Security in cloud platforms is often an afterthought — something you bolt on after the fact with firewalls, WAFs, and compliance checklists. At Runix, security is not a feature. It is the foundation everything else is built on.
Container Hardening
Every container deployed on Runix runs with a hardened security profile. We do not rely on Docker defaults — we explicitly configure the security boundary for every deployment.
- All Linux capabilities are dropped, then only the minimum required set is re-added
- Containers run as non-root (UID 1000) — even if your Dockerfile does not specify a USER
- no-new-privileges flag prevents privilege escalation via setuid binaries
- Resource limits are enforced: memory, CPU, and process count per container
- OOM kill protection is disabled — containers that exceed limits are terminated cleanly
- Temporary filesystems are mounted with noexec to prevent code execution from /tmp
Network Isolation
Each deployment gets its own Docker network. Containers cannot see or communicate with other customers' workloads. Database services are only reachable from within their deployment's network — they are never exposed to the public internet.
Connection strings for PostgreSQL, Redis, and Kafka are automatically scoped to the deployment's private network.
Automatic TLS
Every deployment on Runix is served over HTTPS with a valid TLS certificate. Certificates are provisioned and renewed automatically — no DNS challenges, no Let's Encrypt scripts, no manual intervention. Custom domains get their own certificates with the same zero-effort experience.
Secret Management
Environment variables marked as secrets are encrypted at rest in the database. They are injected into containers at runtime and never appear in build logs, image layers, or API responses. The frontend masks secret values and only transmits them when explicitly edited.
Infrastructure Security
The Runix platform itself is built in Rust, which eliminates entire classes of vulnerabilities — buffer overflows, use-after-free, data races. Our API server enforces authentication on every protected route, rate limits requests per IP, and validates webhook signatures cryptographically. Stripe webhook payloads are verified before any billing state is modified.
Our Commitment
We believe that security should not be a premium feature. Every plan — including the free Hobby tier — gets the same security hardening. Your code runs in the same hardened environment whether you are a solo developer experimenting with a side project or a business running production workloads.