Built to be secure by default.
Every DevSpace container runs inside hardened Docker isolation, behind 92 Tbps DDoS scrubbing, with zero shared memory between workloads. Security isn't a feature — it's the foundation.
Seven layers.
One secure container.
DevSpace wraps every container in a layered security model — from edge-level DDoS scrubbing all the way down to kernel-level restrictions inside Docker. Each layer operates independently so a breach in one never compromises another.
Explore container isolationHardened Docker.
Zero compromise.
Every DevSpace container runs under a strict Docker security profile — not the defaults. We drop all Linux capabilities and add back only what's strictly necessary. No shared IPC. No shared PID namespace. No privilege escalation paths.
Seccomp + AppArmor profiles. A custom syscall allowlist blocks all non-essential kernel calls. AppArmor further restricts filesystem access at the OS level.
Read-only root filesystem. The base container layer is mounted read-only. Only designated writable volumes can be written to — no silent filesystem tampering.
PID limit enforcement. Each container is hard-capped on the number of processes it can spawn, preventing fork bombs and runaway process trees.
no-new-privileges flag. Processes inside the container can never gain more privileges than they started with — setuid binaries are silently ignored.
Network isolation.
Containers can't see each other.
Each container gets its own private Docker bridge network. There is no shared network interface, no inter-container routing, and no broadcast domain. Your workload is invisible to every other tenant on the platform.
Per-container bridge network. A dedicated virtual network interface is created for each DevSpace. Containers on the same physical host cannot communicate by default.
Egress filtered at host. Outbound traffic rules are enforced at the host iptables level, not just inside the container — so they can't be bypassed even with root inside Docker.
Port forwarding is explicit-only. No ports are exposed by default. You forward only what you choose, and each forwarded port goes through DDoS scrubbing before reaching your container.
92 Tbps scrubbing capacity. Every forwarded port, every container — absorbed and filtered before it reaches your workload.
Volumetric attack absorption. SYN floods, UDP amplification, ICMP floods — all absorbed at the edge before packets reach your container's IP.
Layer 3/4 filtering. Malformed packets, spoofed source IPs, and invalid TCP states are dropped at line rate by hardware filtering appliances at each PoP.
Game-server grade. UDP port forwarding is fully supported — with the same DDoS protection as TCP. Ideal for Minecraft, voice servers, and real-time apps.
Real-time audit.
Every event logged.
Security events are captured from container start to shutdown — capability changes, network rule activations, DDoS events, and privilege escalation attempts are all logged in real time.
Startup attestation. Every security control is verified at container boot. If a profile fails to load, the container doesn't start.
Privilege escalation detection. Any attempt to gain elevated privileges is logged and silently denied before it reaches the kernel.
DDoS event visibility. When an attack is absorbed, you see it — attack volume, duration, and scrubber status — in your container log.
Every container, fully covered.
No add-ons. No security tiers. Every feature below applies to every DevSpace — free or paid.
Full Container Isolation
Each DevSpace runs in its own Docker container with private PID, network, mount, and user namespaces. No process or file can leak between containers on the same host.
92 Tbps DDoS Protection
All forwarded ports — TCP and UDP — are routed through high-capacity DDoS scrubbing infrastructure. Volumetric floods are absorbed at the edge before reaching your IP.
TLS 1.3 Everywhere
Domain-mapped ports get auto-provisioned TLS certificates. All web traffic is encrypted in transit. Certificates are renewed automatically — zero maintenance.
Seccomp & AppArmor
A custom seccomp filter restricts the syscalls containers can invoke. AppArmor profiles further constrain filesystem and network access at the OS kernel level.
Capability Restriction
All Linux capabilities are dropped by default. Only the minimum required capabilities are granted. setuid and setgid binaries cannot escalate privileges inside the container.
IP Whitelisting & Firewall
Lock any forwarded port to specific IP addresses or CIDR ranges. Rules take effect instantly at the edge — not inside the container where they could be bypassed.
cgroup Resource Limits
CPU, RAM, and PID counts are enforced by Linux cgroups at the host level. A runaway process inside your container cannot affect other containers or the host system.
Read-Only Root FS
The base container filesystem is mounted read-only. Persistent data lives on isolated volumes. Silent filesystem modification by compromised processes is structurally impossible.
Encrypted at Rest
Container volumes and persistent storage are encrypted at rest using AES-256. Disk images cannot be read without the per-container encryption key, which never leaves our KMS.
Kernel namespaces.
Total process separation.
Namespaces are Linux's foundational isolation primitive — and Docker uses all of them. Each DevSpace container gets its own isolated view of PIDs, networking, mounts, hostname, user IDs, and IPC. What happens inside stays inside.
Granular access control.
Share safely.
When you share a DevSpace with a collaborator, you decide exactly what they can touch. File manager access, terminal access, and port visibility are all individually scoped — not all-or-nothing.
Role-based collaboration. Grant read-only, file-only, terminal-only, or full access to each collaborator independently.
Session-scoped tokens. Collaboration links expire. Sessions are token-bound and cannot be replayed after expiry.
Instant revocation. Remove a collaborator's access at any time — their session is terminated within seconds, no container restart needed.
Secure infrastructure.
Zero effort.
Every security feature on this page is active by default in every DevSpace — no configuration needed.
Security
questions
No. Kernel namespaces give each container an isolated view of the system. Containers on the same physical host operate in completely separate PID, network, and mount namespaces — they are invisible to each other by design.
No. We use user namespace remapping so the root user inside your container maps to an unprivileged UID on the host. Combined with no-new-privileges and dropped capabilities, there is no privilege escalation path to the host kernel.
Yes. Container volumes and persistent storage are encrypted at rest with AES-256. The encryption keys are managed by our KMS and are never accessible from within the container itself.
Yes. Port Manager supports TCP, UDP, or both on any port. UDP forwarding goes through the same 92 Tbps DDoS scrubbing as TCP — game-server attacks are fully absorbed.
The DDoS scrubber absorbs the attack at the edge before it reaches your container IP. Your workload continues running unaffected. The event is logged in your container audit log so you can see exactly what happened.
No. Permissions are allowlist-based — collaborators only have access to the capabilities you explicitly grant. Terminal, file manager, ports, and container restart are each individually scoped.
The base profiles cannot be weakened — they are enforced at the host level. However you can request additional capability grants for specific use cases through our support channel.
Yes. Domain-mapped ports get auto-provisioned TLS certificates (Let's Encrypt or custom). All inbound traffic is TLS 1.3 terminated before it reaches your container. Certificates renew automatically.