: "<CVM_VERSION>" # TODO: Use latest version from https://github.com/tinfoilsh/cvmimage
cpus: 16
memory: 65536
gpus: 1

models:
  - name: "gemma-4-31b-it"
    repo: "google/gemma-4-31B-it@419b2efe421994fdfd3394e621983d4cc511cd4f"
    mpk: "0900ca6b913db0036792149d3ea5862986d66a6964b010e998f56fbb7e1276ab_62578683904_59fe9787-ed93-577a-9fd9-a7804c932a11"

containers:
  - name: "inference"
    image: "ghcr.io/myorg/vllm-gemma4@sha256:<digest>"
    runtime: nvidia
    gpus: all
    restart: always
    command: [
      "--model", "/tinfoil/mpk/mpk-0900ca6b913db0036792149d3ea5862986d66a6964b010e998f56fbb7e1276ab",
      "--served-model-name", "gemma-4-31b-it",
      "--port", "8001"
    ]
    tmpfs:
      /tmp: size=512m,mode=1777,exec
      /root: size=2g,mode=0700,exec
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:8001/health"]
      interval: 30s
      timeout: 5s
      start_period: 30m

shim:
  upstream-port: 8001
  paths:
    - /v1/chat/completions
    - /v1/completions
    - /health
    - /metrics

The tmpfs mounts give vLLM writable scratch space on the read-only root filesystem. Set start_period longer than your model takes to load. There is no networks block, so the container has no internet access; anything it needs at runtime must be in the image.

Multi-container setup

Containers on the same network reach each other by name. They start in parallel, so the worker must retry until the API is up.

tinfoil-config.yml

cvm-version: "<CVM_VERSION>" # TODO: Use latest version from https://github.com/tinfoilsh/cvmimage
cpus: 8
memory: 32768

networks:
  internal: {}

containers:
  - name: "api"
    image: "ghcr.io/myorg/api-server:v1.0.0@sha256:abc123..."
    networks: [internal]
    env:
      - PORT: "8080"
    secrets:
      - DATABASE_URL
    command: ["--port", "8080"]
  - name: "worker"
    image: "ghcr.io/myorg/worker:v1.0.0@sha256:def456..."
    networks: [internal]
    env:
      - API_URL: "http://api:8080"
    secrets:
      - API_SECRET

shim:
  upstream-port: 8080
  paths:
    - /health
    - /api/*

Getting Started

Model catalog

Tinfoil SDKs

Tinfoil Chat

Local Proxy

Tinfoil Containers

Guides

Verification & Attestation

Tutorials

Admin API

Resources

Minimal config

With environment variables and secrets

With outbound network access

GPU inference server (vLLM)

Multi-container setup

​Minimal config

​With environment variables and secrets

​With outbound network access

​GPU inference server (vLLM)

​Multi-container setup

Minimal config

With environment variables and secrets

With outbound network access

GPU inference server (vLLM)

Multi-container setup