Skip to content

DocBunker

Open untrusted documents in a sandbox. PDFs, images, Office files — only pixels reach your machine.

Download How it works

Download

0.1.0 — GitHub Releases

Windows

Windows 10/11 x64. Install QEMU.

macOS

Apple Silicon. brew install qemu.

Linux

x86_64 / aarch64. QEMU from your repos.

How it works

  1. Boot a sandbox — no network, no file access, memory/CPU limits.
  2. Document bytes go in through a size-capped channel.
  3. Untrusted worker renders it, sends pixels back.
  4. Pixels are re-checked before reaching your screen.
  5. On close, the sandbox is killed.

Even a full parser exploit lands in a box with nothing to steal. Honest about what we can't protect against.

FAQ

Why not my browser/Office viewer? Their parsers run with full machine access. One bug away from code execution.

Can I copy text? Not yet. Pixels only — documents can't smuggle scripts or links.

Start here

CONTRIBUTING.md · SECURITY.md