| Boundaries | ||||||||
|---|---|---|---|---|---|---|---|---|
| Dangerzone sandbox (VM + outer container + gVisor sandbox) | ✗ | ✓ | ✗ | ✓ | ✗ | * | ✗ | ✗ |
| Docker/Podman VM | ✓ | ✗ | ✗ | ✓ | ✗ | * | ✗ | ✗ |
| FPF-operated Tailnet | ✓ | ✗ | ✗ | ✗ | ✗ | * | ✗ | ✗ |
| Internet | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ |
| Local host | ✓ | ✗ | ✗ | ✗ | ✗ | * | ✗ | ✗ |
| Outer container | ✓ | ✗ | ✓ | ✓ | ✓ | * | ✗ | ✓ |
| gVisor sandbox | ✗ | ✓ | ✓ | ✓ | ✓ | * | ✗ | ✓ |
| Components | |||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Certum Card | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | * | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✓ |
| Container manager | ✓ | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | * | ✓ | ✗ | ✗ | ✗ | ✓ | ✗ | ✓ | * | ✓ | ✓ |
| Container runtime | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | * | ✓ | ✗ | ✗ | ✗ | ✓ | ✗ | ✓ | * | ✓ | ✓ |
| Cosign Binary (build machines) | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | * | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ | ✓ | * | ✗ | ✓ |
| Cosign Binary (embedded) | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | * | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✓ | * | ✓ | ✓ |
| DZ App | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | * | ✓ | ✗ | ✓ | ✓ | ✓ | ✗ | ✓ | * | ✓ | ✓ |
| LibreOffice | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✓ | * | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ |
| PDF reader | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | * | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| YubiKey | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | * | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ |
| doc_to_pixels.py | ✗ | ✓ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✓ | ✗ | ✓ | * | ✓ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ |
| entrypoint.py | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | * | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ |
| Data | ||||||||
|---|---|---|---|---|---|---|---|---|
| Current Log Index | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| DZ container image | ✗ | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗ |
| DZ release binary | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ |
| DZ repo API target | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Digest of the container image to use | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Embedded Log Index | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ |
| Embedded Sandbox | ✗ | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗ |
| Pixels (rasterized document) | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Release Changelog | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Release Private Key | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | * | ✗ |
| Release Public Key | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ |
| Release Signature Data | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ |
| Release reference | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Remote Log Index | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ |
| Remote Sandbox Image | ✗ | ✓ | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ |
| Safe PDF | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Sandbox Private Key | ✓ | ✗ | ✗ | ✗ | ✓ | ✗ | * | ✗ |
| Sandbox Public Key | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ |
| Sandbox Signature Data | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ |
| Suspicious doc | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Datastore | ||
|---|---|---|
| Host storage | ✓ | * |
| ExternalEntity | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| DZ GitHub repo | ✓ | ✓ | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| External github repositories | ✗ | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✓ | ✗ |
| GitHub Container Registry | ✗ | ✓ | ✓ | ✗ | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ |
| GitHub release server | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ | ✓ | ✗ |
| Random doc source | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗ |
| Rekor Log Server | ✗ | ✓ | ✗ | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ |
| Server | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Build machines | ✓ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗ | * | ✗ | ✓ | ✓ | ✓ | * |
| DZ Linux package server | ✗ | ✗ | ✓ | ✓ | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | ✓ | ✓ | ✗ |
| dangerzone.rocks | ✗ | ✗ | ✓ | ✓ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✓ | ✓ | ✗ |