Airlock

A network card reader appliance for the Raspberry Pi 4

GitHub

About

Plug a USB thumb drive, SD card, or external SSD into the Pi. It appears on your home network within seconds — accessible over SMB (Finder, Explorer, Files, smbclient) and a small web UI in the browser.

[your laptop]  <--  Wi-Fi / Ethernet  -->  [Pi 4 with drive plugged in]
                   smb://airlock              airlock.local
                   http://airlock/

Built for the person whose laptop has USB locked by corporate policy, or who just wants a tidy way to move files off a card without hunting for a reader.

Why the name

Borrowed from spacecraft and cleanrooms: an airlock is the intermediate compartment that isolates two environments while goods pass between them. That is exactly the security posture here.

• The untrusted USB media — someone else's thumb drive, a card of unknown provenance, a booby-trapped stick — plugs into the Pi. Not into your primary machine.
• Every mount uses nosuid,nodev,noexec; nothing on the drive can execute, gain privileges, or open a device node on the Pi.
• Airlock never auto-runs anything from the media. Linux has no autorun.inf, and nothing is scanned-and-executed either.
• BadUSB / Rubber Ducky attacks — a drive pretending to be a keyboard — land on a headless Pi with no interactive session to type into. Optional AIRLOCK_HARDEN_USB=1 refuses HID and CDC-* drivers entirely.
• Kernel filesystem-parser CVEs (rare but real for FAT / NTFS / exFAT / HFS+) hit a $50 Pi you can reflash, not the machine you actually work on.

Airlock is an isolation chamber, not a scanner

You still have to be careful with file content — a booby-trapped PDF or macro-laden Excel document is Airlock's cargo, not its concern. Endpoint hygiene still matters.

Status

Version 0.3.1 — daemon plus a macOS menubar companion app. Runs on real hardware (Raspberry Pi 4 on Debian 13 / Trixie).

Mounts, file management, format, flash, dump, fsck, volume relabel, opt-in USB / boot / Wi-Fi hardening, and a live-updating menu-bar client with silent mount, auto-mount, and auto-unmount-on-eject.

Design

Target hardware	Raspberry Pi 4 (2 GB+), Ethernet or Wi-Fi, PoE HAT recommended
Discovery	mDNS (airlock.local) via Avahi. Home / small-office LAN.
Sharing	SMB (Samba, guest access) + HTTP UI on port 80
Filesystems	FAT32, exFAT, NTFS, ext4 read-write; HFS+ read-only
Mount options	nosuid,nodev,noexec on every mount

Stack: Go, embedded web UI, Samba, Avahi, Swift (macOS companion)