Security at DockBay
Security is the first thing we design around. Splitting the control plane from your data plane gives DockBay the smallest possible trust surface — we orchestrate deploys without ever holding the keys to your servers.
Split control & data plane
Your applications run as plain Docker containers on your own machines. DockBay's cloud only orchestrates — it never becomes a dependency your production traffic flows through.
The agent dials out
Each server runs a lightweight agent that opens a single outbound, mutually-authenticated (mTLS) connection to DockBay. DockBay never connects into your box, so you don't open any inbound ports for us.
Keys never leave your server
The agent generates its private key locally; it never leaves the machine. Our database stores only public certificate fingerprints — a database dump could not be used to impersonate an agent or reach your servers.
Secrets encrypted at rest
Environment variables are encrypted with AES-GCM and enrollment tokens are stored only as hashes. We never persist your secrets in plaintext.
Isolated builds
Every build runs in an isolated, ephemeral environment. A hostile Dockerfile from one project cannot reach another tenant or the control plane, and build-time secrets are mounted transiently — never baked into the resulting image.
Tenant isolation & audit
Every action is scoped to your organization, and every command sent to an agent is recorded in an audit log — for your team's visibility and for our own security.
Responsible disclosure
Found something? We appreciate responsible disclosure — email hello@dockbay.app and we'll work with you on a fix.