Phala Cloud CLI

Command-line tool for deploying and managing TEE (Trusted Execution Environment) applications on Phala Cloud.

Install

npm install -g phala

Or run directly without installing:

npx phala <command>
bunx phala <command>

Quick Start

# Authenticate (opens browser for device flow)
phala login

# Deploy from a directory with docker-compose.yml
phala deploy

# Link the directory to the CVM for future commands
phala link

# View container logs
phala logs

# SSH into the CVM
phala ssh

Tip: Run phala link after your first deploy. It creates a phala.toml that binds the directory to the CVM, so subsequent commands (deploy, logs, ssh, cp, ps) work without specifying a CVM ID. phala.toml is safe to commit to version control.

Commands

Deploy

| Command | Description | |---------|-------------| | deploy | Deploy new CVM or update existing one | | instance-types | List available instance types | | nodes | List TEE worker nodes |

Manage

| Command | Description | |---------|-------------| | apps | List deployed CVMs | | cvms | Manage CVMs (start, stop, restart, delete, resize, ...) | | link | Link a local directory to a CVM | | simulator | Local TEE simulator for development |

CVM Operations

| Command | Description | |---------|-------------| | logs | Fetch logs from a CVM (container, serial, stdout/stderr) | | ps | List containers of a CVM | | ssh | Connect to a CVM via SSH | | cp | Copy files to/from a CVM via SCP |

Profile / Auth

| Command | Description | |---------|-------------| | login | Authenticate with Phala Cloud | | logout | Remove stored API key | | status | Check authentication status | | whoami | Print the current user | | profiles | List auth profiles | | switch | Switch auth profiles |

Advanced

| Command | Description | |---------|-------------| | api | Make authenticated API requests | | self | CLI self-management (update) | | completion | Generate shell completion scripts |

Configuration

Project file (phala.toml)

Place a phala.toml in your project root to bind a directory to a CVM:

app_id = "app_abc123"
compose_file = "docker-compose.yml"
env_file = ".env"
public_logs = true
listed = false

When phala.toml exists, commands like deploy, logs, ssh, and cp automatically use the configured CVM.

Environment variables

| Variable | Description | |----------|-------------| | PHALA_CLOUD_API_KEY | Override the stored API key | | PHALA_CLOUD_API_PREFIX | Override the API base URL | | PHALA_CLOUD_DIR | Override the credentials directory (default: ~/.phala-cloud) | | PHALA_UPDATE_CHANNEL | Release channel for self update (e.g., latest, beta) |

Profiles

Manage multiple workspaces with named profiles:

phala login --profile work
phala login --profile personal
phala switch work
phala profiles

Credentials are stored in ~/.phala-cloud/ with restricted file permissions.

Documentation

Full command reference with all options, arguments, and examples:

https://github.com/Phala-Network/phala-cloud/tree/main/cli/docs

Development

bun install
bun run src/index.ts <command>

# Quality checks
bun run fmt        # Format with Biome
bun run lint       # Lint with Biome
bun run type-check # TypeScript type checking
bun run test       # Run tests

License

Apache-2.0