ContainerOS
Signed Container Distribution
+ License Authority
Customer-deployed products fail security review without signed images. Multi-tenant deployment fails operationally without a license server. ContainerOS is the deployment surface — cosign-signed container packaging, per-tenant license validation, and a revocation path that actually works.
What It Does
Four primitives for shipping software you don't operate.
Replaces the homegrown distribution scripts that don't survive an enterprise security review. Built for the case where the customer runs the container and Mahoosuc Solutions retains operational control.
Cosign-based image signing
Every image published through ContainerOS is signed via cosign with keys held by ContainerOS itself, not your laptop. Customer-side cosign verify proves the image came from us and hasn't been tampered with — the bare minimum for any enterprise security review of a deployed container.
Per-tenant Docker bundling
A single product (e.g. ContentStudio) ships as a per-tenant bundle with the right service set, the right env-var seed, and the right license fingerprint baked in. No "deploy and configure" step on the customer side — what they pull is what they run.
License Authority Service (LAS)
A live, queryable license server. Containers check in at startup and periodically, validating tenant + product + seat-count against the authority. Time-boxed licenses, seat limits, and feature flags all live here. The customer's network can call out; nobody calls in.
Revocation that actually works
If a customer churns or a license is misused, LAS revokes the entitlement and running containers stop honoring it within the next check-in window. No more "the license file is sitting on a server we don't control any more." Revocation is logged and auditable on both sides.
How It Works
Build → Sign → Distribute → Validate.
Build per-tenant image
A product image (e.g. contentstudio:1.4.2) is rebuilt as a per-tenant variant with the tenant's license fingerprint baked in. The base image is shared; the tenant-specific layer is small.
Sign with cosign
The image is signed with ContainerOS's keys. The signature lives alongside the image in the registry. cosign verify on the customer side proves provenance.
Distribute via registry
Customer pulls from mos-registry/<product>:<version>. The pull credentials are scoped per tenant and rotated on cadence. No long-lived credentials on the customer side.
Validate on start + heartbeat
Container start verifies the cosign signature, then calls LAS to validate the tenant + product + seat limit. Periodic heartbeats keep the license fresh; revocation propagates within the heartbeat window.
Built honestly
License Authority Service deployed, cosign verified, Prometheus scraping containeros_las_* — and two things we haven't shipped yet
ContainerOS is in early access today: the License Authority Service runs in production, every published image is cosign-signed, and the LAS exports tenant-scoped license-validation metrics already labeled with org_id. Two gaps remain on the honest punch list.
1. SuperTokens auth is not yet wired on the LAS API itself (audit P0 #4). Internal customer-deployment flows are fine; before we expose the LAS as a multi-tenant SaaS surface, this lands. Tracked in epic #44.
2. The per-product Grafana dashboard is not yet provisioned (audit P2 #11). The metrics are flowing — license validations per result, license operations per op+result, HTTP request shape — but the customer-facing operational view is the next milestone.
We'd rather tell you what's not done than rebrand work-in-progress as polish.
Customer-deployed software needs an authority server.
ContainerOS is that.
Currently powering signed deployments for Mahoosuc product customers. Talk to us if you're shipping software to environments you don't control.
N/A