Sandbox

It just works, and it cannot reach the network.

Every analysis runs inside a container: hardened enough that your security team can read the flags and relax, and prepared enough that you never spend a Tuesday fighting a Bioconductor dependency again.

Install InflexaRead the container config
No package installation headaches

The stack is already inside.

Everyone who has done this work has lost a day to it: a package that will not compile, a C library the R package silently needs, a version conflict that only manifests on your colleague's machine. It is the tax that computational biology charges before you are allowed to do any biology.

Inflexa's sandbox image arrives with the scientific stack already resolved and working. You do not install anything. You do not manage an environment. The analysis runs on your machine, in a container that already knows how to run it.

Prebaked in the image

  • R 4.6.0
    with the Bioconductor stack
  • Python 3.12
    scanpy, scikit-learn, statsmodels, the usual
  • Node 20
    for tooling and report generation
  • bioconda
    the standard bioinformatics packages, already resolved

The image is a real download and it is not small. The first inflexa setup will pull it, and that takes a few minutes on a decent connection. After that it is on your disk.

What your security team will ask

An AI writes code and then runs it. That should worry you.

It worried us, which is why the container is locked down by default rather than as an option you have to find. Here is what is on, before you configure anything.

Runs as a non-root user
Code the agent writes cannot escalate to root inside the container.
All Linux capabilities dropped
No raw sockets, no mounting, no ptrace. The container gets nothing it does not need.
no-new-privileges is set
A setuid binary inside the image cannot be used to gain privileges.
Input files mounted read-only
An analysis cannot overwrite the data it was given, accidentally or otherwise.
Network egress denied by default
Generated code cannot phone home. Not to an attacker, and not to us. You allow specific access when an analysis genuinely needs it.

And you do not have to take our word for any of it. The container configuration is in a public repository under Apache 2.0. Your security team can read the actual flags rather than a marketing page about the flags. That is the difference between a vendor asserting a control and a control you can verify.

Docker or Podman is required. There is no way around it.

Inflexa will not fall back to running analysis code directly on your machine if no container runtime is present, it will refuse to start. That is a deliberate choice and occasionally an inconvenient one. We are not willing to execute model-generated code against your filesystem with nothing in between, and we would rather lose the install than do it.

Install it and read the container config.

Both take about a minute, and the second one is the one that will convince you.

Install Inflexa