Is FUSE (gocryptfs) a supported configuration on Machines?

Questions / Help
1

I’m putting a transparent encryption layer over a volume and want to know whether I can rely on it long-term.

What I’ve verified on a scratch app (syd, shared-cpu-1x, Debian 12):

  • /dev/fuse is present
  • Full capabilities, CAP_SYS_ADMIN included
  • Kernel carries fuse / fuseblk / fusectl
  • gocryptfs initialised and mounted over a volume first try
  • Overhead is modest — roughly 1.1–1.8× on small-file I/O, nothing measurable on sequential, and flat at about 1.2× with 8 concurrent readers

Questions:

  1. Is FUSE a supported configuration, or does it work incidentally and could change without notice?
  2. Any known issues running a FUSE mount over a Fly volume — particularly unclean shutdown, or a restart leaving a stale mount that blocks the app coming back up?
  3. Anything to watch on fly deploy or machine replacement when the app’s data path is a FUSE mount?

Context: it’s a writing app holding sensitive IP, and I want the encryption key held outside Fly so a volume snapshot isn’t readable on its own. Not asking anyone to endorse the design — just whether the FUSE dependency is safe to build on.

2

I’m not an employee, but I’d query the notion of supported configurations. It’s your app running in a micro-VM; it either works or it doesn’t. Have you got it to work locally, in a Docker container?

The one issue to watch out for with volumes is that it ties the machine to a physical host. So if the host suffers a hardware failure, your app can’t be deployed on another host without moving the volume.

Do you especially need a FS for this encryption need? Encrypted blobs in managed S3, Redis, or a relational db would probably be far less hassle.

3

Hi there,

We’re unlikely to remove modules built into the Fly machines kernel, so you can rely on FUSE being there; and since beyond the FUSE kernel driver, everything else is userspace-based (hence the name!), you can likely rely on this long-term.
The issues you’ll run into are not specific to Fly machines - all the things you mentioned can also happen on bare metal, so if you cover those cases in general it should work for a Fly machine.