Phala Cloud

Run polign_db inside a confidential VM on Phala Cloud. The template keeps your data encrypted in memory by the hardware and encrypted in storage by keys that only you and the VM hold.

Open the template on Phala Cloud →

What the template runs

Two containers inside one Intel TDX confidential VM:

polign_db. On first start it downloads the release you name, checks it against the published checksums, and keeps it on the VM's volume. It stores data on that volume, or in your S3 or GCS bucket.
A small proxy on port 23000 that requires Authorization: Bearer with your token on everything except GET /healthz.

Storage encryption is always on. The template will not start without a keyring, so nothing readable ever reaches the volume or the bucket. Phala's attestation shows the hardware quote and the hash of the deployed configuration, so you can check that the code holding your keys is the code you approved.

Step 1: make the two secrets

printf '1=%s\n' "$(openssl rand -base64 32)"   # POLIGN_STORE_ENCRYPTION_KEYS
openssl rand -hex 32                            # BEARER_TOKEN

Keep a copy of the keyring outside Phala Cloud. Without it nobody can read the data, including you.

Step 2: choose where the data lives

With no other settings the data stays on the VM's volume. To use an S3 bucket, create the bucket with public access blocked, a role that can reach it, and a user that can do nothing except assume that role. Then set these as encrypted variables. The AWS region is the bucket's region. It has nothing to do with the Phala region the VM runs in.

POLIGN_STORE=s3://BUCKET/polign
POLIGN_STORE_REGION=us-west-2
POLIGN_STORE_ROLE_ARN=arn:aws:iam::ACCOUNT:role/polign-phala
POLIGN_STORE_EXTERNAL_ID=EXTERNAL_ID
AWS_ACCESS_KEY_ID=AKIA...
AWS_SECRET_ACCESS_KEY=...

For Google Cloud Storage, set POLIGN_STORE=gcs://BUCKET/polign and GOOGLE_APPLICATION_CREDENTIALS_BASE64 to the base64-encoded key of a service account that holds roles/storage.objectAdmin on that one bucket. The template README has the full IAM policies.

Variable	Default	What it does
`POLIGN_STORE_ENCRYPTION_KEYS`	required	The keyring, one `id=base64` line per key. If it is empty the container exits.
`BEARER_TOKEN`	required	What clients send as `Authorization: Bearer`. It gives full read and write access.
`POLIGN_STORE`	`fs:/data/store`	The volume, or an `s3://` or `gcs://` bucket. Choose before the first write.
`POLIGN_VERSION`	`v0.5.0`	The release to download. Set it to the current release, and change it later to upgrade in place.
`POLIGN_DISK_CACHE_BYTES`	4 GiB	Local cache size. Used only with a bucket.

Step 3: deploy and verify

Create a VM from the template, paste the variables as encrypted environment, expose port 23000, and deploy. The first start downloads about 85 MB. Then check the endpoint:

curl https://APP/healthz                                  # ok, no token needed
curl -i https://APP/v1/collections/docs/vectors/a         # 401 without the token
curl -X PUT https://APP/v1/collections/docs/vectors/a \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"values":[1,0,0],"metadata":{"label":"first"}}'
curl -X POST https://APP/v1/collections/docs/query \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"values":[0.9,0.1,0],"k":5}'

The server log should show store encryption: on with the key id in use, and with a bucket, the role it assumes for every request. The Attestations tab on the Phala dashboard shows the TDX quote and the configuration hash for the deployment.

Limits

The bucket still sees object names, sizes, and access patterns.
Encryption detects altered data. It does not stop someone with storage permissions from deleting objects. Bucket versioning and a backup in a separate account cover that.
S3 and GCS do not check the hardware quote before serving a request. You decide which deployment gets the keyring, and you check the attestation yourself.
One shared token is the only authentication in the template. polign_db has per-client API keys if you need them, and the start command has to be changed to use them.
Search speed inside a confidential VM has not been measured. The benchmarks were run on ordinary EC2 instances.

Cost

The template defaults to Phala's smallest confidential VM (1 vCPU, 2 GB, 20 GB disk), billed by Phala at about $0.06 an hour at the time of writing. A bucket is billed by your cloud account at normal storage rates. polign_db is free to self-host, and the template downloads the same release binaries as every other channel.

Announcing polign_db on Phala Cloud explains the design: why an agent's memory should outlive its VM, how the keys are handled, how it scales, and what it means for GDPR.