Skip to content
Cerberon Docs

Architecture

Cerberon runs as a set of containers on one host that you operate. The web console and REST API run in the Core. Scans run in separate, short-lived worker containers built from the scanner tools image.

ON-PREMISES HOST ENVIRONMENT Web Console & REST API User Auth, RBAC & SSO Scan Scheduling & Triage Privacy & Redaction Filter HTTPS (Port 443) Isolated Scan Workers SAST, SCA & CBOM Analysis DAST, Cloud & Kubernetes Mobile Package Inspection Read-Only Target Access Persistent Storage Findings & Scan History Encrypted Credentials Reports & Snapshots Audit Activity Log
Cerberon separates the web console and API from isolated scan workers and persistent on-premises storage.

Components

Section titled “Components”
Component Role
Core Web console, REST API, authentication, scheduling, the findings register and report generation. Contains no scanner binaries.
Tools image The scanners the Core drives. Built on your host during installation from a signed recipe.
Scan workers One container per scan, created at start and removed when the scan ends. Source code is mounted read-only.
Mobile analyser Optional container for Android and iOS package analysis. Skip it with --no-mobile.
Data volume Findings, reports, accounts, sealed credentials and settings. Stays on the host.

Security controls

Section titled “Security controls”

Isolation. Each scan runs in its own worker container with all Linux capabilities dropped, no-new-privileges, and memory and CPU limits. A worker mounts only its own job directory, with source code read-only. It has no access to the Core’s data volume and is removed when the scan ends.

Target validation. Before connecting, Cerberon refuses loopback, link-local and cloud metadata addresses, such as 127.0.0.1, ::1 and 169.254.169.254. A webhook to a private network address needs an administrator to allow it.

Sealed credentials. Cloud, Kubernetes, registry and repository credentials are encrypted at rest with AES-256-GCM. They are passed only to the worker that needs them and never appear in a job record, log or browser response.

Masking at egress. When the privacy policy is on, secrets, internal addresses, host names and email addresses are masked in AI requests, masked report downloads and masked share links. The database keeps the real values. See AI providers and privacy.

Integrity. Every report version carries a SHA-256 fingerprint. SBOM and CBOM documents are signed with Ed25519.

Audit log. Sign-ins, role changes, triage decisions, shares and administrative actions are recorded. The log is kept for 180 days by default, configurable from 180 to 3,650 days.

No telemetry. The instance contacts only the endpoints listed in Network and egress.