Web3Signer Compatible
Drop-in replacement — point your validator client at Containment Chamber and it just works. All 10 Eth2 signing operations, compatible with Lighthouse, Teku, Prysm, Lodestar, and Nimbus. Same API, no client modifications.
Containment Chamber
Drop-in replacement for Web3Signer. Same API, same validator clients — with multi-tenant auth and slashing protection built in.
Features
Section titled “Features”Auth Policies & Tokens
Run one signer for multiple validator clients. Each client gets a unique token with per-key and per-operation restrictions. Isolate tenants without client-side changes — just embed the token in the signer URL.
EIP-3076 Slashing Protection
PostgreSQL or DynamoDB for production, with a pluggable backend architecture. Both prevent double-signing — PostgreSQL stores full history with surround detection, DynamoDB uses Hybrid mode (watermarks + signing root records).
Nitro Enclave Mode
Keep decrypted validator keys inside AWS Nitro Enclave memory, use aTLS for attested client connections, and require KMS RecipientAttestation before master-key shares are released.
Start Reading
Section titled “Start Reading”Use these paths to move from orientation to implementation.
Installation
Install the binary or container image, verify the release, and choose the right package for your environment. Install Containment Chamber →
Configuration Reference
Complete reference for all configuration options, environment variables, and CLI flags. View Reference →
Zero to Production
A guided path from installation to production. Install, configure, deploy, and harden in one continuous flow. Start the Guide →
Deployment Guides
Deploy on Kubernetes, Docker, bare metal, or AWS Nitro Enclaves with production-ready examples. View Guides →
API Reference
HTTP endpoints, signing operations, request/response schemas, and error codes. View API →
Operations Guides
Run seal/unseal ceremonies, manage chamber keys, troubleshoot incidents, and upgrade deployments safely. View Operations →