@@ -4,18 +4,20 @@
 
 use std::io;
 use std::pin::Pin;
-use std::sync::Arc;
+use std::sync::{Arc, OnceLock};
 use std::task::{Context, Poll};
 
 use anyhow::{anyhow, bail, Context as _, Result};
+use dstack_guest_agent_rpc::v0::AppInfo;
+use dstack_types::AppCompose;
 use hyper::body::Incoming;
 use hyper::server::conn::http1;
 use hyper::service::service_fn;
 use hyper::{Request, Response, StatusCode};
 use hyper_util::rt::tokio::TokioIo;
 use proxy_protocol::ProxyHeader;
 use rustls::version::{TLS12, TLS13};
-use serde::Serialize;
+use serde::{Deserialize, Serialize};
 use tokio::io::{AsyncRead, AsyncWrite, AsyncWriteExt, ReadBuf};
 use tokio::net::TcpStream;
 use tokio::time::timeout;
@@ -206,7 +208,7 @@ impl Proxy {
                 "/app-info" => {
                     let agent = crate::dstack_agent().context("Failed to get dstack agent")?;
                     let app_info = agent.info().await.context("Failed to get app info")?;
-                    json_response(&app_info)
+                    json_response(&public_app_info(app_info))
                 }
                 "/acme-info" => {
                     let acme_info = self.acme_info(None).context("Failed to get acme info")?;
@@ -618,6 +620,29 @@ impl AsyncWrite for MergedStream {
     }
 }
 
+/// The internal `Info` call returns the TCB info and VM config even when the
+/// app compose sets `public_tcbinfo = false`; the guest agent only withholds
+/// them on its external surface. `/app-info` is public, so withhold them here too.
+/// The choice is fixed for the CVM's lifetime, so it is decided once.
+fn public_app_info(mut info: AppInfo) -> AppInfo {
+    static TCB_INFO_PUBLIC: OnceLock<bool> = OnceLock::new();
+    if !*TCB_INFO_PUBLIC.get_or_init(|| tcb_info_is_public(&info.tcb_info)) {
+        info.tcb_info.clear();
+        info.vm_config.clear();
+    }
+    info
+}
+
+fn tcb_info_is_public(tcb_info: &str) -> bool {
+    #[derive(Deserialize)]
+    struct TcbInfo {
+        app_compose: String,
+    }
+    serde_json::from_str::<TcbInfo>(tcb_info)
+        .and_then(|tcb| serde_json::from_str::<AppCompose>(&tcb.app_compose))
+        .is_ok_and(|compose| compose.public_tcbinfo)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -659,4 +684,30 @@ mod tests {
         let (remainder, _socket) = stream.into_socket_parts();
         assert!(remainder.is_empty(), "got {remainder:?}");
     }
+
+    fn tcb_info_with_compose(extra: serde_json::Value) -> String {
+        let mut compose = serde_json::json!({
+            "manifest_version": "3",
+            "name": "gateway",
+            "runner": "docker-compose",
+        });
+        compose
+            .as_object_mut()
+            .expect("object")
+            .extend(extra.as_object().expect("object").clone());
+        serde_json::json!({ "app_compose": compose.to_string() }).to_string()
+    }
+
+    #[test]
+    fn tcb_info_is_private_when_the_compose_opts_out() {
+        let tcb_info = tcb_info_with_compose(serde_json::json!({ "public_tcbinfo": false }));
+        assert!(!tcb_info_is_public(&tcb_info));
+    }
+
+    #[test]
+    fn tcb_info_is_public_by_default() {
+        assert!(tcb_info_is_public(&tcb_info_with_compose(
+            serde_json::json!({})
+        )));
+    }
 }