> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tinfoil.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# QuickStart Demo

> Deploy your first Tinfoil Container in minutes.

This dashboard-first walkthrough takes you through the full Tinfoil Containers flow end-to-end using the [`tinfoil-containers-template`](https://github.com/tinfoilsh/tinfoil-containers-template). The template ships with a pre-built hello-world image, so there's nothing to build — you'll deploy a demo container to a real Tinfoil enclave, manage a secret, send a verified request, and see how updates work. To deploy from the terminal instead, see [Managing containers from the CLI](/containers/cli). By the end you'll understand the moving parts well enough to swap in your own image.

Here's what you'll do:

* Create a repo from the template and review its `tinfoil-config.yml`.
* Release a version and add a secret (`GREETING_TOKEN`).
* Deploy the container to an enclave and make a verified request to it.
* Learn how to update the instance.

## Prerequisites

* An organization in the [Tinfoil Dashboard](https://dash.tinfoil.sh) (Containers is an org-level feature).
* An active Tinfoil Containers subscription for your organization.

## 1. Create a repo from the template

Use [`tinfoil-containers-template`](https://github.com/tinfoilsh/tinfoil-containers-template) to make a new repo: click **Use this template** → **Create a new repository**.

Give it any name you'd like, and make sure it's **public**. The `tinfoil-config.yml` needs to be public so the instance can be independently verified — Tinfoil fetches it at deploy time to compute the enclave measurement, and your users' SDKs fetch it (via the [Sigstore transparency log](https://docs.sigstore.dev/logging/overview/)) to check that the running enclave matches what you published. The Docker image itself can still be private — see [Private images](/containers/private-images).

## 2. Read the `tinfoil-config.yml`

This is the file that defines your deployment. It's already wired up:

```yaml tinfoil-config.yml theme={"dark"}
# Tinfoil Container Configuration
# For updates: edit this file, commit, run the workflow (e.g., v0.0.2)
cvm-version: "<CVM_VERSION>" # TODO: Use latest version from https://github.com/tinfoilsh/cvmimage
cpus: 2
memory: 8192

containers:
  - name: "hello-world"
    image: "ghcr.io/tinfoilsh/tinfoil-containers-hello-world@sha256:<hash>"
    env:
      - MESSAGE: "Hello from Tinfoil"
    secrets:
      - GREETING_TOKEN

shim:
  upstream-port: 8080
  paths:
    - /*
```

The `containers` section defines a `hello-world` container, which points to a prebuilt Tinfoil image, [`tinfoil-containers-hello-world`](https://github.com/tinfoilsh/tinfoil-containers-hello-world). It accepts an environment variable and a secret, then reports the message and whether the secret is present.

For now, leave it alone — we'll customize it later. See the [configuration reference](/containers/configuration) for the full schema, with [networking & routing](/containers/config-networking), [runtime & security](/containers/config-runtime), and [example configs](/containers/config-examples) on their own pages.

<Tip>
  Deploying a Hugging Face model with an inference server like vLLM? Prepare the model weights first in the dashboard's **Models** tab, then add the generated `models:` block to your config. See [Model weights](/containers/models).
</Tip>

## 3. Release a version

Releasing creates the Git tag, measures the image, signs the attestation, and publishes a GitHub release. The dashboard drives the whole flow, so you don't need to touch the command line.

The template includes the required `tinfoil-release.yml` and `tinfoil-release-publish.yml` GitHub Actions workflows. If you use a custom config repository, copy both workflows from the template before publishing your first release.

1. Open the [Tinfoil Dashboard](https://dash.tinfoil.sh) and go to **Containers** → **Repositories** → select your repo that you just created. Note: you may need to install the Tinfoil GitHub App first.
2. Edit the config. The dashboard renders `tinfoil-config.yml` as editable fields (resources, containers, env, secrets). The template config is already complete, so for this first release a trivial change (for example, the `MESSAGE` value) is enough.
3. Click **Open Pull Request**. The dashboard opens a PR on your repo with the config change. Review and merge it.
4. Follow the **Release** steps shown in the dashboard to publish version `v0.0.1`.

<Info>
  After the release runs, wait \~1 min before deploying — the tag won't appear in the dashboard's picker until the measurement is computed and the GitHub release is published.
</Info>

<Accordion title="Release manually with the GitHub CLI">
  Prefer the command line? Trigger the **Tinfoil Release** workflow directly:

  ```bash theme={"dark"}
  gh workflow run tinfoil-release.yml -f version=v0.0.1
  ```

  Or via the GitHub UI: **Actions** → **Tinfoil Release** → **Run workflow** → enter `v0.0.1`.

  Two workflows run back-to-back: `tinfoil-release.yml` creates the tag, then auto-dispatches `tinfoil-release-publish.yml`, which runs [`measure-image-action`](https://github.com/tinfoilsh/measure-image-action) to compute the enclave measurement and publish the release.
</Accordion>

## 4. Add the `GREETING_TOKEN` secret

The config declares a `GREETING_TOKEN` secret. That means we'll have to add a value for it before deploying. Tinfoil Dashboard will refuse to deploy unless this secret exists. To add the value:

1. Open the [Tinfoil Dashboard](https://dash.tinfoil.sh)
2. Navigate to **Tinfoil Containers** → **Secrets**
3. Click **Add Secret**, enter the name `GREETING_TOKEN` and any value
4. Save

## 5. Deploy

In the dashboard:

1. **All Containers** tab → **New Container**
2. Enter a container name (lowercase, hyphens allowed — e.g. `hello-world`)
3. Select your new repository (enter `owner/repo` manually or pick from connected repos)
4. The `v0.0.1` tag will auto-select
5. Confirm the env vars and secrets shown match your config
6. Click **Deploy Container**

The status will show **Deploying** while the image is pulled and the enclave boots. After a minute or two it flips to **Running**.

<Tip>
  Click **Connect GitHub** in the dashboard to install the Tinfoil GitHub App on your repo. This lets Tinfoil mark a successfully deployed release as GitHub `latest`. It does not update running containers when a new release is published.
</Tip>

## 6. Update the instance

To roll out a change — new image digest, new env var, new path — edit `tinfoil-config.yml` and release a new version, all from the dashboard.

1. Go to **Containers** → **Repositories** → select your repo and edit `tinfoil-config.yml`. For example, change the `MESSAGE` env var:

   ```yaml tinfoil-config.yml theme={"dark"}
       env:
         - MESSAGE: "A new message!"
   ```

2. Click **Open Pull Request**, then review and merge it.

3. Follow the **Release** steps shown in the dashboard to publish `v0.0.2`.

4. Click **Update** on your container and select `v0.0.2`. This triggers a [blue-green update](/containers/updates) (no downtime).

<Accordion title="Release manually with the GitHub CLI">
  After committing your config change:

  ```bash theme={"dark"}
  gh workflow run tinfoil-release.yml -f version=v0.0.2
  ```

  Or via the GitHub UI: **Actions** → **Tinfoil Release** → **Run workflow** → enter `v0.0.2`.
</Accordion>

## 7. Make a request

Your container is live at `https://<name>.<org>.containers.tinfoil.dev`. To test it out:

```bash theme={"dark"}
curl https://<name>.<org>.containers.tinfoil.dev/
```

This raw `curl` request checks connectivity but does not verify the enclave. Do not send sensitive data this way.

You should see your updated message:

```
MESSAGE: A new message!
GREETING_TOKEN: present
```

For real-time, attested requests (where the SDK verifies the enclave measurement before sending data), use one of the [Tinfoil SDKs](/containers/connecting).

Once you're ready to deploy your own code instead of the prebuilt template image, see [Building your own image](/containers/building-images).