Detonate

Detonate is a runtime-analysis sandbox for software packages, binaries, and container images. It is best suited to security and engineering teams that can operate a Linux/KVM host and want artifact verdicts to inform deployment decisions.

Overview

Detonate runs dependencies in isolated micro-virtual machines and records file access, network connections, DNS queries, and process execution. Each run receives a benign, suspicious, or policy-violating verdict alongside an event timeline, giving teams behavioral evidence to review rather than relying only on an artifact’s identity.

The focus is software supply-chain analysis: teams can examine artifacts before release and use the REST API to connect results to deployment gates. This is a more specialized fit than a general endpoint security product. Containerized deployment requires a Linux x86_64 host with KVM support and Docker 24 or newer, making it a poor choice for teams that cannot manage that infrastructure.

Key features

Detonate accepts npm and PyPI packages, Maven artifacts, binaries, and Docker images. That range covers several common dependency and container workflows. Its event record captures multiple kinds of runtime behavior, while the timeline and three verdict classes help reviewers investigate what happened and decide whether a run meets their own release policy.

Decoy files, including fake SSH keys, cloud credentials, API tokens, and environment files, can flag attempts to access sensitive-looking material. This adds a useful signal to behavioral analysis, though it does not replace reviewing the surrounding events and deciding what they mean.

The sandbox is designed around Firecracker microVM isolation, KVM hardware isolation, gVisor support, seccomp-BPF profiles, and read-only root filesystems with tmpfs overlays. It has no internet access by default; outbound connections can be logged and optionally blocked. Those controls suit teams examining untrusted artifacts, while the host and container requirements add operating overhead.

A token-authenticated REST API supports artifact submission, status checks, verdicts, and reports, so teams can build checks into CI/CD deployment gates. The SMB plan also includes Slack, webhook, and email notifications; those notifications are a paid-plan feature in the plan information.

Pricing

Detonate has a free Community plan, a 14-day trial, and paid plans from $4,990/yr. The plan limits matter: higher run volumes and longer event retention require a paid tier, and the free option is constrained to a small number of concurrent sandboxes and API runs.

The stated result-retention period is 30 days, matching the SMB allowance; Community retains events for 7 days and Enterprise for a configurable year. The free plan’s forever billing makes it useful for a small self-hosted start, but its one-admin seat and 200 API runs/month limit its value as a shared release gate.

Platforms

Detonate supports API, Linux, self-hosted, and web access. The Linux x86_64 and KVM host requirement is central to deployment, not a minor platform preference; teams without that environment should consider a different operating model.

Who it's for

Detonate fits security or engineering teams that need runtime evidence for software dependencies and want to incorporate verdicts and reports into CI/CD. Community suits a small-scale self-hosted evaluation or low-volume use; SMB is the more practical tier for a team with several users and recurring runs; Enterprise is aimed at organizations that need access controls, audit logging, air-gapping, or higher volume and retention.

It is less suitable for users seeking a turnkey hosted service, broad consumer protection, or a Windows-based analysis host. The Linux/KVM requirement and plan quotas should be part of the decision from the outset.

Pros and cons

• Pro: Analyzes npm, PyPI, Maven, binaries, and Docker images in isolated micro-VMs, giving teams one workflow across several artifact types.
• Pro: Captures file, network, DNS, and process activity and pairs it with an event timeline and categorized verdicts.
• Pro: A token-authenticated REST API supports CI/CD submission and deployment checks, while outbound traffic can be logged and optionally blocked.
• Con: Containerized deployment requires Linux x86_64, KVM, and Docker 24 or newer, which creates an infrastructure burden.
• Con: Community is limited to 2 concurrent sandboxes, 200 API runs/month, 7-day retention, and 1 admin user, so it is not a generous shared-team tier.
• Con: SMB costs $4,990 a year and caps usage at 5,000 runs/month and 30-day retention; larger needs push buyers to Enterprise.

Alternatives

For a broader set of malware-analysis sandbox options, see Malware Analysis Sandboxes.

• ANY.RUN is a freemium alternative with a free Community plan and support across Android, API, Linux, macOS, web, and Windows; choose it if that platform range is a better match.
• Retrace offers a free Community plan with feed access, a standard execution queue, web interface, basic report export, and unlimited public analyses; consider it if those community capabilities suit your analysis needs.
• Malwagon has a free scan tier with 3 scans per source address per day, Windows 10 22H2, no internet egress, and public reports; it is an option for that specific free scanning setup.
• CAPE Sandbox is free, open-source, and self-hosted; choose it if an open-source self-hosted sandbox is the priority.
• Hybrid Analysis offers a free community service capped at 30 file uploads per month and 100 MB per upload; that makes it an alternative for limited file-upload analysis.
• Bitdefender Total Security is a paid consumer security product with Android, iOS, macOS, and Windows support; it is an alternative for users looking for that kind of device coverage rather than artifact sandboxing.
• Hatching Triage offers volume-based licensing, with packages starting at 500 analyses per day and scaling toward 50,000; it may suit buyers organizing around daily analysis volume.
• ReversingLabs Cloud Sandbox offers a feature preview limited to 5 samples per day, with full access available at additional cost; consider it if that preview model fits.

Verdict

Choose Detonate if your security or engineering team needs isolated runtime analysis across common software artifacts and wants API-based deployment gates. Its mix of behavioral events, verdicts, and outbound-network controls is the core reason to choose it. Look elsewhere if you need a hosted, low-operations service or cannot meet the Linux/KVM requirement; for team use, also weigh the annual cost and the run and retention limits of SMB.