Protecting the Crown Jewels: Securing Source Code in Containerized Applications

package main

import (
 "crypto/sha256"
 "encoding/hex"
 "fmt"
 "log"
 "net/http"
 "os"
 "time"
)

// Secret business logic - this will be compiled and not visible in the container
const (
 secretKey       = "my-super-secret-algorithm-key-2024"
 licenseCheckURL = "internal-license-server"
)

// ProprietaryAlgorithm represents our "secret sauce"
type ProprietaryAlgorithm struct {
 secretSalt string
 iterations int
}

// NewAlgorithm creates a new instance with proprietary settings
func NewAlgorithm() *ProprietaryAlgorithm {
 return &ProprietaryAlgorithm{
  secretSalt: secretKey,
  iterations: 10000,
 }
}

// ProcessData applies our proprietary algorithm
func (pa *ProprietaryAlgorithm) ProcessData(input string) string {
 // This is our "secret" business logic
 result := input + pa.secretSalt
 for i := 0; i < pa.iterations; i++ {
  hash := sha256.Sum256([]byte(result))
  result = hex.EncodeToString(hash[:])
 }
 return result
}

// ValidateLicense checks if the application is properly licensed
func ValidateLicense() bool {
 // Simulated license validation
 licenseKey := os.Getenv("LICENSE_KEY")
 if licenseKey == "" {
  log.Println("Warning: No license key provided")
  return false
 }

 // In production, this would call a license server
 expectedHash := "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
 hash := sha256.Sum256([]byte(licenseKey))
 actualHash := hex.EncodeToString(hash[:])

 return actualHash == expectedHash || licenseKey == "DEMO-LICENSE-KEY"
}

func healthHandler(w http.ResponseWriter, r *http.Request) {
 w.WriteHeader(http.StatusOK)
 fmt.Fprintf(w, `{"status":"healthy","timestamp":"%s"}`, time.Now().Format(time.RFC3339))
}

func processHandler(algo *ProprietaryAlgorithm) http.HandlerFunc {
 return func(w http.ResponseWriter, r *http.Request) {
  if r.Method != http.MethodPost {
   http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
   return
  }

  input := r.URL.Query().Get("data")
  if input == "" {
   http.Error(w, "Missing 'data' parameter", http.StatusBadRequest)
   return
  }

  // Apply our proprietary algorithm
  result := algo.ProcessData(input)

  w.Header().Set("Content-Type", "application/json")
  fmt.Fprintf(w, `{"input":"%s","processed":"%s","algorithm":"proprietary-v1"}`, input, result)
 }
}

func main() {
 // Validate license on startup
 if !ValidateLicense() {
  log.Println("Running in DEMO mode - some features may be limited")
 } else {
  log.Println("License validated successfully")
 }

 // Initialize our proprietary algorithm
 algo := NewAlgorithm()

 // Setup HTTP server
 http.HandleFunc("/health", healthHandler)
 http.HandleFunc("/process", processHandler(algo))

 port := os.Getenv("PORT")
 if port == "" {
  port = "8080"
 }

 log.Printf("Starting Go secure application on port %s", port)
 log.Printf("Endpoints: /health (GET), /process (POST)")

 if err := http.ListenAndServe(":"+port, nil); err != nil {
  log.Fatal(err)
 }
}

// Made with Bob

# Multi-stage build for Go application
# Stage 1: Build the application
FROM golang:1.21-alpine AS builder

# Set working directory
WORKDIR /build

# Copy go mod files
COPY go.mod ./

# Download dependencies
RUN go mod download

# Copy source code
COPY main.go ./

# Build the application with optimizations
# -ldflags="-s -w" strips debug information and symbol table
# CGO_ENABLED=0 creates a static binary
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build \
    -ldflags="-s -w -X main.buildTime=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
    -trimpath \
    -o secure-app \
    main.go

# Stage 2: Create minimal runtime image
# Using distroless for maximum security - no shell, no package manager
FROM gcr.io/distroless/static-debian11:nonroot

# Copy only the binary from builder
COPY --from=builder /build/secure-app /app/secure-app

# Use non-root user (already set in distroless/static:nonroot)
# UID 65532 is the nonroot user

# Expose port
EXPOSE 8080

# Set working directory
WORKDIR /app

# Run the application
ENTRYPOINT ["/app/secure-app"]

# Benefits of this approach:
# 1. Source code is NOT in the final image
# 2. No build tools in the final image
# 3. No shell access (distroless)
# 4. Minimal attack surface
# 5. Binary is stripped of debug symbols
# 6. Non-root user for security
# 7. Image size is minimal (~2MB for Go binary + ~2MB for distroless base)

"""
Secure Python Application with Proprietary Algorithm
This code will be obfuscated before containerization
"""

import hashlib
import os
import time
from flask import Flask, request, jsonify

# Secret proprietary constants - will be obfuscated
SECRET_KEY = "python-proprietary-algorithm-2024"
ITERATIONS = 8000


class ProprietaryAlgorithm:
    """
    Our secret business logic class
    This will be obfuscated to protect intellectual property
    """

    def __init__(self):
        self.secret_salt = SECRET_KEY
        self.iterations = ITERATIONS
        self._internal_state = self._initialize_state()

    def _initialize_state(self):
        """Internal initialization - will be obfuscated"""
        return hashlib.sha256(self.secret_salt.encode()).hexdigest()

    def _apply_transformation(self, data: str, iteration: int) -> str:
        """
        Proprietary transformation logic
        This is our "secret sauce" that will be protected
        """
        combined = f"{data}{self._internal_state}{iteration}"
        return hashlib.sha256(combined.encode()).hexdigest()

    def process_data(self, input_data: str) -> str:
        """
        Main processing method with proprietary algorithm
        Multiple iterations make reverse engineering harder
        """
        result = input_data + self.secret_salt

        # Apply our secret transformation multiple times
        for i in range(self.iterations):
            result = self._apply_transformation(result, i)

        return result


class LicenseValidator:
    """License validation logic - will be obfuscated"""

    @staticmethod
    def validate():
        """Check if application is properly licensed"""
        license_key = os.getenv('LICENSE_KEY', '')

        if not license_key:
            print("Warning: No license key provided - running in DEMO mode")
            return False

        # Simulated license validation
        expected_hash = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
        actual_hash = hashlib.sha256(license_key.encode()).hexdigest()

        is_valid = actual_hash == expected_hash or license_key == "DEMO-LICENSE-KEY"

        if is_valid:
            print("License validated successfully")
        else:
            print("Invalid license - some features may be limited")

        return is_valid


# Initialize Flask app
app = Flask(__name__)

# Initialize our proprietary algorithm
algorithm = ProprietaryAlgorithm()

# Validate license on startup
license_valid = LicenseValidator.validate()


@app.route('/health', methods=['GET'])
def health_check():
    """Health check endpoint"""
    return jsonify({
        'status': 'healthy',
        'timestamp': time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime()),
        'licensed': license_valid
    })


@app.route('/process', methods=['POST'])
def process_data():
    """Process data using our proprietary algorithm"""
    data = request.args.get('data')

    if not data:
        return jsonify({'error': 'Missing "data" parameter'}), 400

    # Apply our proprietary algorithm
    result = algorithm.process_data(data)

    return jsonify({
        'input': data,
        'processed': result,
        'algorithm': 'python-proprietary-v1'
    })


@app.route('/')
def index():
    """Root endpoint"""
    return jsonify({
        'service': 'Secure Python Application',
        'endpoints': {
            '/health': 'GET - Health check',
            '/process': 'POST - Process data (requires ?data=value)'
        }
    })


if __name__ == '__main__':
    port = int(os.getenv('PORT', 8080))
    print(f"Starting Python secure application on port {port}")
    print(f"Endpoints: /health (GET), /process (POST)")

    # Run with production settings
    app.run(host='0.0.0.0', port=port, debug=False)

# Made with Bob

FROM python:3.11-slim AS builder

RUN apt-get update && apt-get install -y \
    gcc \
    && rm -rf /var/lib/apt/lists/*

WORKDIR /build

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY app.py .

RUN pyarmor gen -O dist app.py

RUN echo "Flask==3.0.0" > dist/requirements.txt && \
    echo "Werkzeug==3.0.1" >> dist/requirements.txt

FROM python:3.11-slim

WORKDIR /app

COPY --from=builder /build/dist/requirements.txt .

RUN pip install --no-cache-dir -r requirements.txt && \
    rm requirements.txt

COPY --from=builder /build/dist/ .

RUN useradd -r -u 1001 appuser && \
    chown -R appuser:appuser /app

USER appuser

EXPOSE 8080

ENV PYTHONUNBUFFERED=1
ENV PORT=8080

CMD ["python", "app.py"]