Skip to main content
This dashboard-first walkthrough takes you through the full Tinfoil Containers flow end-to-end using the tinfoil-containers-template. The template ships with a pre-built hello-world image, so there’s nothing to build — you’ll deploy a demo container to a real Tinfoil enclave, manage a secret, send a verified request, and see how updates work. To deploy from the terminal instead, see Managing containers from the CLI. By the end you’ll understand the moving parts well enough to swap in your own image. Here’s what you’ll do:
  • Create a repo from the template and review its tinfoil-config.yml.
  • Release a version and add a secret (GREETING_TOKEN).
  • Deploy the container to an enclave and make a verified request to it.
  • Learn how to update the instance.

​
Prerequisites

  • An organization in the Tinfoil Dashboard (Containers is an org-level feature).
  • An active Tinfoil Containers subscription for your organization.

​
1. Create a repo from the template

Use tinfoil-containers-template to make a new repo: click Use this template → Create a new repository. Give it any name you’d like, and make sure it’s public. The tinfoil-config.yml needs to be public so the instance can be independently verified — Tinfoil fetches it at deploy time to compute the enclave measurement, and your users’ SDKs fetch it (via the Sigstore transparency log) to check that the running enclave matches what you published. The Docker image itself can still be private — see Private images.

​
2. Read the tinfoil-config.yml

This is the file that defines your deployment. It’s already wired up:
tinfoil-config.yml
The containers section defines a hello-world container, which points to a prebuilt Tinfoil image, tinfoil-containers-hello-world. It accepts an environment variable and a secret, then reports the message and whether the secret is present. For now, leave it alone — we’ll customize it later. See the configuration reference for the full schema, with networking & routing, runtime & security, and example configs on their own pages.
Deploying a Hugging Face model with an inference server like vLLM? Prepare the model weights first in the dashboard’s Models tab, then add the generated models: block to your config. See Model weights.

​
3. Release a version

Releasing creates the Git tag, measures the image, signs the attestation, and publishes a GitHub release. The dashboard drives the whole flow, so you don’t need to touch the command line. The template includes the required tinfoil-release.yml and tinfoil-release-publish.yml GitHub Actions workflows. If you use a custom config repository, copy both workflows from the template before publishing your first release.
  1. Open the Tinfoil Dashboard and go to Containers → Repositories → select your repo that you just created. Note: you may need to install the Tinfoil GitHub App first.
  2. Edit the config. The dashboard renders tinfoil-config.yml as editable fields (resources, containers, env, secrets). The template config is already complete, so for this first release a trivial change (for example, the MESSAGE value) is enough.
  3. Click Open Pull Request. The dashboard opens a PR on your repo with the config change. Review and merge it.
  4. Follow the Release steps shown in the dashboard to publish version v0.0.1.
After the release runs, wait ~1 min before deploying — the tag won’t appear in the dashboard’s picker until the measurement is computed and the GitHub release is published.
Prefer the command line? Trigger the Tinfoil Release workflow directly:
Or via the GitHub UI: Actions → Tinfoil Release → Run workflow → enter v0.0.1.Two workflows run back-to-back: tinfoil-release.yml creates the tag, then auto-dispatches tinfoil-release-publish.yml, which runs measure-image-action to compute the enclave measurement and publish the release.

​
4. Add the GREETING_TOKEN secret

The config declares a GREETING_TOKEN secret. That means we’ll have to add a value for it before deploying. Tinfoil Dashboard will refuse to deploy unless this secret exists. To add the value:
  1. Open the Tinfoil Dashboard
  2. Navigate to Tinfoil Containers → Secrets
  3. Click Add Secret, enter the name GREETING_TOKEN and any value
  4. Save

​
5. Deploy

In the dashboard:
  1. All Containers tab → New Container
  2. Enter a container name (lowercase, hyphens allowed — e.g. hello-world)
  3. Select your new repository (enter owner/repo manually or pick from connected repos)
  4. The v0.0.1 tag will auto-select
  5. Confirm the env vars and secrets shown match your config
  6. Click Deploy Container
The status will show Deploying while the image is pulled and the enclave boots. After a minute or two it flips to Running.
Click Connect GitHub in the dashboard to install the Tinfoil GitHub App on your repo. This lets Tinfoil mark a successfully deployed release as GitHub latest. It does not update running containers when a new release is published.

​
6. Update the instance

To roll out a change — new image digest, new env var, new path — edit tinfoil-config.yml and release a new version, all from the dashboard.
  1. Go to Containers → Repositories → select your repo and edit tinfoil-config.yml. For example, change the MESSAGE env var:
    tinfoil-config.yml
  2. Click Open Pull Request, then review and merge it.
  3. Follow the Release steps shown in the dashboard to publish v0.0.2.
  4. Click Update on your container and select v0.0.2. This triggers a blue-green update (no downtime).
After committing your config change:
Or via the GitHub UI: Actions → Tinfoil Release → Run workflow → enter v0.0.2.

​
7. Make a request

Your container is live at https://<name>.<org>.containers.tinfoil.dev. To test it out:
This raw curl request checks connectivity but does not verify the enclave. Do not send sensitive data this way. You should see your updated message:
For real-time, attested requests (where the SDK verifies the enclave measurement before sending data), use one of the Tinfoil SDKs. Once you’re ready to deploy your own code instead of the prebuilt template image, see Building your own image.