Deploys your patches at the end of each tick, filters the traffic that reaches your services, and rolls back what breaks.
Every directory with a compose file is a service, FAUST-style. Public ports are read from the compose file after environment substitution, and moved behind the proxy without touching the original.
Game modes for FAUST CTF and the ECSC bring the flag format, the tick timing and the vulnbox address, and read the checker's verdict on every service from the gameserver.
Pushes are fetched, built and pulled straight away. Containers are only swapped in the last few seconds of a tick (5 by default, configurable), and the proxy holds connections while a service comes back so the checker sees latency, not a failure.
A new version that does not come up, or a change after which the checker says down, is undone with a pushed commit and deployed. vulnboxctl rollback does the same by hand.
Block, rewrite, route or log TCP, UDP, HTTP (including h2c and WebSockets), FTP and DNS traffic. Patterns are matched as the data streams by, at any distance, in constant memory.
Rules write the game's flags as {flag}. Flags can be stored encrypted and decrypted only where users read their own, so dumps and data smuggled off the box yield ciphertext.
Each service gets a vulnboxd-rules.yml, committed and pushed for the team. Saving it reloads the rules without a rebuild or a dropped connection, and a bypass header lets your own exploits through.
Alerts go to a Discord webhook when a port stops answering, the checker says down, a build or deploy fails, or something is rolled back.
Prometheus metrics for every rule, port and deploy, and vulnboxctl top to watch them in the terminal. Try a rule as action: log before you let it block.
Turn the PCAP-over-IP broker on and it serves the box's traffic live to tulip, shovel or tcpdump, byte for byte what fox-it's pcap-broker serves. Its own service, so an upgrade never interrupts the capture.
vulnboxctl upgrade takes a release archive or a binary straight out of cargo. The running daemon hands its listening sockets to the new build at the end of a tick, then stays behind to finish what it had open. Nothing is refused and nothing is cut.