Infrastructure Security
We follow established cloud security practices, and the code that implements them is public in our GitHub repository.- Compute: We use Linux KVM for full virtualization and Cloud Hypervisor as our virtual machine monitor (VMM). Each VMM instance runs inside its own Linux namespaces for isolation. The control plane communicates with bare metal hosts over SSH.
- Block Storage: Virtual disks are provided by ubiblk, our open source vhost-user block backend, and are encrypted at rest. We use envelope encryption: each volume has its own data encryption key (DEK), which is itself encrypted with a key encryption key (KEK) held by the control plane. A compromised host alone is not enough to decrypt customer data. See our blog post for details.
- Virtual Networking: Traffic between VMs in a private subnet travels over IPsec tunnels, and tunnel keys are rotated daily. Each customer’s VMs operate in their own networking namespace.
- Firewalls: Firewalls are stateful ingress filters implemented with Linux nftables. Traffic initiated by a VM and its return traffic is always allowed. To minimize initial setup, the default firewall attached to a new private subnet allows all inbound traffic; we recommend restricting it to the ports and sources you need. See Firewalls. Managed PostgreSQL databases allow inbound traffic on the PostgreSQL port (5432) and the connection pooler port (6432) by default, and SSH only from Ubicloud’s control plane.