Skip to content
PyArmorDEMO

Architecture

Each box links to what it is and where it lives in the repo.

Developeruv · gitPython sourceapp/backend/PyArmor buildpyarmor gen -r
Docker imageno source insideDeploymentproxy · HTTPSFastAPI API:8300ClientHTTP only
Highlighted: what PyArmor produces

  1. 01Developer

    your machine

    Writes and tests the readable source. Runs the workshop commands with uv.

  2. 02Python source

    app/backend/

    The FastAPI app. business_logic/ holds the scoring model worth protecting. Never shipped.

  3. 03PyArmor build

    scripts/obfuscate.py · verify.py

    Runs pyarmor gen -O build/protected -r app, fails on PyArmor errors (it exits 0 on some), then checks every module is obfuscated and the tests still pass.

  4. 04Protected application

    build/protected/app/

    The same package structure; each .py is a three-line stub with an encrypted payload.

  5. 05Runtime components

    build/protected/pyarmor_runtime_000000/

    A compiled extension that decodes the protected code in memory. Tied to one platform and one Python minor version.

  6. 06Docker image

    app/backend/Dockerfile

    Two stages: the builder obfuscates, the runtime image gets only the protected build and hash-pinned dependencies. Non-root, read-only code.

  7. 07Deployment

    docker-compose.yml · deploy/

    Locally: published on 127.0.0.1 only. On a server: behind Caddy with HTTPS, health checks, log rotation and a restart policy.

  8. 08FastAPI API

    :8300

    /health, /api/info (reports the build), /api/analyze, /api/report. Identical answers from both builds.

  9. 09Client

    curl · the Lab page · your app

    Sees only HTTP. Cannot tell the builds apart except through /api/info, which reports it on purpose.