Problem

The license validation system uses keygen-sh/machineid (v1.1.2) to identify the host machine. This library tries the following sources on Linux:

1. /var/lib/dbus/machine-id
2. /etc/machine-id
3. /proc/self/cgroup (Docker-specific cgroup path)
4. /proc/self/mountinfo (Docker-specific mount path regex)

All four fail in GKE (and other containerd-based Kubernetes environments) because:

• Alpine-based containers don't have dbus or /etc/machine-id
• GKE uses containerd, not Docker — the cgroup and mountinfo patterns don't match
• The mountinfo regex specifically looks for /docker/containers/ which doesn't exist under containerd

This produces: license is invalid; additional features are disabled. {"error": "machineid: machineid: no machine-id found"}

Affected Environments

• GKE (containerd)
• EKS with containerd
• Any Kubernetes cluster not using Docker as the container runtime
• Rootless containers
• AWS Fargate / Cloud Run / other serverless container runtimes

Proposed Solution

Add a configurable machine fingerprint that overrides the auto-detection. Two options that work well together:

1. Environment variable override

Allow setting FLIPT_MACHINE_ID (or similar) to explicitly provide the machine fingerprint. The license manager would check this before falling back to machineid.ProtectedID.

2. Config option

Add a license.machine_id config field:

license:
  key: "..."
  machine_id: "${env:FLIPT_MACHINE_ID}"

Implementation

In internal/coss/license/license.go, the fingerprinter field could be wrapped:

fingerprinter: func(appID string) (string, error) {
    if id := os.Getenv("FLIPT_MACHINE_ID"); id != "" {
        return protect(appID, id), nil
    }
    return machineid.ProtectedID(appID)
}

Workaround (current)

Users can mount the host's /etc/machine-id into the container via hostPath volume:

extraVolumeMounts:
  - name: machine-id
    mountPath: /etc/machine-id
    readOnly: true

extraVolumes:
  - name: machine-id
    hostPath:
      path: /etc/machine-id

This works but requires hostPath access which some security policies restrict.

Context

Reported by a user deploying Flipt Pro on GKE with containerd. The license key is valid but the machine identification step fails before validation can occur.