Security

How your apps are kept apart from everybody else's, how secrets are kept, and how to protect your account.

CloudJod runs code from many organizations on shared machines, so it is built on the assumption that some of that code is hostile. This page explains what keeps your apps and data apart from everybody else's, and what you can do to protect your own account.

Your apps, kept apart

• A sandbox for every workload. Every app, database, build and command runs under gVisor, a kernel of its own between your code and the machine. Code that breaks out of its container meets gVisor, not the host. An app's Isolation tab shows this.
• Its own users. Each organization's containers run as a range of user IDs no other organization shares, so even a shared file would not be readable across them.
• Its own network. Each organization has a private network of its own. Other organizations cannot reach your apps or databases except through their public addresses, and databases have none.
• Its own share of the machine. CPU and memory are hard limits for each copy of an app, so a busy neighbour cannot slow yours down.
• No mail servers. Apps cannot send mail directly on port 25, the usual first move of compromised code. Send mail through a mail provider's API or submission port instead.
• Pinned software. Every release records the exact image it runs, so what is running cannot change without a new release.

Secrets

• Sealed settings, database passwords, repository webhook secrets, provider keys and similar are encrypted with your organization's own keys before they are stored.
• A sealed value is never shown again, to anybody, through the dashboard or the API. To change one, set it again.
• The audit log records that a secret changed, never its value. An owner deciding on somebody's waiting change sees it with every secret masked.
• Builds start from a clean copy of your code, with no access to the platform's own credentials.

Traffic

• Every app's address, and every domain of your own once it is verified, is served over HTTPS with a certificate issued for it automatically.
• An app can be team only (people must sign in to CloudJod as members of your organization) or private (not on the internet at all; reached by your other apps and your team's VPN devices).
• The dashboard and the API take your credentials only in a request header, never in a cookie, so another website cannot make your browser act for you.

Your account

• Use a long password: at least twelve characters, and one you use nowhere else.
• Turn on two-factor sign-in under Account, with any authenticator app. Keep the recovery codes somewhere safe: each works once, in place of a code.
• Check your sessions. Account lists every place you are signed in, and signs any of them out. Changing your password signs out every session.
• Give people the least they need. A role, areas, and approval of their changes by an owner are described in Teams and access.
• Give scripts their own token, and revoke it when the script is retired. A token acts as the person who made it, never above their role.

Next: The CLI and the API