Analysis Workspace
Execute autonomous Python data analysis inside disposable, isolated Docker containers on Vultr Cloud.
1. Target Dataset
Schema Validated2. Natural-Language Objective
Max 2,000 charactersExecutive Analysis Findings
Chart Snapshot
No visualization available
High-Resolution Analysis Chart
chart.pngNo chart generated for this analysis.
Containment Card
Observed Linux cgroups and container inspection attributes captured directly by trusted controller.
Extracted Container Artifacts
| Filename | MIME Type | Size | SHA-256 Digest | Action |
|---|
Generated Python Script (AST Validated)
Container Stdout (256 KB Cap)
Container Stderr
Tamper-Evident Execution Receipt
Canonical SHA-256 digest covering inputs, AST-verified code, inspect evidence, and artifact outputs.
Security Testing / Red Team Arena
Disabled by DefaultActive boundary validation against disposable Docker containers with controller-side evidence.
Outbound Network Exfiltration
Verifies complete network namespace isolation by testing egress blocking, internal canary name resolution, and interface restriction under --network none.
Host Secret & Env Exfiltration
Scans container environment variables and sensitive host directories (/root, /etc/shadow, /etc/auron) for credentials and API keys.
Process Table Fork Bomb
Spawns recursive child processes to attempt host process table exhaustion beyond the Linux kernel cgroups PID ceiling.
Ready for probe execution. Click "Launch Probe" above to test active boundary containment.
Red Team Audit Log
| Timestamp | Probe Name | Target Mechanism | Classification | Duration | Observed Controller Evidence |
|---|---|---|---|---|---|
| Loading audit records... | |||||
Execution History & Sample Runs
Verified historical executions with tamper-evident SHA-256 receipts, charts, and plans for instant demonstration inspection.
| Dataset | Analysis Objective | Model | Status | Artifacts | Receipt SHA-256 | Action |
|---|---|---|---|---|---|---|
| sales_clean.csv | Which category generated the highest revenue? Rank categories & plot chart. | deepseek-v4.1 | VERIFIED | 3 files | 4f03e317... | |
| customer_churn.csv | Analyze churn rate across contract types and visualize distribution. | deepseek-v4.1 | VERIFIED | 2 files | 8e12a9c3... |
Sample Run: Category Revenue Breakdown
Dataset: sales_clean.csv (25 rows) • Total Revenue: $160,775.00
System Architecture & Containment
Production infrastructure flow, trusted controller boundaries, and defense-in-depth isolation matrix.
End-to-End Orchestration Architecture
Blast Radius Zero Defense Matrix
| Boundary | Enforced Control | Enforcement Mechanism | Security Limitation & Verification |
|---|---|---|---|
| Network | --network none | Isolated container network namespace; zero socket or DNS access. | Verified via Red Team Probe #1 (socket creation blocked). |
| Filesystem | --read-only | Root filesystem is mounted read-only; system libraries cannot be modified. | Write attempts fail with Read-only file system (EROFS). |
| Privileges | UID 10001:10001 | Non-root execution reduces the privileges available to a compromised workload. | Does not protect against zero-day Linux kernel vulnerabilities. |
| Capabilities | --cap-drop ALL | Strips all Linux capabilities (raw sockets, ptrace, kernel module loading). | Verified in Docker inspect State.CapDrop = ["ALL"]. |
| Processes | --pids-limit 64 | Linux cgroups PID controller (pids.max) enforces ceiling. | Verified via Red Team Probe #3 (fork bomb halted at 62 PIDs). |
| Storage | 20 MB tmpfs /out | Kernel-enforced during run; tar-stream extracted by trusted controller. | Attempts to exceed 20 MB fail with No space left on device. |
| Integrity | SHA-256 Receipt | Tamper-evident canonical digest covers code, CSV, inspect, and artifacts. | Provides post-run tamper detection; not a hardware TPM attestation. |