How to secure containerized python source code deployed at client side cloud

Question

How can we secure a source code which is deployed at client side cloud and is difficult to reverse engineer just like a licensed product The major difference is that I have a service to protect and do not have exe or dmg file.

I want to obfuscate the code deployed at the client side which was an internal API service till now but will be white-labelled and deployed away from my access. The usual methods to obfuscate isn't the ones feasible to opt for an always evolving code. The deployment needs to be scalable, updatable which is why container tech is preferred. However, container security is not my forte and I have read from different blogs that it involves user access management only which cannot 100% guarantee security.

Answer 1

Accept that you can't do it...

If you deploy a container (that needs to be accessible and re-bootable by the client, 101 times out of 100) then the container's contents is at the complete mercy of whatever containerization technology will have been adopted.

Either you can trust your client, or you cannot. If you cannot, then nothing stops them from cloning the container and either access its storage (if unencrypted; but if you encrypt it, you'll have to be available at each reboot) or pin the container memory and read the source off it. Almost always, the latter approach is available even without cloning, and containerization technology means that the application is not aware of what is happening, and has no way of detecting or stopping it.

All protection schemes in these cases rely on something that the client has not access to. You need to ask, "is there something - before I give them the container - that the client has not access to?". If the answer is "No", then you can stop right there (if it is "Yes", then you need to ask, "and do I have access to that?"). Hardware keys, for example, is something the client hasn't access to. External keyservers are also something they don't have access to. Third-party PAAS services also. Android "secure space", to a large extent. So, what you ask can be done in principle, but very probably, not in your scenario.

...and move on.

Now, unless you're doing "jobsecurity through obscurity", there's an overwhelming chance that your code will be something complex, probably difficult to maintain for somebody unfamiliar with it, and will contain nothing embarrassing or unprofessional.

So, your target becomes simply to be cheaper than just stealing your work. This can be done in several ways, starting from making it clear than stealing from you now will mean not simply renouncing to the next few fixes (which someone might be willing to accept), but to any and all maintenance. This you can do by calculating e.g. the hashes of your code units, and verifying them to ensure they haven't been tampered with -- in which case you will charge for the restoration or for your reverse engineering any changes.

Answer 2

Unless you do this in a SaaS fashion, your software cannot be protected.

If the client have access to your software, no matter if encoded, obfuscated or encrypted, this client CAN decode/deobfuscate/decrypt it. That's not a question of if, but when. That's a tradeoff between time and money. If it's lucrative to them to crack your defenses, they will.

You mention private API. And that means the client could proxy all requests from the container, and deduce the methods used for your API. Depending on how your software is built, the client does not even need access to the container.