Understanding a LockFlare server

A LockFlare server is an appliance, not a computer you keep. Treat it as disposable from the day you register it — because the moment you seal one, disposability stops being a convenience and becomes the only recovery path that exists.

Read this before you seal anything. A sealed server whose engine stops responding cannot be recovered. Not by SSH, not by console, not by the hosting provider, not by us. The machine is finished and the only answer is to build another one.

Why the constraint exists

It is not a limitation of the implementation. It follows directly from what the product is for.

LockFlare’s central claim is that your source is unreadable on the server. RAM-only execution gets most of the way there: nothing readable is written to disk. What it cannot stop is someone with root on a running machine attaching to the process and reading its memory. That is the honest ceiling of every software-only approach.

Enclave closes that gap by removing every interactive login path — SSH, console, KVM, IPMI, an attached keyboard. There is no shell to get root in, so there is no session from which to dump memory. That is the whole point, and it works.

But a machine with no way in has no way in for you either. A recovery channel that survived sealing would be a recovery channel an attacker could use, so it does not exist. The security property and the lockout are the same property, seen from two sides.

What happens when a sealed server fails

Situation	Can you get back in?
Sealed, engine healthy	Yes. Unseal from Cipher — it is authorized through the engine, which is running.
Sealed, engine crashed but the service manager restarts it	Yes. The engine comes back and the unseal path comes back with it. This is why a managed service is mandatory.
Sealed, engine dead and nothing restarts it	No. No SSH, no console, no rescue boot. Rebuild the server.
Sealed, a service the engine depends on has failed	No. Same outcome — unsealing needs the engine responding.
Not sealed, anything at all	Yes. SSH still works. This is the state to be in while you are still setting things up.

Why this is survivable

Losing a server sounds severe until you look at what is actually on it. A LockFlare host holds the engine binary, a licence file, and encrypted artifacts it can fetch again. There is no application source, no build output, no database, no writable web root, no state that exists only there.

So the recovery is: provision a machine, install the engine, apply a licence, push. Every project is back and serving within minutes, and nothing was restored because nothing was lost.

That is the trade. You accept that a server can become unrecoverable, and in exchange an unrecoverable server costs you fifteen minutes instead of a weekend.

The contract, as Cipher states it

Registering a server asks you to acknowledge five things. They are not boilerplate — each one is a precondition for the paragraph above being true.

You confirm	Because
This will be a dedicated LockFlare server. It runs the engine and nothing else — no second application, no web server of your own, no background workloads.	Anything else on the box is something you would lose, and something you would need a shell to fix.
This server does not contain any database engine. MongoDB, PostgreSQL, MySQL, Redis and anything comparable live on separate machines.	A database is state that exists only there. Rebuilding the host would destroy it.
Nothing irreplaceable is stored on its disk. Uploads, backups and generated files belong elsewhere. This disk is never the source of truth for anything.	The disk is not backed up, because there is supposed to be nothing on it worth backing up.
I can wipe and rebuild this server at any time. A fresh machine, the engine binary, and a push — every project is back and serving within minutes.	This is the recovery plan. If it is not true for this machine, there is no recovery plan.
I understand a sealed server can lock me out permanently.	Because it can, and the consequence lands on whoever sealed it.

If you are not going to seal

The appliance discipline is still the right way to run a LockFlare host — it is what makes a lost server cheap — but the stakes are lower. An unsealed server still has SSH, so a mistake is recoverable in the ordinary way.

Sealing is what converts every one of those acknowledgements from good practice into a hard precondition. A server that breaks the contract and is never sealed is untidy. The same server sealed is a machine you will one day be unable to open.

Before sealing, ask one question: if this machine stopped responding in ten minutes and I could never log into it again, would I lose anything I cannot replace with a push? If the answer is yes, fix that first. If the answer is no, seal it — that is exactly the state Enclave is for.

The one thing that must be running

The engine has to be under a service manager — systemd or PM2, as root. Not for convenience: it is the difference between a crash that self-heals and a crash that ends the machine.

Cipher asks you to confirm this again in the seal dialog, separately from the registration acknowledgements, because it is the single condition most likely to be true at registration and false by the time someone seals.

See Node Engine installation or .NET Engine installation for the service setup.

The three pieces Editions