0.19.17-v1

Single Sign-On via Google

dstack Enterprise now supports Single Sign-On via Google. When Google integration is configured, the dstack login page will display the Sign in with Google button. See the Google integration guide for more information.

Secrets

dstack gets support for secrets that allow centralized management of sensitive values such as API keys and credentials. They are project-scoped, managed by project admins, and can be referenced in run configurations to pass sensitive values to runs in a secure manner. Example:

$ dstack secret set my_secret some_secret_value
OK

type: task
nodes: 1
name: test-secrets
env:
  - MY_SECRET=${{ secrets.my_secret }}
commands:
  - echo $MY_SECRET

$ dstack apply -f .dstack/confs/task.dstack.yaml

Submit the run test-task? [y/n]: y
 NAME            BACKEND         RESOURCES              PRICE   STATUS   SUBMITTED
 test-task       aws             cpu=2 mem=8GB          $0.107  running  10:48 
                 (eu-west-1)     disk=100GB                                   

test-secrets provisioning completed (running)
some_secret_value
Exited (0)

For more details on secrets, check out the docs.

Files

By default, dstack automatically mounts the repo directory where you ran dstack init to any run configuration.

However, in some cases, you may not want to mount the entire directory (e.g., if it’s too large), or you might want to mount files outside of it. In such cases, you can use the files property.

type: task
name: trl-sft

files:
  - .:examples  # Maps the directory where `.dstack.yml` to `/workflow/examples`
  - ~/.ssh/id_rsa  # Maps `~/.ssh/id_rsa` to `/root/.ssh/id_rsa`

python: 3.12

env:
  - HF_TOKEN
  - HF_HUB_ENABLE_HF_TRANSFER=1
  - MODEL=Qwen/Qwen2.5-0.5B
  - DATASET=stanfordnlp/imdb

commands:
  - uv pip install trl
  - | 
    trl sft \
      --model_name_or_path $MODEL --dataset_name $DATASET
      --num_processes $DSTACK_GPUS_PER_NODE

resources:
  gpu: H100:1

Warning

If you have existing fleets, it's recommended to re-create them after upgrading to version 0.19.17. Otherwise, there is a risk that these instances won't be able to execute jobs if if a run uses files.

Services

Rolling deployment

Rolling deployments introduced in 0.19.15 are now supported when deploying new commits or branches from a Git repo, or when changes are made to the repo contents or files listed in the files section.

Additionally, dstack apply now displays a full list of detected changes:

$ dstack apply -f my-service.dstack.yml

Active run my-service already exists. Detected changes that can be updated in-place:
- Repo state (branch, commit, or other)
- File archives
- Configuration properties:
  - env
  - files

Update the run? [y/n]:

Even when a rolling deployment isn't possible, the list of changes is still shown — making it easier to identify which changes are preventing the deployment from proceeding in-place.

What's changed

• [Bug]: Docker In Docker does not work with AMD by @peterschmidt85 in dstackai/dstack#2849
• [Feature] Add files property to run configurations by @un-def in dstackai/dstack#2848
• [Feature] Implement project secrets by @r4victor in dstackai/dstack#2854
• [Internal] Support fleet configurations for the local backend by @jvstme in dstackai/dstack#2856
• [Services] Rolling deployments for repo updates by @jvstme in dstackai/dstack#2853
• [Internal] Fix package dependency direction by @jvstme in dstackai/dstack#2859
• [Internal] Rolling deployments for files by @jvstme in dstackai/dstack#2862
• [Internal] Support the local backend with the in-server proxy by @jvstme in dstackai/dstack#2858
• [Docs] Added Files documentation by @peterschmidt85 in dstackai/dstack#2866
• [Bug] Fix ~ expansion in files by @un-def in dstackai/dstack#2865
• [Feature] Allow in-place update for more run properties by @jvstme in dstackai/dstack#2867

Full changelog: dstackai/dstack@0.19.16...0.19.17