Entry-Point Runtime — Elixir / Erlang (BEAM)

Heuristics the Stella Ops scanner uses to classify a container entry point as an Elixir or Erlang service running on the BEAM VM, plus the evidence it attaches and the edge cases it guards against. For the shared detector contracts, scoring, and calibration, see the Runtime Detector Overview.

Signals to gather

• argv0 equals elixir, iex, mix, erl, beam.smp, or release scripts (bin/app start).
• Release layouts: _build/prod/rel/<app>/bin/<app>, releases/<version>/vm.args, sys.config.
• Environment variables (MIX_ENV, RELEASE_COOKIE, RELEASE_NODE).
• Config files (config/config.exs, config/prod.exs).

Implementation notes

• Recognise Distillery / mix release scripts that exec the real BEAM VM.
• When release script is invoked with eval, treat the wrapper as part of the chain but classify runtime as Elixir.
• Inspect vm.args for node name, cookie, and distributed settings.
• For pure Erlang services (no Elixir), the same detector should fire using erl hints.

Evidence & scoring

• Boost for release directories and BEAM VM binaries (beam.smp).
• Add evidence for config files and env vars.
• Penalise minimal images lacking release artefacts (could be generic shell wrappers).

Edge cases

• Phoenix apps often rely on a bin/server wrapper — ShellFlow must collapse it to the release script.
• Multi-node clusters may start multiple BEAM instances; classify as a Supervisor when several nodes stay active.

Related

• Runtime Detector Overview — shared contracts, scoring, calibration.
• Supervisor detector — multi-node BEAM clusters.