vastai-security-basics

# Vast.ai Security Basics ## Overview Security best practices for Vast.ai API keys, SSH access to GPU instances, data protection on rented hardware, and credential management. Vast.ai instances run as root on shared hardware, requiring careful attention to data lifecycle. ## Prerequisites - Vast.ai account with API key - Understanding of SSH key management - Secrets manager available (optional but recommended) ## Instructions ### Step 1: API Key Management ```bash # Never commit API keys to git echo '.vast_api_key' >> .gitignore echo '.env' >> .gitignore # Use environment variables, not files in repos export VASTAI_API_KEY="$(vault kv get -field=api_key secret/vastai)" # Rotate keys periodically at cloud.vast.ai > Account > API Keys ``` ```python # Fail fast on missing credentials import os def get_api_key(): key = os.environ.get("VASTAI_API_KEY") if not key: key_file = os.path.expanduser("~/.vast_api_key") if os.path.exists(key_file): key = open(key_file).read().strip() if not key: raise ValueError("VASTAI_API_KEY not set and ~/.vast_api_key not found") return key ``` ### Step 2: SSH Key Security ```bash # Generate a dedicated key pair for Vast.ai instances ssh-keygen -t ed25519 -f ~/.ssh/vastai_key -C "vastai-instances" -N "" # Upload public key at cloud.vast.ai > Account > SSH Keys # Use the dedicated key for connections ssh -i ~/.ssh/vastai_key -p PORT root@HOST ``` ### Step 3: Data Protection on Shared Har...