Non-root containers
Containers run as UID 10001 unless you choose otherwise. Default workloads also drop Linux capabilities, block privilege escalation and get no service-account token or host mounts.
Read the detailsSecure by default, from the first deploy.
Hakopod starts every app private. It writes deny-by-default network policies, runs containers as a non-root user, encrypts secrets in the cluster and checks what you run against a signed advisory feed every hour. Opening anything up is a choice you make.
PRIVATE BY DEFAULT
Is my database exposed
Is my database exposed
to the internet?
No. Managed databases have no public endpoint, and only services you mark public get an ingress route. Everything else sits behind deny-by-default Kubernetes NetworkPolicies, and virtual networks connect apps only when you grant it. Backups are encrypted before they leave for your S3-compatible storage.
How private networking works 01 / WORKLOAD HARDENINGCONTAINERS, SECRETS, TLS, EDGE
ON BY DEFAULT, OR ONE SETTING AWAY
What does Hakopod
What does Hakopod
secure by default?
Non-root containers and encrypted secrets, masked in logs, come standard. Read-only filesystems, gVisor, external secret stores and Edge rules are one setting away, with no YAML to write.
Read-only root and gVisor
Turn on a read-only root filesystem per service and keep writable paths explicit. For stronger isolation, run services under gVisor runtime classes your operator grants.
Read the detailsEncrypted, masked secrets
Secrets are encrypted in the cluster with K3s secrets encryption and masked in logs. Values are write-only and never appear in TOML, secret lists or revision history.
Read the detailsVault, OpenBao and Infisical
Keep secrets where they already live. Self-hosted Free reads from HashiCorp Vault, OpenBao and Infisical, or generates values for you.
Read the detailsHTTPS with Let's Encrypt
cert-manager issues Let's Encrypt certificates over HTTP-01 once a custom domain is verified. You can also upload your own certificate.
Read the detailsHakopod Edge rules
Allow or deny IP addresses, rate-limit clients and apply country rules read from trusted proxy headers.
Read the details 02 / SECURITY ADVISORIESHOURLY, SIGNED FEED AND OSV.DEV
How does Hakopod
flag apps that need a security update?
Once an hour, Hakopod matches each running app's image and runtime version against published security advisories, flags the ones that are affected and puts the fix one step away.
- CHECK
Every hour, each running app's image digest and runtime version (Node, Python, Go, PHP, Ruby, Java) is matched against a signed Hakopod feed and OSV.dev.
- TELL
An affected app raises a dashboard banner, shows the advisory on its own Security page and sends a notification.
- FIX
Update or rebuild in one step, turn on auto-patching (off by default), or press Copy fix prompt to hand the fix to your coding agent.
Advisories track the image and runtime you deployed. They don't inspect OS packages, your dependencies or your source code, so keep your own tools for those.
03 / ACCESSPEOPLE, KEYS AND AGENTS
WHO CAN DO WHAT
How does Hakopod
How does Hakopod
control access?
Everyone gets their own account, every key gets a scope, and the most powerful actions need permissions nobody holds by accident.
MFA and passkeys
Every account can turn on TOTP codes and passkeys, on the Free plan. No shared admin password to pass around.
Read the detailsTeam and project roles
Invite people into teams and give each a fixed project role: administrator, developer or viewer. Teams and invitations are Free.
Read the detailsScoped, expiring keys
API keys cover one project and environment, expire, list their permissions and can be revoked at any time. Machine keys can't open container terminals.
Read the detailsExec and SQL kept apart
The admin wildcard doesn't grant pod exec or SQL. Both need their own permission, and the audit log keeps a hash of each command.
Read the detailsSSO and audit on Pro
Self-hosted Pro adds OIDC single sign-on, Google, GitHub and GitLab login, and actor audit history you can export as CSV.
Read the detailsAI agents on a short leash
Agents connect over MCP with the same scoped keys. Login, MFA and OAuth consent stay human-only, and no app or agent receives Kubernetes credentials.
Read the details 04 / SUPPLY CHAINVERIFIABLE RELEASES
Can I verify a Hakopod release
before I install it?
Yes. Every release ships with SBOMs and build-provenance attestations
you can check with gh attestation verify, and the
installer verifies checksums before it installs anything.
K3s, Helm and the Hakopod binaries are pinned and checksummed, and nothing is compiled on your server. Your own app builds run in your GitHub Actions or GitLab CI, never on the Hakopod API host. With Managed Actions (Pro, beta), each CI job runs in its own gVisor sandbox.
The code is open source under Apache-2.0, so you can audit exactly what you install.
How the installer checks itself 05 / SHARED RESPONSIBILITYKNOW WHAT YOU OWN
What do you still own
when you self-host?
Your servers. Self-hosted operators own host updates, the K3s version, storage, DNS and recovery drills. Hakopod upgrades itself with a backup first, but it doesn't upgrade K3s for you.
Network policies decide who can talk to whom; they aren't encrypted tunnels, and workloads share a kernel, so don't run hostile tenants side by side. Every Hakopod release today is an evaluation alpha. Test it on your own infrastructure before you trust it with production.
Review the operating requirements 06 / PLANSFREE, PRO AND PLANNED
WHAT'S INCLUDED
Which security features
Which security features
are free?
- Self-hosted Free
- Private networking, encrypted secrets with Vault, OpenBao and Infisical, TOTP and passkeys, teams, invitations and fixed project roles. You pay only for your servers.
- Self-hosted Pro
- OIDC single sign-on, Google, GitHub and GitLab login, actor audit history with CSV export, Slack notifications and Managed Actions (beta).
- Planned
- Custom roles and organization-wide MFA enforcement.
- Hakopod Cloud (beta)
- Signup is open. We run the dashboard and control plane; you connect your own Linux server and your apps run there. Paid checkout isn't open yet.