Security model
Smallcloud's core bet: small software becomes safe to ship constantly when the platform makes the safe path the only path.
No unauthenticated app URLs
An auth proxy fronts every app route. No session → sign-in wall; valid session but no role → 403. Magic-link tokens and session tokens are random 256-bit values, single-use where applicable, stored only as SHA-256 hashes, delivered over HTTPS with HttpOnly; Secure; SameSite=Lax cookies. Auth endpoints are rate-limited per client IP.
Every app is sandboxed
- All Linux capabilities dropped; privilege escalation disabled (
no-new-privileges). - Read-only root filesystem; writes only to a 64 MiB noexec
/tmpand the quota'd/datavolume. - Zero network egress by default: apps run on an internal network with no route out — no DNS, no IP. Build-time installs are the only unrestricted network moment. Owners can grant an explicit per-app hostname allowlist, served through an authenticated forward proxy that refuses (and audits) everything else — deny-by-default even when egress is on.
- Hard caps: 0.5 CPU, 256 MiB memory (no swap), 256 processes.
- Non-root users inside every container, including Smallcloud's own services.
Isolation between apps
Apps can't read each other's data (separate volumes), and per-app roles are enforced on every request: owners and editors get all methods, viewers get read-only, everyone else gets nothing.
Platform hygiene
- Audit trail: deploys, deletes, shares, sign-ins, and logouts recorded with actor and subject (
smallcloud audit). - Security headers: HSTS on every response; strict CSP, frame denial, and nosniff on all Smallcloud pages.
- Backups: nightly database snapshot + per-app volume archives, 7-day retention, tested restore path.
- Self-verification:
smallcloud doctorchecks and heals the installation.
What about this website?
This site is the one deliberately public surface — static marketing and docs with no user data, running in the same hardened container regime as everything else. Deployed apps are never public.