SentraZero
documentation.
Everything you need to deploy agents, write plugins, and run preprocessing pipelines — while your data stays on your infrastructure.
Deploy in
one command
One 12–15 MB Go binary. No Docker, no Kubernetes, no runtime installers. Download, claim, and run your first pipeline.
Install the agent
Download the binary for your platform and make it executable. The sandbox, GPU scheduling, and every runtime are built in.
# Download the binary from your dashboard → Agents # then, on the target machine: chmod +x sentra-agent ./sentra-agent --claim-code YOUR_TOKEN_HERE
Claim it to your workspace
On first run, the agent registers with your workspace using the claim code, then appears Online in your dashboard — ready to take jobs.
- Auto-detects formats: CSV, JSON, Parquet, image, video, PDF, audio
- Routes GPU plugins to GPU-capable devices automatically
- Data is processed in your storage: local path or object-store bucket
Configuration
basics
The agent works out of the box with sensible defaults. When you do tune it, the knobs are few and deliberate.
Starting the agent
The only required flag on first run is your claim code, generated in the dashboard. The agent reads any additional settings from environment variables or a .env file — every setting has a compiled default, so nothing is mandatory.
./sentra-agent --claim-code YOUR_TOKEN_HERE
Common settings you may want to set: your storage backend (local path or object-store bucket) and the signing keys used to verify plugins.
Storage
Point the agent at a local mount path or an object-store bucket. Datasets are read from and written to your storage — never uploaded.
Signing keys
Set the public keys used to verify plugins. Verification happens on the agent before anything runs, so unsigned code is rejected.
GPU devices
Plugins that need a GPU can use GPU-capable machines on your fleet. CPU-bound prep can be distributed across machines you already run.
How a pipeline
runs
Run where the data lives. Process in place. 0 bytes moved. Raw data never leaves your storage.
Data
arrivesUpload a dataset or point the agent at a folder. Formats — CSV, images, PDF, audio, and more — are detected automatically from content.
Agent
verifiesEvery plugin is checked against its signature before it runs. No unsigned code ever touches your machines.
Runs
in placeThe agent runs on machines you own against local disk, NAS, or an S3-compatible bucket. 0 bytes moved.
Results
stay where they belongOutput is written to your storage. Only outcome metadata and audit logs reach the control plane.
Writing
plugins
Bring your own preprocessing logic in any supported language. One signing flow, one sandbox, every runtime.
What you write
Any supported language
Python, Node.js, Go, Rust, Ruby, Bash, and more. Compiled and script plugins both run in the same sandbox with the same limits.
A manifest, not a harness
Declare name, version, language, and input/output schema. Runs inside the agent sandbox with resource limits.
Sign before you ship
Upload the plugin, sign it with your workspace key, and set it trusted in the dashboard. The agent verifies the signature on every download.
How it stays safe
Verified before execution
Checksum and signature are checked before a plugin is written to disk or executed. Anything invalid fails fast.
One sandbox for all runtimes
Every language gets identical isolation, resource limits, and GPU routing. No runtime gets special treatment.
Audit trail on every run
Signature, resource usage, and outcome are logged for every execution — queryable anytime for compliance review.
Security
model
Embedded in the agent, not bolted on. The controls are part of the binary — not a diagram.
Signed plugins
Every plugin is verified by signature before it runs. No unsigned code ever touches your machines.
Default-deny sandbox
Plugins run in a sandbox with a default-deny policy: network blocked, memory and CPU bounded, time-limited.
Per-OS isolation
macOS, Linux, and Windows each get native isolation — Seatbelt, namespaces + cgroups + seccomp, and job objects.
Zero client data
Only outcome metadata and audit logs are reported. Your data stays in your storage, confirmed by direct query.
Next
steps
Where to go from here, depending on what you are building.
Deploy your first agent
Five steps from a blank workspace to your first completed pipeline.
5-minute setupUnderstand the security model
Sandbox default-deny, plugin signing, and zero client data in the control plane.
Sandbox & signingRead the benchmarks
Real pipeline results: success rate, speedups, and verified zero data movement.
BenchmarksStart with the
quickstart
One binary, three env vars, and five minutes to your first pipeline. Everything else in the docs builds on that.