System Global Architecture

Cerberus is organized into three distinct tiers that run cooperatively to provide end-to-end security observability:

Cerberus Desktop: A native desktop application built with Wails v2, embedding the Go Sentinel daemon directly in-process.
Cerberus Sentinel: The central Go daemon containing the scheduling engine, hybrid scanner, identity resolver, posture calculator, and SQLite storage.
Cerberus Agent: A lightweight eBPF probe running in Linux kernel space, streaming process and network activity into Sentinel.

System Interaction Map

Cerberus Sentinel Global Architecture

Go 1.23 + Wails v2 + eBPF

Layer 1: Presentation

Wails v2 Desktop UI

React frontend embedded directly within the native OS window. Communicates with Sentinel via zero-overhead Wails IPC (no local HTTP server for UI).

• window.go.main.Bridge

• Temporal Timeline Renderer

• Live Log & Scan Stream

Layer 2: Core Sentinel Engine

Go Sentinel Daemon

Central orchestration hub. Serializes all scans via `scanGate`, coordinates the tri-stage engine, and computes posture scores.

• HybridEngine (L2/RustScan/Nmap)

• 3-Tier Matcher (identity.Resolve)

• Deterministic Rule Engine (detect)

• SQLite Storage (WAL mode)

Layer 3: Kernel Telemetry

eBPF Probe (Linux Agent)

Zero-overhead Linux kernel hooks streaming process exec, shell interaction, socket connections, and memory injection in signed batches.

• Loopback Ingest (127.0.0.1:8080)

• Process Exec & Shell Events

• MITRE ATT&CK Mapping

Architectural Principles

1. Zero Cloud Dependency (Local-First)

All telemetry, device histories, scan results, and vulnerability CVE records are stored exclusively in an embedded SQLite database on your local machine (cerberus.db). No telemetry or private IP addresses leave your network.

2. IPC Over HTTP for Desktop UI

Unlike many modern web-based administrative consoles that expose a local web server (which can be vulnerable to Cross-Site Scripting or unauthorized LAN access), the Cerberus Desktop UI never uses HTTP.

Instead, the React frontend communicates with the Go backend through Wails v2 Inter-Process Communication (IPC) using native runtime bindings (window.go.main.Bridge).

3. Loopback-Only Ingest Endpoint

The only HTTP listener started by the daemon is the agent telemetry ingest server. By default, it binds strictly to 127.0.0.1:8080. Any attempt to bind to external or non-loopback addresses is refused by internal/ingest/server.go to prevent unauthorized network injections.

Component Layout

The repository is modularized into clean Go packages under internal/:


├── cmd/
│   ├── sentinel/          # Headless CLI entrypoint (systemd / Docker)
│   └── helper/            # Privileged macOS helper (SMJobBless)
├── desktop/               # Wails v2 application shell & IPC bridge
├── front/                 # React UI frontend (submodule)
└── internal/
    ├── app/               # Daemon lifecycle & IPC business logic
    ├── scanner/           # Tri-Stage HybridEngine, Nmap & RustScan runners
    ├── scheduler/         # Periodic scan scheduling & serialized scanGate
    ├── identity/          # 3-Tier identity matcher & multi-channel resolver
    ├── detect/            # Deterministic MITRE ATT&CK threat engine
    ├── posture/           # Deterministic cvss-agg-v1 scoring
    ├── ingest/            # Loopback eBPF agent ingest server
    └── storage/           # SQLite migrations (1–8), queries, and transactions