cryptship — Ship Encrypted, License-Gated Code Inside Docker Images

The problem

A Docker image ships your code in the clear. Anyone with the image can do this:

docker save your/app:latest -o app.tar
tar -xf app.tar   # unpack the layers and read everything

For interpreted languages such as Python, Node or Ruby, that means your entire source. If you sell software that customers run on their own servers, air-gapped networks or private clouds, that is a problem.

What cryptship does

cryptship ships your application encrypted, with a thin loader that decrypts and runs it only when a valid license is present.

• One tool, one license format
• Three deployment modes: air-gapped, on-prem and cloud
• Written in Go, licensed GPLv3, first release v0.1.0

The 30-second version

Build time (you):

1. cryptship keygen: an Ed25519 signing keypair, once
2. cryptship pack: encrypt your app directory with a random key (AES-256-GCM) into payload.enc
3. cryptship issue: a signed license that wraps that key to a machine, a pool of machines, or nothing
4. Build an image with the loader, payload.enc, the license and your public key. No source, no content key.

Run time (customer): the loader verifies the license, checks expiry and revocation, derives the key, decrypts into tmpfs and execs your app.

An honest promise

Code that runs on hardware the customer controls can never be made perfectly extraction-proof: at some instant the plaintext is in memory. cryptship is not DRM snake oil. It makes casual copying impossible and makes serious reverse engineering cost more than a license. Part 3 is all about where that line is.

Try it

You need Docker, plus python3 for the demo's tamper step; the tools compile in a Go container.

git clone https://github.com/AI2TH/cryptship && cd cryptship
bash scripts/demo.sh

The demo packs a small Python app, issues a license and builds the image. It then docker saves the image, unpacks it and searches it for the source (it is not there), runs it to show it works, and tampers with the license to show the loader refuse it.

The series

1. Part 1: binding the decryption key to the license and the machine
2. Part 2: air-gapped, on-prem and cloud with one loader and three key providers
3. Part 3: an honest threat model, and the hardening that raises the cost

🔗 cryptship

• 🐙 GitHub: github.com/AI2TH/cryptship (GPLv3)
• 📦 Release: v0.1.0
• 📚 Docs: HOWTO · Architecture · Diagrams
• 🌐 Website: ai2th.github.io/cryptship.html
• 💬 Discussion: AI2TH Google Group