ContainRE is a sandbox, execution tracer, and flight recorder for Linux ELF x86-64 binaries. It is built for authorized malware analysis and reverse engineering on systems you control.
Use this folder as the short-form documentation set:
- Features - what ContainRE can observe, contain, and export.
- Architecture and Tech Stack - how the control plane, runtimes, tracer, sink, storage, API, and web UI fit together.
- Tutorials - practical workflows ordered by difficulty.
- TLS Plaintext Capture - authorized inspection of
OpenSSL plaintext with
LD_PRELOADduring controlled ContainRE runs. - Offline Service Emulation - infer and replay simple HTTP/2 gRPC service behavior with no outside network access.
- Batch Runs and Helper Services - run large offline batches with setup/teardown hooks and optional reusable Docker containers.
- Reporting and Assertions - evidence summaries and reusable pass/fail checks for no-egress, output, exit-code, and detection expectations.
For the full design notes, see SPEC.md. For quick commands and status, see README.md.
ContainRE has two runtime backends:
localis fast and useful for tests, development, and trusted specimens. It uses ptrace interception on the host and is not a safe backend for real malware.dockerruns the specimen in a locked-down container with no real network egress by default. Use this backend for untrusted specimens.
The control-plane API is powerful and unauthenticated. Keep it bound to
127.0.0.1 unless you add your own access controls around it.
uv sync
make -C specimens
uv run containre run specimens/bin/netbeacon --net deny
uv run containre ls
uv run containre show <run_id> --events --kind netTo launch the web dashboard:
uv run containre serveThen open http://127.0.0.1:8787.
The dashboard includes a Static tab for symbol queries, caller/callee review, and a compact call graph around confirmed direct calls:
