How Can I Protect Code in a Docker Container from Clients?

Any way you slice it, asking a client to be locked out of their own container is a bit tricky. Once code is executed, it becomes readable. The only reliable approach is to deploy it on your own infrastructure, which gives you complete control.

Similar to others' points, once the container is with the client, they're going to access the files regardless of how you set permissions. You could technically hide certain functionalities from them, but it's a tricky balance. The best way might actually be not to run the application on their hardware, instead, consider hosting it yourself.

Unfortunately, if a client has access to the container, they can always find a way to access the filesystem. It's just something you can't fully prevent once they have the image. If you don’t trust the client, ideally, avoid giving them access altogether.

One thing to consider is using an external licensing service. This way, if the client stops paying, you can disable the application from starting. Also, running the code through an obfuscator might deter direct reverse engineering, but it can complicate your debugging. To enhance security, think about using a distroless container. It removes unnecessary shell applications and tools that make it easier to meddle with the container.