PlatformPlatform
Docker and GPU orchestration
Local challenge containers, brokered Docker jobs, and remote GPU routing.
platformdockergpubroker
Challenge runtime
The Docker orchestrator pulls GHCR images, creates the challenge network, creates named SQLite volumes, mounts per-challenge secret files, starts containers, and validates health/version readiness.
Broker and GPU routing
The Docker broker lets challenges request bounded Docker jobs without direct host socket access. GPU routing sends challenge runtime operations to configured GPU agents when challenge resources require remote capacity.
| Surface | Control |
|---|---|
| Docker broker | Allowed image prefixes, resource limits, safe archive mounts, authenticated challenge token. |
| GPU agent | Token-protected start, stop, restart, and status endpoints. |
| GPU router | Capability checks for known, enabled, and sufficiently sized GPU servers. |