nShield Containers v13.9.9 User Guide

nShield Containers enables application developers to access the cryptographic functionality of an nShield Connect HSM in a container-based environment. This release has been tested with Docker.

One container runs the hardserver. It is supplied with configuration to connect to one or more network HSMs. It exposes the hardserver via an AF_UNIX socket.

Access to the hardserver socket must be restricted to trusted users.

Application instances are containers that run applications using the nShield software stack. These applications are supplied with the socket used to connect to the hardserver and access to the Security World key management data files and the associated cryptographic keys.

The key management data files, including encrypted copies of keys, are located in NFAST_KMLOCAL. A container that mounts NFAST_KMLOCAL as a volume can spoof the nShield Connect client. Therefore, access to files in NFAST_KMLOCAL must be restricted to trusted users.