Skip to content
Sandbox

It just works, and it cannot reach the network.

Every analysis runs inside a container: hardened enough that your security team can read the flags and relax, and prepared enough that you never spend a Tuesday fighting a Bioconductor dependency again.

Install InflexaRead the container config

The stack is already inside.

Everyone who has done this work has lost a day to it: a package that will not compile, a C library the R package silently needs, a version conflict that only manifests on your colleague's machine. It is the tax that computational biology charges before you are allowed to do any biology.

Inflexa arrives with that stack already resolved and working. You do not install anything. You do not manage an environment. The analysis runs on your machine, in a container that already knows how to run it.

And when an analysis needs a package the stack does not have, that is one command, not a rebuild. Packages live in a store on your machine rather than baked into the container image, so inflexa store add <package> resolves it, installs it once, and links it into the analysis that asked. Every other analysis on the machine keeps the package set it was working with.

Ready before you start

  • R 4.6.0, Python 3.12, Node 20
    the interpreters, in the image
  • bioconda
    samtools, bcftools, bedtools, plink2 and the rest, in the image
  • The scientific stack
    scanpy, scikit-learn, DESeq2, limma, edgeR, clusterProfiler and hundreds more, from the package store
  • Whatever else you need
    one command resolves it from PyPI, CRAN, or Bioconductor

These are real downloads and they are not small. The first inflexa setup asks once, then fetches the images and the packages in the background while you keep working. After that they are on your disk.

An AI writes code and then runs it. That should worry you.

It worried us, which is why the container is locked down by default rather than as an option you have to find. Here is what is on, before you configure anything.

Runs as a non-root user
Code the agent writes cannot escalate to root inside the container.
All Linux capabilities dropped
No raw sockets, no mounting, no ptrace. The container gets nothing it does not need.
no-new-privileges is set
A setuid binary inside the image cannot be used to gain privileges.
Input files mounted read-only
An analysis cannot overwrite the data it was given, accidentally or otherwise.
Network egress denied by default
Generated code cannot phone home. Not to an attacker, and not to us. You allow specific access when an analysis genuinely needs it.

And you do not have to take our word for any of it. The container configuration is in a public repository under Apache 2.0. Your security team can read the actual flags rather than a marketing page about the flags. That is the difference between a vendor asserting a control and a control you can verify.

Docker or Podman is required. There is no way around it.

Inflexa will not fall back to running analysis code directly on your machine if no container runtime is present, it will refuse to start. That is a deliberate choice and occasionally an inconvenient one. We are not willing to execute model-generated code against your filesystem with nothing in between, and we would rather lose the install than do it.

Install it and read the container config.

Both take about a minute, and the second one is the one that will convince you.

Install Inflexa