Skip to content

Home

KIMO

CTF challenges as on-demand containers on Kubernetes.

Players request an instance through a REST API; KIMO provisions a hardened pod, isolates it on the network, watches its health, and tears it down when its TTL runs out — keeping your scoreboard informed at every step.

Quickstart GitHub

  • On-demand instances

    One container per team or player, created through the REST API or by applying a ChallengeInstance resource.

  • TTL-driven lifecycle

    Every instance expires. A grace-window warning fires before teardown, then pod, service, and network policy are garbage-collected.

  • Health monitoring

    TCP or HTTP readiness probes drive the phase machine. A flapping challenge is marked Unhealthy instead of silently serving a broken service.

  • Network isolation

    Deny-by-default NetworkPolicy per instance: only exposed ports are reachable, egress is blocked.

  • Hardened pods

    Non-root, read-only root filesystem, no privilege escalation, no service-account token.

  • Proof-of-work gating

    Optional per-challenge SHA-256 puzzles stop instance-spawn abuse before it reaches the cluster.

  • Pluggable scoring backends

    CTFd works out of the box; anything else integrates through the generic HMAC-signed webhook adapter — or a small Go interface.

  • Scheduled rounds

    ChallengeSet groups challenges and opens and closes them inside a time window, no external triggers needed.

How it fits together

flowchart LR
    P[Player / Platform] -->|REST API| A[KIMO API :8080]
    A --> C[ChallengeInstance CR]
    C --> O[Controllers]
    O --> D[Deployment + Service]
    O --> F[NetworkFence → NetworkPolicy]
    O -->|lifecycle events| B[Scoring backend<br/>CTFd / generic webhook]

Where to go next