- Home
- Malware Analysis Sandboxes
- Detonate
Detonate
What it is
Detonate analyzes software dependencies by running them in isolated micro-virtual machines and monitoring their activity for supply-chain security. It accepts npm and PyPI packages, Maven artifacts, binaries and Docker images. During execution, it records file access, network connections, DNS queries and process activity, then issues a benign, suspicious or policy-violating verdict with an event timeline. Decoy files such as fake SSH keys, cloud credentials, API tokens and environment files can reveal access attempts. A token-authenticated REST API handles artifact submission, status checks, verdicts and reports for CI/CD deployment gates. The sandbox network has no internet access by default; outbound connections can be logged and optionally blocked. Detonate offers API, web, Linux and self-hosted options. Deployment requires a Linux x86_64 host with KVM support and Docker 24 or newer for containerized use. The free Community plan is self-hosted and retains events for seven days. Paid plans start at $4,990/yr; Enterprise adds options such as SSO and air-gapped deployment.
For and against
For
- Supports packages, artifacts, binaries and Docker images.
- Verdicts include an event timeline.
- API supports CI/CD deployment gates.
- Sandbox has no internet access by default.
- Enterprise lists air-gapped deployment and audit logging.
Against
- Containerized deployment requires Linux x86_64, KVM and Docker 24 or newer.
- Community plan allows two concurrent sandboxes and 200 API runs monthly.
- Community event retention is seven days.
- Paid plans start at $4,990/yr.
The verdict
Detonate combines isolated execution, activity monitoring and API-based verdicts for dependency review. Check the host requirements, plan limits and retention periods against your deployment needs.
Who it suits
Detonate suits software teams that want to examine dependency behavior and feed results into deployment workflows. Its Linux and self-hosted requirements are relevant for teams planning their own deployment.
Plans and prices
Community
all artifact types · 2 concurrent sandboxes · 200 API runs/month · unlimited manual UI
Read 15 Oct 2026 · detonate.fnsys.pro
SMB
10 users · 10 concurrent sandboxes · 5,000 runs/month · 30-day event retention
Read 15 Oct 2026 · detonate.fnsys.pro
Enterprise
unlimited users · unlimited sandboxes · unlimited runs · configurable 1-year retention
Read 15 Oct 2026 · detonate.fnsys.pro
On the record
- Anti-evasion
- Detonate checks long sleeps, VM and CPU fingerprinting, /proc inspection, timing attacks and delayed callbacks.detonate.fnsys.pro · read 15 Oct 2026
- API endpoints
- The listed endpoints are POST /api/v1/submit, GET /api/v1/status/:id, GET /api/v1/verdict/:id and GET /api/v1/report/:id.detonate.fnsys.pro · read 15 Oct 2026
- Bare-metal installation
- The manual describes cloning a Gitea repository, installing Bun, building the project and running the generated Node application.detonate.fnsys.pro · read 15 Oct 2026
- Behavior monitoring
- It captures and classifies artifact file access, network connections, DNS queries, and process execution.detonate.fnsys.pro · read 8 Oct 2026
- CI/CD integration
- A token-authenticated REST interface supports submission, status polling, verdict retrieval and report downloads.detonate.fnsys.pro · read 15 Oct 2026
- Community support
- The Community plan lists support through GitHub.detonate.fnsys.pro · read 8 Oct 2026
- Custom runtimes
- Administrators can build custom rootfs images from Docker images for runtimes not included by default.detonate.fnsys.pro · read 15 Oct 2026
- Database support
- SQLite is the default database and PostgreSQL 14 or newer is supported through DATABASE_URL.detonate.fnsys.pro · read 15 Oct 2026
- Deception honeypots
- Nine built-in deception packs plant fake credentials and configuration files whose access triggers alerts.detonate.fnsys.pro · read 15 Oct 2026
- Dependency API
- Firecracker provides a REST control API for configuring CPUs, starting machines and applying resource rate limits.firecracker-microvm.github.io · read 15 Oct 2026
- Dependency hardware
- Firecracker supports 64-bit Intel, AMD and Arm processors with hardware virtualization.firecracker-microvm.github.io · read 15 Oct 2026
- Dependency isolation
- Firecracker uses KVM isolation and a companion jailer as an additional defense layer.firecracker-microvm.github.io · read 15 Oct 2026
- Dependency licence
- Firecracker, the microVM component used by Detonate, is an open-source project under Apache License 2.0.firecracker-microvm.github.io · read 15 Oct 2026
- Dependency performance
- Firecracker documentation describes microVM startup below 125 milliseconds and memory overhead below 5 MiB.firecracker-microvm.github.io · read 15 Oct 2026
- Deployment
- The recommended installation is a Docker image containing Firecracker, kernel, rootfs images and the monitoring agent.detonate.fnsys.pro · read 15 Oct 2026
- Deployment requirements
- The manual requires a Linux x86_64 host with KVM support and Docker 24 or newer for containerized deployment.detonate.fnsys.pro · read 8 Oct 2026
- Documentation
- The manual covers installation, environment variables, databases, artifact submission, policies, reports, tokens, CI examples and architecture.detonate.fnsys.pro · read 15 Oct 2026
- Enterprise options
- The Enterprise plan lists SSO, LDAP/Active Directory, audit logging, air-gapped deployment, and a premium support SLA with a 24-hour response.detonate.fnsys.pro · read 8 Oct 2026
