cryptship | Part 3 — An Honest Threat Model, and the Hardening That Raises the Cost

Every "protect your code" product has to answer one question honestly: what about root? This part is cryptship's answer.

🧱 Where the line is

The image on disk is ciphertext. But once your app runs, its plaintext is in the container's memory, and root on the host can read that memory. No user-space trick changes that. Only two things truly do:

1. a confidential-compute key provider (SEV-SNP or TDX with attestation), or
2. keeping the crown-jewel logic server-side.

Everything else in cryptship raises the cost. We would rather say that plainly than sell you a lock that is not there.

🔧 Three ways cryptship raises the cost

1. Ship compiled code, not source

cryptship pack --transform-cmd "<your toolchain>" …

The transform runs over a copy of your app before it is encrypted. A memory dump then recovers compiled artifacts instead of readable source, which matters a lot when the attacker has AI tools that are good at reconstructing source. The repo includes a Python-bytecode recipe (scripts/compile-python.sh); swapping in Nuitka for native code is a one-line change. scripts/demo-compiled.sh shows the difference.

2. Harden the runtime

• The loader marks itself non-dumpable.
• Run the container non-root, with dropped capabilities, a read-only root filesystem, a tmpfs for the decrypted app, and the seccomp profile from deploy/.

That stops other non-root users in the container from reading the app. It does not stop code running as the app's own user, or container root, which can read the decrypted files, and it does not stop root on the host.

3. Watermark every license

The loader writes .cryptship-manifest.json and exposes CRYPTSHIP_LICENSE_ID and CRYPTSHIP_CUSTOMER to your app. If an instance leaks, it traces back to its licensee. That is a deterrent, not a lock: a determined attacker can strip it.

✅ What it does guarantee

• Nobody can read your source with docker save and tar.
• Moving a license to another machine, or editing its bound claims, breaks decryption. The signature and expiry are checked by the loader.
• With the online provider, a revoked license fails on its next start.

🗺️ Roadmap

• Real SEV-SNP / TDX attestation and a verifying key broker
• Stronger machine binding: TPM sealing and cloud instance identity

If you work on confidential computing and want to help, we would love to hear from you.

🔗 cryptship

• 🐙 GitHub: github.com/AI2TH/cryptship (GPLv3)
• 📦 Release: v0.1.0
• 📚 Docs: HOWTO · Architecture · Diagrams
• 🌐 Website: ai2th.github.io/cryptship.html
• 💬 Discussion: AI2TH Google Group