Nacos is a production-grade dynamic service discovery, configuration management, and service management platform, originally built by Alibaba. The codebase is a large Java/Spring Boot monolith with a React frontend, organized into modules for core infrastructure (cluster, gRPC, Raft consensus, Distro sync), configuration management (CRUD, long-polling, gray rules, history), naming/service discovery (instance registration, health checks, push v2), and an extensive plugin system (auth, datasource, encryption, control, visibility). In recent versions, Nacos has expanded into AI resource management, adding modules for MCP server registry, agent specs, skills, prompts, A2A agent discovery, vector search indexing, and pipeline execution. The repository includes two frontend codebases (legacy console-ui and modern console-ui-next with Radix UI/Tailwind), a Java client SDK, and comprehensive unit/integration tests. The architecture is modular with SPI-based plugin loading, event-driven internal communication, and support for multiple databases (Derby, MySQL, PostgreSQL, Oracle). Despite its size and rapid AI feature growth, the codebase maintains solid engineering practices with clear separation of concerns, extensive test coverage, and a well-defined plugin contract.
Strelka is a real-time, containerized file scanning system designed for threat hunting, detection, and incident response at enterprise scale. It is built with a Go frontend and manager components that handle gRPC client intake, Redis-based task coordination, and response logging (local, Kafka, S3), while Python backend workers execute over 50 file-format scanners. The system uses YARA rules for initial file classification ('taste'), then dispatches files to specialized scanners for metadata extraction, IOC detection, archive extraction, and malware analysis. It supports multiple client modes: oneshot (CLI), filestream (continuous file monitoring), and a Python client. Deployment is via Docker Compose or Kubernetes, with optional Envoy proxy and OpenTelemetry tracing. The architecture follows a microservices pattern: frontend (gRPC server), coordinator (Redis task queue), gatekeeper (dedup cache), manager (Redis management), and backend (Python scanner workers). Scanners are dynamically loaded and configured via YAML, with positive/negative flavor matching. The codebase includes extensive test fixtures and pytest tests for each scanner, CI/CD pipelines, and pre-commit hooks. While the system is production-ready and well-structured, it exhibits some code duplication across archive scanners, deprecated library usage (pylzma, old protobuf), and brittle subprocess calls for password cracking. Overall, it is a strong, maintainable security analysis platform.
Haaukins is a cybersecurity training and Capture The Flag (CTF) platform developed at Aalborg University. It orchestrates isolated lab environments for teams, combining Docker containers and VirtualBox VMs to deliver challenges. The system is built as a set of gRPC microservices: a central daemon manages event lifecycle, team assignments, and challenge verification; a store service provides persistence; and an exercise service defines challenge configurations. Participants access labs via a web frontend (Amigo) using browser-based RDP (Guacamole) or WireGuard VPN. The daemon also handles DNS/DHCP per lab subnet, real-time scoreboards via WebSocket, and keylogging for monitoring. The CLI client (hkn) allows administrators to manage events, teams, and exercises. The architecture is modular with clean interfaces for virtualization (Docker/VirtualBox) and storage (in-memory with hooks or gRPC backend), though some components show tight coupling and aging dependencies.
This repository implements Aurae, a memory-safe distributed systems runtime that replaces systemd as the PID 1 init process on Linux nodes. It manages workloads (processes, containers, VMs) with cgroups v2 isolation, eBPF-based observability, and a gRPC API defined via protobuf. The system consists of three main binaries: auraed (daemon), auraescript (TypeScript scripting runtime), and aer (CLI). It also provides a partial Kubernetes CRI implementation and supports nested cells for multi-tenant isolation. The codebase is in early active development with many incomplete features and ignored tests, but demonstrates strong architectural patterns such as proc-macro-driven code generation, a reusable validation framework, and an eBPF abstraction layer. It is not production-ready.