From 2119421cf52958c77969ab4de708b5133de2e1e6 Mon Sep 17 00:00:00 2001 From: Leechael Yim Date: Fri, 28 Aug 2026 05:53:58 +0800 Subject: [PATCH 1/2] fix(verifier): bind the configured address and port Rocket 0.6 DefaultListener treats `address` as an Endpoint. A bare IP such as `0.0.0.0` from dstack-verifier.toml parses as tcp:0.0.0.0:8000, and `.launch()` binds that socket. `port` from the toml file or DSTACK_VERIFIER_PORT is extracted into the app Config and validated, but it never reaches the listener, so operators cannot move the HTTP server off 8000. Bind a tokio TcpListener from the already-validated Config address/port and `launch_on` it. That matches how guest-agent and supervisor start Rocket, and keeps listen-address selection in one place instead of hoping Figment keys overlay Rocket's Endpoint default. Verified with `cargo test -p dstack-verifier --bin dstack-verifier` (2 passed). --- dstack/verifier/src/main.rs | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/dstack/verifier/src/main.rs b/dstack/verifier/src/main.rs index 44e29e8ba..440d7544e 100644 --- a/dstack/verifier/src/main.rs +++ b/dstack/verifier/src/main.rs @@ -92,6 +92,14 @@ fn load_config(figment: &Figment) -> Result { Ok(config) } +fn socket_addr(config: &Config) -> Result { + let ip = config + .address + .parse::() + .with_context(|| format!("invalid verifier address: {}", config.address))?; + Ok(std::net::SocketAddr::from((ip, config.port))) +} + #[post("/verify", data = "")] async fn verify_cvm( verifier: &State>, @@ -351,6 +359,10 @@ async fn main() -> Result<()> { Arc::new(AttestationVerifier::load(&config.attestation)?), )); + let addr = socket_addr(&config)?; + let listener = tokio::net::TcpListener::bind(addr) + .await + .with_context(|| format!("failed to bind {addr}"))?; let rocket_figment = Figment::from(rocket::Config::default()).merge(config_figment); rocket::custom(rocket_figment) .mount("/", rocket::routes![verify_cvm, health]) @@ -360,7 +372,7 @@ async fn main() -> Result<()> { info!("dstack-verifier started successfully"); }) })) - .launch() + .launch_on(listener) .await .map_err(|err| anyhow::anyhow!("launch rocket failed: {err:?}"))?; Ok(()) @@ -391,6 +403,10 @@ image_download_timeout_secs = 7 assert_eq!(loaded.address, "127.0.0.1"); assert_eq!(loaded.port, 18080); assert_eq!(loaded.image_download_timeout_secs, 7); + assert_eq!( + socket_addr(&loaded).unwrap(), + "127.0.0.1:18080".parse().unwrap() + ); for (name, body, expected) in [ ( From dfa31ef6a5d273ef0811af58555d0ad43c4aaced Mon Sep 17 00:00:00 2001 From: Leechael Yim Date: Fri, 28 Aug 2026 06:04:19 +0800 Subject: [PATCH 2/2] docs(verifier): use address instead of host in the config example The verifier Config field is `address`, and unknown fields are rejected. The README listed `host`, so a copied toml failed to load. --- dstack/verifier/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dstack/verifier/README.md b/dstack/verifier/README.md index 232ede636..146eac731 100644 --- a/dstack/verifier/README.md +++ b/dstack/verifier/README.md @@ -95,7 +95,7 @@ You usually don't need to edit the config file. Just using the default is fine, ### Configuration Options -- `host`: Server bind address (default: "0.0.0.0") +- `address`: Server bind address (default: "0.0.0.0") - `port`: Server port (default: 8080) - `image_cache_dir`: Directory for cached OS images (default: "/tmp/dstack-verifier/cache") - `image_download_url`: URL template for downloading OS images (default: dstack official releases URL) @@ -106,7 +106,7 @@ You usually don't need to edit the config file. Just using the default is fine, ### Example Configuration File ```toml -host = "0.0.0.0" +address = "0.0.0.0" port = 8080 image_cache_dir = "/tmp/dstack-verifier/cache" image_download_url = "https://download.dstack.org/os-images/mr_{OS_IMAGE_HASH}.tar.gz"