cli

Phala Cloud CLI

Command-line tool for deploying and managing TEE (Trusted Execution Environment) applications on Phala Cloud.

Install

npm install -g phala

Or run directly without installing:

npx phala <command>
bunx phala <command>

Quick Start

# Authenticate (opens browser for device flow)
phala login

# Deploy from a directory with docker-compose.yml
phala deploy

# Link the directory to the CVM for future commands
phala link

# View container logs
phala logs

# SSH into the CVM
phala ssh

Tip: Run phala link after your first deploy. It creates a phala.toml that binds the directory to the CVM, so subsequent commands (deploy, logs, ssh, cp, ps) work without specifying a CVM ID. phala.toml is safe to commit to version control.

Commands

Deploy

Command	Description
deploy	Deploy new CVM or update existing one
instance-types	List available instance types
nodes	List TEE worker nodes

Manage

Command	Description
apps	List deployed CVMs
cvms	Manage CVMs (start, stop, restart, delete, resize, ...)
link	Link a local directory to a CVM
simulator	Local TEE simulator for development

CVM Operations

Command	Description
logs	Fetch logs from a CVM (container, serial, stdout/stderr)
ps	List containers of a CVM
ssh	Connect to a CVM via SSH
cp	Copy files to/from a CVM via SCP

Profile / Auth

Command	Description
login	Authenticate with Phala Cloud
logout	Remove stored API key
status	Check authentication status
whoami	Print the current user
profiles	List auth profiles
switch	Switch auth profiles

Advanced

Command	Description
api	Make authenticated API requests
self	CLI self-management (update)
completion	Generate shell completion scripts

Configuration

Project file (phala.toml)

Place a phala.toml in your project root to bind a directory to a CVM:

app_id = "app_abc123"
compose_file = "docker-compose.yml"
env_file = ".env"
public_logs = true
listed = false

When phala.toml exists, commands like deploy, logs, ssh, and cp automatically use the configured CVM.

Environment variables

Variable	Description
PHALA_CLOUD_API_KEY	Override the stored API key
PHALA_CLOUD_API_PREFIX	Override the API base URL
PHALA_CLOUD_DIR	Override the credentials directory (default: ~/.phala-cloud)
PHALA_UPDATE_CHANNEL	Release channel for self update (e.g., latest, beta)

Profiles

Manage multiple workspaces with named profiles:

phala login --profile work
phala login --profile personal
phala switch work
phala profiles

Credentials are stored in ~/.phala-cloud/ with restricted file permissions.

Documentation

Full command reference with all options, arguments, and examples:

https://github.com/Phala-Network/phala-cloud/tree/main/cli/docs

Development

bun install
bun run src/index.ts <command>

# Quality checks
bun run fmt        # Format with Biome
bun run lint       # Lint with Biome
bun run type-check # TypeScript type checking
bun run test       # Run tests

License

Apache-2.0