Skip to main content
At Tinfoil, everything that touches plaintext client data runs inside secure enclaves. This includes all our hosted AI models and the rest of our critical security infrastructure. Tinfoil Containers makes that same infrastructure available for running your own applications, with the same privacy, transparency, and security guarantees. Tinfoil Containers run any Docker image inside an AMD SEV or Intel TDX secure enclave. The container’s memory is encrypted in hardware, isolated from the host, and invisible to Tinfoil. You and any client connecting to it can verify that fact themselves via remote attestation.
GPU workloads run inside NVIDIA confidential-computing enclaves with the same attestation. Contact us to enable GPU access for your org.
Features that use V3 attestation are beta, including private secrets, encrypted persistent volumes, attested keys, attested SSH, and fresh attestation requests. See Feature status.

​
What’s public, what’s private

A Tinfoil Container splits into two artifacts with different visibility rules:
  • The configuration (tinfoil-config.yml) must live in a public repo. Tinfoil reads it at deploy time to compute the enclave measurement, and your users’ SDKs read it (via the Sigstore transparency log) at request time to verify the running enclave matches what you published.
  • Your source code and Docker image can stay private. The config pins the image by SHA256 digest, and the attestation commits to that exact digest; Tinfoil doesn’t need to read your code to verify it. See Private images for registry credentials.
Anything that’s part of the measurement must be readable; anything that’s measured by the config doesn’t have to be.

​
Limitations

Tinfoil Containers have some limitations to work around when building on top of them:
  • No persistent disk by default. Data written to the enclave’s ephemeral filesystem is lost when it stops or is replaced during an update. For durable storage, declare a named volume mount, attach an encrypted persistent volume, and confirm it is unlocked and mounted before writing; or use the S3 sidecar tutorial.
  • No inbound private networking. Your container is reachable over the public internet. You’ll have to build in appropriate authentication yourself.
  • No built-in load balancing. Each instance is one enclave. A project can contain multiple independently managed instances, but Tinfoil does not balance traffic between them.
  • No SSH access by default. Since your container runs in a secure enclave, you can’t shell into it by default. To troubleshoot, enable debug mode, which deploys a separate instance of your container with SSH access.
Debug containers do not pass attestation. Tinfoil’s SecureClient will refuse to connect to a debug instance because debug enclaves are not confidential. Never use debug mode for production traffic or sensitive data.

​
Getting started

Quickstart

Deploy your first container.

Example repo

A ready-to-deploy template that ships a working hello-world container with an env var and a secret.

​
Configuration

Configuration reference

The full tinfoil-config.yml schema for runtime, resources, and routing.

Private images

Configure registry credentials so Tinfoil can pull private images.

Secrets & variables

Manage environment variables and encrypted secrets.

Custom domains

Use your own domain instead of the default .containers.tinfoil.dev URL.

Model weights

Prepare Hugging Face weights for GPU inference containers.

​
Operations

Making requests

SDK and CLI examples for making attested requests.

Projects

Group the instances that share one config repository.

Instance lifecycle

Deploy, stop, and delete instances.

Updating

Blue/green updates, downtime, rollback, cancel, and recovery.

Debug mode

SSH into a separate debug instance for troubleshooting.

Hold for review

Try a new version at its review URL, then promote it.

Using the CLI

Manage projects and instances from the terminal.

​
Reference

Resource limits

CPU, memory, naming constraints, and org quotas.

Production checklist

Security, reliability, and deployment best practices.

Troubleshooting

Common issues and how to fix them.