Something went wrong. RecordingController.swift, line 214.
Crashbox is a self-hosted crash and error service that speaks the Sentry envelope protocol. Keep the SDKs you already ship, point them at your own host, and get symbolicated stack traces, grouped issues, and regressions without a third party holding your users' data.
What happens to an event
The public edge accepts an envelope only after it has been written to a durable queue. Everything expensive happens afterwards, in bounded workers, per project.
Limits before parsing
Body, header, item, nesting and decompression limits are checked before any allocation. Rejections are stable and never echo the payload.
Durable before acknowledged
The 202 is returned only once the scrubbed envelope is in a bounded, durable queue. One broken SDK cannot starve another project.
Secrets and PII removed server-side
Recursive scrubbing runs before anything durable is stored. Raw payloads, credentials and request bodies are never logged.
Deterministic issues
Exception types and application-owned frames form the fingerprint. Line numbers, addresses and messages do not split otherwise equal crashes.
dSYMs and source maps
Upload private debug artifacts per project. Apple frames resolve to function, file and line; browser frames use the release's map.
Transitions, not noise
New, regressed and resolved are explicit issue transitions. Crashbox decides when one warrants an alert and hands it to your gateway.
Keep the SDK. Change the DSN.
Crashbox accepts a documented subset of the Sentry envelope protocol. Cocoa, Python and browser JavaScript SDKs send events without a custom client library. Each supported SDK version is fixture-tested and canaried before it is listed.
SentrySDK.start { options in
options.dsn = "https://PUBLIC_KEY@crashbox.example.com/42"
options.releaseName = "com.example.tonebox@1.14.2+3121"
options.environment = "production"
}
Upload the matching dSYM once per release. Frames from that build resolve on the server; the dSYM never leaves your host.
sentry_sdk.init(
dsn="https://PUBLIC_KEY@crashbox.example.com/7",
release="receipt-sync@2026.09.1",
environment="production",
traces_sample_rate=0, # tracing is rejected at the edge
)
Error and message events are accepted. Transactions, profiles and replays are rejected with a stable response rather than silently stored.
Sentry.init({
dsn: "https://PUBLIC_KEY@crashbox.example.com/11",
release: "keepfloat-web@4.2.0",
environment: "production",
});
Upload the release's source map and Crashbox overlays original file and line on minified frames. Browser ingestion uses credential-free Access-Control-Allow-Origin: *; preflights allow only POST and the documented request headers.
Small on purpose
Crashbox does one job and refuses the rest at the edge. That is what keeps it possible to run on a single host and reason about under load.
Crashbox owns
The path from a crash to a fixable line, and the evidence that path was taken.
- Projects and public DSN keys, with per-project isolation and quotas
- Bounded envelope ingestion and a durable admission queue
- Recursive secret and PII scrubbing before storage
- Deterministic grouping, occurrence counts, regressions and release history
- dSYM and source-map catalogs and asynchronous symbolication
- Retention, encrypted off-host backups and restore drills
- Deciding when an issue transition should raise an alert
Crashbox does not own
Anything that would turn a crash service into an observability platform.
- Logs, metrics, distributed tracing, profiling or session replay
- Alert-provider credentials or cross-service notification routing
- Customer email, push or SMS notifications
- A custom SDK, when the upstream Sentry SDK can be configured
| Runs on | One host. Python 3.12, Gunicorn, PostgreSQL 17, and a SQLite admission queue. systemd units and reverse-proxy contracts are included. |
|---|---|
| Default ingest limits | 1,000,000 byte body, 8,192 byte header lines, 750,000 byte items, 20 items per envelope. Projects can be set lower. |
| Accepted items | event. Attachments are not supported; a later policy may allow them only for explicit projects under bounded MIME and size rules. Sessions, transactions, profiles and replays are rejected. |
| Symbolication | Apple dSYMs via atos on macOS or a pinned LLVM 18 toolchain on Linux. JavaScript source maps per release. Uploaded files are treated as data, never executed. |
| Backups | Encrypted bundles shipped off-host on a timer, with a separate-host weekly restore drill of PostgreSQL, SQLite and artifacts. |
Built for teams that would rather run one small thing well.
Cocoa, Python and browser infrastructure has passed production canaries; real application migrations remain staged until their rollout, rollback and observation gates pass. If you want to run it, or want us to run it for you, write to us.