Enclosed 1.16.1

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Enclosed 1.16.1 on Ubuntu 24.04 as the software version and select your Region. Then choose Launch through EC2.

Choose m5.large, your key pair and a security group as described above.

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --image-id <ami-id-from-the-listing> --instance-type m5.large \
  --key-name <your-key-pair> --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=enclosed}]'

First boot takes about half a minute after the instance is running.

To use your own name from the start, put it in /etc/sac/enclosed-domain with user data, for example a cloud-init write_files entry. Otherwise, first boot uses the instance's public DNS name, or its public IP address if it has no DNS name.

Operating system SSH user

Ubuntu 24.04 ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

systemctl is-active enclosed-firstboot docker enclosed nginx

active active active active

Only SSH, HTTP and HTTPS are public. The Enclosed container is published on the loopback address only:

sudo ss -tln | grep -E ':(22|80|443|8787) '

LISTEN 0 4096 0.0.0.0:22 0.0.0.0:* LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 511 0.0.0.0:443 0.0.0.0:* LISTEN 0 4096 127.0.0.1:8787 0.0.0.0:* LISTEN 0 4096 [::]:22 [::]:* LISTEN 0 511 [::]:80 [::]:* LISTEN 0 511 [::]:443 [::]:*

Run the local health check. It is answered only on the loopback address:

curl -s http://127.0.0.1/api/ping; echo

{"status":"ok"}

sudo cat /root/enclosed-credentials.txt

The file (root-only, mode 0600) holds this instance's address, the admin email and password, and the SHA-256 fingerprint of its certificate:

# Enclosed 1.16.1 - written on first boot by enclosed-firstboot.service. Unique to this instance. ENCLOSED_URL=https://ec2-32-201-68-126.compute-1.amazonaws.com/ ENCLOSED_ADMIN_EMAIL=admin@enclosed.local ENCLOSED_ADMIN_PASSWORD=<per-instance password> ENCLOSED_TLS_SHA256=6F:F0:1F:70:...:(64 hex digits in pairs)
# Log in at ENCLOSED_URL with the e-mail and password above to CREATE notes. Anyone you send a note link to can
# open it WITHOUT an account: the decryption key travels in the link's #fragment, which never reaches this server. ...

The certificate is self-signed and unique to your instance, so your browser warns about it. Open the certificate details in the browser and check that its SHA-256 fingerprint matches ENCLOSED_TLS_SHA256. Only then continue.

Do not add the certificate to your operating system's trust store. For production, replace it with a certificate from a certificate authority (Step 9). The certificate is an end-entity certificate for this instance's names only:

openssl x509 -in /etc/ssl/enclosed/enclosed.crt -noout -subject -ext basicConstraints,keyUsage,extendedKeyUsage,subjectAltName

subject=CN = ec2-32-201-68-126.compute-1.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-32-201-68-126.compute-1.amazonaws.com, IP Address:32.201.68.126, IP Address:172.31.94.230 X509v3 Basic Constraints: critical CA:FALSE X509v3 Key Usage: critical Digital Signature, Key Encipherment X509v3 Extended Key Usage: TLS Web Server Authentication

Browse to the ENCLOSED_URL address. A visitor who is not logged in is sent to the login page, because on this private instance only an account can create notes. Log in with ENCLOSED_ADMIN_EMAIL and ENCLOSED_ADMIN_PASSWORD.

Write the note. You can add a note password (the recipient must type it, and it is not part of the link), choose the expiration delay, switch on delete after reading and attach files.

Choose Create note. Your browser encrypts the note and its files and uploads only the ciphertext. The page then shows the share link, also as a QR code. Send the link to the recipient over any channel, and send the note password over a different one.

The recipient opens the link in any browser, without logging in. A note that is deleted after reading says so first, and it is fetched only when the recipient chooses to see it.

A password-protected note then asks for its password. A wrong password does not decrypt it. With the right password, the browser decrypts the note and its attachments.

The note is now gone from the server, and opening the same link again shows that it was not found.

A note that is not deleted after reading can be opened until it expires. Expired notes are refused and deleted.

The web app talks to a small JSON API, which you can also call from scripts. The Enclosed command-line client, npx @enclosed/cli, encrypts for you.

The server never sees a key. Anything you send as payload is stored as you send it, so encrypt it first. Creating a note needs a login token, and reading a public note does not.

Run the commands below on the instance itself. They use the instance's own certificate as the trust anchor and keep the password and token in a private temporary directory rather than on a command line:

U=$(sudo sed -n 's/^ENCLOSED_URL=//p' /root/enclosed-credentials.txt) CA=/etc/ssl/enclosed/enclosed.crt NOTE='{"payload":"already-encrypted-text","deleteAfterReading":true,"ttlInSeconds":3600,"encryptionAlgorithm":"aes-256-gcm","serializationFormat":"cbor-array"}' curl -s --cacert "$CA" -o /dev/null -w 'anonymous create: %{http_code}\n' -H 'Content-Type: application/json' --data "$NOTE" "${U}api/notes" umask 077;
T=$(mktemp -d) sudo sed -n 's/^ENCLOSED_ADMIN_PASSWORD=//p' /root/enclosed-credentials.txt | python3 -c 'import json,sys; print(json.dumps({"email": "admin@enclosed.local", "password": sys.stdin.read().strip()}))' > "$T/login.json" curl -s --cacert "$CA" -H 'Content-Type: application/json' --data @"$T/login.json" "${U}api/auth/login" | python3 -c 'import json,sys; print("Authorization: Bearer " + json.load(sys.stdin)["accessToken"])' > "$T/auth"
ID=$(curl -s --cacert "$CA" -H @"$T/auth" -H 'Content-Type: application/json' --data "$NOTE" "${U}api/notes" | python3 -c 'import json,sys; print(json.load(sys.stdin)["noteId"])')
echo "created a note with a ${#ID}-character id" curl -s --cacert "$CA" -o /dev/null -w 'first read: %{http_code}\n' "${U}api/notes/${ID}" curl -s --cacert "$CA" -o /dev/null -w 'second read: %{http_code}\n' "${U}api/notes/${ID}" rm -rf "$T"

anonymous create: 401 created a note with a 26-character id first read: 200 second read: 404

A request made by a page on another website (its Origin is not this instance) is refused, and so is any cross-origin preflight:

U=$(sudo sed -n 's/^ENCLOSED_URL=//p' /root/enclosed-credentials.txt)
curl -s --cacert /etc/ssl/enclosed/enclosed.crt -o /dev/null -w 'cross-site create: %{http_code}\n' -H 'Origin: https://evil.example' -H 'Content-Type: application/json' --data '{}' "${U}api/notes"
curl -s --cacert /etc/ssl/enclosed/enclosed.crt -o /dev/null -w 'preflight: %{http_code}\n' -X OPTIONS -H 'Origin: https://evil.example' -H 'Access-Control-Request-Method: POST' "${U}api/notes"

cross-site create: 403 preflight: 403

First boot generates the admin password and the JWT signing secret on each instance. Check that the login works and that a wrong password does not:

sudo enclosed-admin check

ENCLOSED_ADMIN_OK login=200 wrong=401

To get a new admin password and a new signing secret, run sudo enclosed-admin rotate. Every logged-in session ends, and links you already sent keep working. The new password is written to /root/enclosed-credentials.txt.

The secrets live in a file only root can reach, and the container reads it through a read-only mount:

sudo stat -c '%a %U:%G %n' /etc/enclosed/secrets /etc/enclosed/secrets/enclosed.env

700 root:root /etc/enclosed/secrets 600 enclosed:enclosed /etc/enclosed/secrets/enclosed.env

The container's own configuration holds only non-secret settings:

sudo docker inspect enclosed --format '{{range .Config.Env}}{{println .}}{{end}}' | grep -E '^(PUBLIC_IS_AUTHENTICATION_REQUIRED|NOTES_MAX|AUTHENTICATION_)'

PUBLIC_IS_AUTHENTICATION_REQUIRED=true NOTES_MAX_ENCRYPTED_PAYLOAD_LENGTH=52428800 AUTHENTICATION_JWT_DURATION_SECONDS=86400

Point a DNS record (for example notes.example.com) at the instance, then run:

sudo enclosed-set-domain notes.example.com

nginx then serves that name, and the instance's EC2 name and addresses keep working. If the certificate is still the SecureAnyCloud self-signed one, a new self-signed certificate is issued for the new name. Share links use the name the sender browsed to.

To use a certificate from a certificate authority, replace /etc/ssl/enclosed/enclosed.crt (full chain) and /etc/ssl/enclosed/enclosed.key (mode 0600, root), then run sudo systemctl reload nginx. enclosed-set-domain never overwrites a certificate that is not SecureAnyCloud's own.

Check the current name and fingerprint with sudo enclosed-set-domain --show.

The non-secret settings are in /etc/enclosed/enclosed.env:

grep -E '^(PUBLIC_IS_|PUBLIC_DEFAULT_NOTE_TTL|NOTES_MAX|AUTHENTICATION_JWT_DURATION)' /etc/enclosed/enclosed.env

PUBLIC_IS_AUTHENTICATION_REQUIRED=true PUBLIC_IS_SETTING_NO_EXPIRATION_ALLOWED=false PUBLIC_DEFAULT_NOTE_TTL_SECONDS=3600 NOTES_MAX_ENCRYPTED_PAYLOAD_LENGTH=52428800 AUTHENTICATION_JWT_DURATION_SECONDS=86400

After editing the file, run sudo systemctl restart enclosed.

This appliance is a private instance. The start-up check refuses to start Enclosed with PUBLIC_IS_AUTHENTICATION_REQUIRED set to anything but true, and it refuses any secret in this file, because the file is visible to docker inspect. PUBLIC_IS_SETTING_NO_EXPIRATION_ALLOWED=false means every note expires.

If you raise NOTES_MAX_ENCRYPTED_PAYLOAD_LENGTH above 50 MB, also raise client_max_body_size (55m, in the location = /api/notes block) in /usr/local/lib/sac/enclosed/nginx-site.tmpl. Then run sudo enclosed-set-domain --boot and sudo systemctl reload nginx.

nginx limits how fast one client address can log in, create notes and call the API. The address is the real TCP peer. A forged X-Forwarded-For header neither changes it nor appears in the log:

sudo grep -E 'limit_req_zone' /etc/nginx/conf.d/sac-enclosed-maps.conf

limit_req_zone $enc_post_key zone=enc_login:10m rate=10r/m; limit_req_zone $enc_post_key zone=enc_create:10m rate=30r/m; limit_req_zone $binary_remote_addr zone=enc_api:10m rate=20r/s;

A client over a limit gets HTTP 429 until its allowance refills. The access log records the note API without note ids:

sudo tail -2 /var/log/nginx/access.log | sed -E 's/^[0-9.]+ /<client-ip> /'

<client-ip> - - [30/Oct/2026:11:37:33 +0000] "POST /api/notes HTTP/2.0" 403 146 "curl/8.5.0" <client-ip> - - [30/Oct/2026:11:37:33 +0000] "OPTIONS /api/notes HTTP/2.0" 403 146 "curl/8.5.0"

Storage. Notes (ciphertext only) are files in /var/lib/enclosed/data, owned by the container's user. Expired notes are deleted every hour and whenever someone asks for one. To see how many notes are stored, run:

sudo enclosed-storage count

To delete every stored note, stop Enclosed and purge the store: sudo systemctl stop enclosed && sudo enclosed-storage purge && sudo systemctl start enclosed.

A backup of /var/lib/enclosed/data holds only ciphertext. Without the links, which hold the keys, it cannot be read.

• The container. It runs the pinned upstream image as a non-root user, with a read-only root filesystem, no capabilities and no-new-privileges. It is published on the loopback address only:

sudo docker inspect enclosed --format 'user={{.Config.User}} readonly={{.HostConfig.ReadonlyRootfs}} capdrop={{.HostConfig.CapDrop}} privileged={{.HostConfig.Privileged}} securityopt={{.HostConfig.SecurityOpt}} ports={{json .HostConfig.PortBindings}}'

user=997:986 readonly=true capdrop=[ALL] privileged=false securityopt=[no-new-privileges:true] ports={"8787/tcp":[{"HostIp":"127.0.0.1","HostPort":"8787"}]}

• Metadata service. The AMI requires IMDSv2. Firewall rules that Docker loads before any container starts deny the metadata addresses to containers, and systemd denies them to Docker, containerd, Enclosed, nginx and the first-boot service. Enclosed makes no outbound requests.

sudo iptables -S DOCKER-USER systemctl show -p IPAddressDeny enclosed docker | grep -c 169.254.169.254

-N DOCKER-USER -A DOCKER-USER -d 168.63.129.16/32 -j DROP -A DOCKER-USER -d 169.254.169.254/32 -j DROP 2

• Response headers. Every page is served with a Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer and HSTS. API responses are not cacheable. The policy blocks the web fonts Enclosed would otherwise load from a third-party font service, so a recipient's browser never contacts a third party and pages use the browser's own fonts. It also blocks eval, and Enclosed's decoder then uses its built-in fallback.
• Advisories. The container image's operating system packages have no known vulnerabilities at build time. The Node.js image it is built on also ships the npm command-line tool, whose bundled modules have published advisories. npm is never run on this image: the container runs node directly, as a non-root user with a read-only filesystem. One advisory in Enclosed's web framework (Hono CVE-2026-69207, rated medium: slow parsing of a crafted Access-Control-Request-Headers header) is closed on this image, because nginx answers every cross-origin preflight itself and never forwards that header to Enclosed.
• Logs. Enclosed logs each request path (note ids, never keys) to its container log. Only root can read that log (sudo docker logs enclosed), it is removed whenever the container restarts, and it is kept out of the system journal.
• Upgrades. Ubuntu security updates (including nginx) and Docker CE updates install automatically. The Enclosed container is pinned by digest and never updated in place. SecureAnyCloud publishes new versions of this AMI for new Enclosed releases.

Enclosed is licensed under the Apache License 2.0. The image ships its licence and the exact source and image references:

cat /usr/share/doc/sac-enclosed/SOURCE.txt head -3 /usr/share/doc/sac-enclosed/LICENSE-enclosed-Apache-2.0.txt

sac Enclosed 1.16.1 appliance - source Enclosed (Apache License 2.0, LICENSE-enclosed-Apache-2.0.txt; Copyright the Enclosed authors, Corentin Thomasset): https://github.com/CorentinTh/enclosed/tree/v1.16.1 (commit cb6db13bd486622d48c0d880ecb7bd08023f1f30) This image runs the OFFICIAL upstream container image UNMODIFIED: corentinth/enclosed:1.16.1 OCI index sha256:e65f73b085823ceeab1a39c515614c1a24e9b5c69b8e1221d3d7071a4f8bc4a8 linux/amd64 sha256:fb6547f358c3230e616be3b35f307a0847da55e6ba7ec3d9dc50eeedee993ec5 (the reference this instance runs) image config sha256:275fda1429f7def403ebfecb3c3f58564fb38a786d2e4de748a0302f1ddc7d65 (Node.js 22.23.4 on Alpine Linux 3.24.3; the image's own notices are inside it.) sac adds deployment configuration only: systemd units, an nginx HTTPS reverse proxy, per-instance secrets and container hardening (see /etc/systemd/system/enclosed*.service, /etc/nginx, /etc/enclosed). Docker CE is installed from Docker's official repository (download.docker.com), key pinned by fingerprint. Enclosed is a trademark of its respective owner; sac is not affiliated with or endorsed by the Enclosed project. Apache License Version 2.0, January 2004 http://www.apache.org/licenses/

All product and company names are trademarks or registered trademarks of their respective holders. SecureAnyCloud is not affiliated with or endorsed by them.