How it works

You drop a file. We open it in a sealed box, record what it really does, and show the result as a creature at a depth.

Architecture

UploadThe controller reads the file’s type from its content, not its name, and picks a path: run it, run it under Wine, emulate it, or inspect it.
DetonateA fresh gVisor container runs, emulates or inspects the file. Fake passwords and documents are planted for it to find.
CollectA second container records the trace and a before/after diff of the seeded files.
AnalyseAn AI model (Vultr Serverless Inference) writes Python to read the trace. A third container runs that code. If it fails, the error goes back to the model, up to three retries, all shown on screen.
VerdictFixed rules turn the evidence into findings, a depth and a family. The model never decides the verdict. It only explains it.
DestroyEvery container and the upload are deleted and checked. A receipt records it.

Browser ──HTTPS──► Vultr Cloud Compute VM (Ubuntu 24.04)
                   ├─ Caddy: TLS, public origin
                   ├─ Controller (Node): jobs, rules, receipts, ocean counts
                   │    ├─► Vultr Serverless Inference (the only network client with a key)
                   │    └─► Docker with gVisor (runsc)
                   │          ├─ detonate container
                   │          ├─ collect container
                   │          └─ analyse container
                   └─ job temp files (encrypted), ocean counts, host canary

The browser never runs your file. It only replays what the server recorded on a Windows or macOS desktop.

Containment

Four properties keep a harmful file inside the box. Each has an acceptance test that proves it.

Property	What it means	Proven by
Process isolation	gVisor, no network, non-root, all capabilities dropped, read-only root, no Docker socket or host mounts. The host cannot be reached.	AT-5 (a sample runs `rm -rf /`; the host canary and the VM’s `/bin` are unchanged) and AT-16 (the job fails if any isolation flag is missing)
Secret hygiene	The inference key lives only in the controller. Containers start with an empty environment. File text reaches the model only as quoted, size-capped data.	AT-1 (no key in the container environment) and AT-12 (a file saying “ignore previous instructions” gets the same verdict)
Resource limits	512 MB memory, 1 CPU, 128 processes, 30 s per run, capped output. A fork bomb or a memory balloon stops at the limit.	AT-2 (time limit), AT-3 (process limit) and AT-4 (memory limit)
Lifecycle	A new container for every run, removed and confirmed gone. If removal cannot be confirmed, the site stops taking uploads. The upload is deleted after the run.	AT-9 (nothing left behind) and AT-10 (failed removal stops new jobs)

What the depths mean

The depth is the worst harm proven by evidence: Sunlight is Clean, Twilight is Risky, Midnight Steals, Abyss Takes control, Trench Destroys. Only harm to the seeded user data counts. A file that only deletes its own temporary files is not a Trench file. See the Bestiary for every creature.

Limits

Up to 100 MB per file. Files over 10 MB get static analysis only.
Up to 50 files after unpacking an archive, 30 seconds per item and 3 minutes per job.
3 uploads per connection per hour. The site can stop taking uploads when busy or unsafe.
A file that was only inspected, not run, can reach Twilight at most.
Some risks cannot be proven here: a phishing email that only links out, or a document that exploits a flaw in other software. The report says “risky, unproven”.
A result of “No harmful behaviour observed” lists the checks that ran. It is not a guarantee that a file is safe.
Windows programs run under Wine or an emulator, not on real Windows. Some will not run, and the report says which steps worked.
Without the model, verdicts still come from evidence. Only the written explanation is missing.

Honest status

This is a hackathon build. The file types it handles first are archives, PDFs, Office files with macros, Windows programs, web pages, emails and scripts. Other types are inspected only.
The containment is built to run on Docker and gVisor. An end-to-end run on the public Vultr server with live inference has not been shown yet.
Some creatures and fish use stand-in art until their own sprites are drawn. Their cards in the Bestiary still show the right name and meaning.
The ocean updates in batches, so a single upload cannot be spotted in it. It shows counts only: no file names, no hashes, no times.
The scripted attack scenes from the earlier version of this project are hidden on this site.

Back to the ocean