By default, anyone can view and use the source code and executables inside a Docker image.
There are a few ways to keep others from viewing the source code inside a Docker image and to restrict its use to authorized users only.

1. Multi-Stage Builds

This is a built-in image-building feature provided by Docker.
You can select specific files from a previous stage and copy only those into the current stage.
Files you don’t specify aren’t included in the final image, which reduces image size and keeps unnecessary files from being exposed to others.

FROM ubuntu:24.04 AS builder
WORKDIR /var/work
RUN touch secret.txt public.txt

FROM ubuntu:24.04
WORKDIR /var/work
# Copy only public.txt
COPY --from=builder /var/work/public.txt .

2. Obfuscation and DRM by File Type

As shown above, multi-stage builds let you hide a large portion of the files that would otherwise be exposed inside a Docker image.
However, because of how multi-stage builds work, any files included in the final stage remain intact.
For the final stage, you need to apply separate obfuscation and DRM techniques suited to each type of file (shell scripts, C/C++ programs, etc.).

2.1 Shell Script Obfuscation and DRM

The most widely known tool for protecting shell scripts is shc.
However, as analyzed in a previous post, shc has a critical vulnerability.
Let’s use HimitsuShell, which fixes shc’s vulnerability.

# 1. download and load docker image
curl -LO https://github.com/HimitsuShell/Himitsu/releases/download/v1.2.0/himitsu_core_v1.2.0.tar.gz
docker load -i himitsu_core_v1.2.0.tar.gz

# 2. start container
docker run --name himitsu_core -d -it himitsu_core:v1.2.0

# 3. upload your shell script (must be named launcher.sh)
docker cp launcher.sh himitsu_core:/var/work/

# 4. build and download binary (10–20 seconds)
docker exec himitsu_core /var/work/compile.sh
docker cp himitsu_core:/var/work/safeLauncher .

# 5. Run the obfuscated binary
chmod +x ./safeLauncher
./safeLauncher

2.2 Python Obfuscation and DRM

The most widely known tool for protecting Python code is Pyarmor.
Pyarmor provides features such as obfuscation and expiration-date settings.

# Install Pyarmor
pip install pyarmor

# Obfuscate the Python script
pyarmor gen foo.py

# Run the obfuscated script
python dist/foo.py

2.3 C/C++, Objective-C/C++, Swift, Rust, Zig, Kotlin/Native, etc.

LLVM-based obfuscation tools let you obfuscate a wide range of languages — C/C++, Objective-C, and more — to a level comparable to commercial tools like VMProtect and Enigma Protector.
Let’s try HimitsuObfuscator using C/C++ code as an example.

Obfuscation Tool LLVM Version License Commercial Use Maintenance Notable Points
OLLVM 4 UIUC/NCSA Allowed Discontinued in 2017 The starting point of LLVM-based obfuscation tools
Hikari Obfuscator 8 Modified AGPLv3 Allowed with restrictions Discontinued in 2020 Applied more advanced obfuscation techniques after OLLVM
Himitsu Obfuscator 17 MIT Allowed Actively maintained Fixed OLLVM bugs, expanded obfuscation coverage 
# Required: Ubuntu 24.04

# download and extract obfuscator
curl -LO https://github.com/HimitsuShell/HimitsuObfuscator/releases/download/v1.2.0_0/himitsu_obfuscator_v1.2.0_0.tar
tar -xvf himitsu_obfuscator_v1.2.0_0.tar

vim main.c
-----------------------------
#include <stdio.h>
int main() {
  printf("Hello World!\n");
  return 0;
}
-----------------------------

# builds a binary that runs on any linux (static musl)
sudo apt-get install -y build-essential
./compiler/bin/x86_64-unknown-linux-musl-clang -flto -fuse-ld=lld -mllvm -sobf -mllvm -sub -static main.c -o main
./main

Conclusion

Applying the methods above in layers can block most source code theft attempts by beginners, like script kiddies.
For a skilled reverse engineer, though, these methods only slow down and complicate the attack — they don’t make it impossible.
So on top of the methods above, you’ll need to keep applying various stronger techniques as well.

I’ll cover additional methods in the next post.