Coroner — Crash Forensics for Containers
Status: Under development for Kiroween 2026. This draft describes planned functionality, not completed or verified features.
Inspiration
When a container crashes or is killed by an out-of-memory condition, the process may disappear before an engineer can inspect its final moments. Coroner aims to preserve and reconstruct the evidence that preceded failure.
What we are building
Coroner is a crash-autopsy workstation for Python services. A lightweight instrumented FastAPI application exports recent runtime telemetry to an independent collector. The planned forensic interface will reconstruct the final seconds before a crash, showing memory trends, event-loop delays, request activity, and evidence gaps on a navigable timeline.
The interface will use a medical-examiner theme to make technical evidence easier to understand, not merely decorate ordinary logs.
Engineering principles
- Preserve evidence before process termination; never depend on a SIGKILL/OOM shutdown hook.
- Keep the recorder and collector isolated from the application under test.
- Report missing samples and uncertainty explicitly.
- Produce deterministic, evidence-backed findings rather than invented diagnoses.
Development checkpoints
M0 (in progress): FastAPI probe, independent collector, persistent JSONL evidence, reproducible exception/SIGKILL/container-OOM tests. Later stages (planned): Interactive forensic workstation, repeatable diagnostic reports, deployed judge-accessible demo, and Kiro development evidence.
Built with (planned)
Kiro, Python, FastAPI, Docker, TypeScript.
Kiroween category
Costume Contest.
Public source code, live demo, screenshots, and video will be added when available.
Built With
- docker
- fastapi
- kiro
- python
- typescript