Airlock

A network card reader appliance for the Raspberry Pi 4

GitHub

About

Plug a USB thumb drive, SD card, or external SSD into the Pi. It appears on your home network within seconds — accessible over SMB (Finder, Explorer, Files, smbclient) and a small web UI in the browser.

[your laptop]  <--  Wi-Fi / Ethernet  -->  [Pi 4 with drive plugged in]
                   smb://airlock              airlock.local
                   http://airlock/

Built for the person whose laptop has USB locked by corporate policy, or who just wants a tidy way to move files off a card without hunting for a reader.

Why the name

Borrowed from spacecraft and cleanrooms: an airlock is the intermediate compartment that isolates two environments while goods pass between them. That is exactly the security posture here.

• The untrusted USB media — someone else's thumb drive, a card of unknown provenance, a booby-trapped stick — plugs into the Pi. Not into your primary machine.
• Every mount uses nosuid,nodev,noexec; nothing on the drive can execute, gain privileges, or open a device node on the Pi.
• Airlock never auto-runs anything from the media. Linux has no autorun.inf, and nothing is scanned-and-executed either.
• BadUSB / Rubber Ducky attacks — a drive pretending to be a keyboard — land on a headless Pi with no interactive session to type into. Optional AIRLOCK_HARDEN_USB=1 refuses HID and CDC-* drivers entirely.
• Kernel filesystem-parser CVEs (rare but real for FAT / NTFS / exFAT / HFS+) hit a $50 Pi you can reflash, not the machine you actually work on.
• The drive stays inside its own mount. Every file operation in the web UI and API goes through Go's os.Root, so the kernel checks each path component — a stick carrying x -> /etc can't be used to read or write the rest of the Pi.
• The Pi can't be told to wipe itself. Any disk backing /, /boot/firmware or swap — including the root disk of a Pi booted from USB — is never offered for format, flash or dump.

Airlock is an isolation chamber, not a scanner

You still have to be careful with file content — a booby-trapped PDF or macro-laden Excel document is Airlock's cargo, not its concern. Endpoint hygiene still matters.

Status

Version 0.4.0 — daemon plus a macOS menubar companion app. Runs on real hardware (Raspberry Pi 4 on Debian 13 / Trixie).

Mounts, file management, format, flash, dump, fsck, volume relabel, opt-in USB / boot / Wi-Fi hardening, and a live-updating menu-bar client with silent mount, auto-mount, and auto-unmount-on-eject.

0.4.0 is a security and data-safety release from a full audit of the codebase — see the news entry and the changelog.

Install

On an existing Raspberry Pi (Bookworm or Trixie, 64-bit):

curl -fsSL https://github.com/emdzej/airlock/releases/latest/download/install.sh | sudo bash

Options go on the sudo side of the pipe — … | sudo AIRLOCK_HARDEN_USB=1 bash. The installer verifies everything it downloads against the release checksums.

Design

Target hardware	Raspberry Pi 4 (2 GB+), Ethernet or Wi-Fi, PoE HAT recommended
Discovery	mDNS (airlock.local) via Avahi. Home / small-office LAN.
Sharing	SMB (Samba, guest access) + HTTP UI on port 80
Filesystems	FAT32, exFAT, NTFS, ext4 read-write; HFS+ read-only
Mount options	nosuid,nodev,noexec on every mount
Auth	None — trusts the LAN. Cross-origin requests and DNS rebinding are refused, so a web page can't drive it
Eject	Withdraws the SMB share first; refuses (HTTP 409) while a file is still open instead of pretending

Stack: Go, embedded web UI, Samba, Avahi, Swift (macOS companion)