BUILDBOX-RUN-BUBBLEWRAP(1)

📦
version 1.4.16 · 2 versions
, in ubuntu stonking

✨ NAME ✨

okay bestie, meet buildbox-run-bubblewrap — and that hyphenated one-liner is also buildbox-run-bubblewrap. this is the BUILDBOX-RUN-BUBBLEWRAP(1) manual, main character energy ✨

🛠️ DESCRIPTION 🛠️

so the vibe is: you run it like this:

usage: debian/buildbox/usr/bin/buildbox-run-bubblewrap [OPTIONS]

and then you pass options. here's every single one, fr fr: 💖

  • --help — Print this message and exit. short, sweet, iconic. ✨
  • --version — Print version information and exit. know your roots. 💅
  • --action=PATH — Path to read input Action from. the tea goes in here. 🫖
  • --action-result=PATH — Path to write output ActionResult to. the receipts come out here. 📝
  • --log-level=LEVEL — (default: info) Log verbosity: trace/debug/info/warning/error. pick your chaos level. 😭
  • --verbose — Set log level to debug. for when you need the whole lore. 🔍
  • --digest-function — Set digest function. cryptographic vibe check. 🧚
  • --log-directory=DIR — Write logs to this directory with filenames: debian/buildbox/usr/bin/buildbox-run-bubblewrap.<hostname>.<username>.log.<severity level>.<date>.<time>.<pid>. yes, that's a whole paragraph of filename, periodt. 💀
  • --disable-localcas — Do not use LocalCAS protocol methods. no LocalCAS, no problems? maybe. 🙈
  • --workspace-path=PATH — Location on disk which runner will use as root when executing jobs. the sandbox's home base. 🏠
  • --stdout-file=FILE — File to redirect the command's stdout to. catch those streams. 🌊
  • --stderr-file=FILE — File to redirect the command's stderr to. catch those screams. 😱
  • --no-logs-capture — Do not capture and upload the contents written to stdout and stderr. leave the stream raw, i guess. 🚫
  • --collect-execution-stats — Gather execution_stats.proto metrics and attach the digest of the message in CAS to ActionResult.execution_metadata.auxiliary_metadata. numbers? in my metadata? it's more likely than you think. 📊
  • --validate-parameters — Only check whether all the required parameters are being passed and that no unknown options are given. Exits with a status code containing the result (0 if successful). the pre-flight vibe check. ✅
  • --post-action-command=COMMAND — Command to run after the action is done. It can take one parameter which is the path to the staged directory. These commands are blocking if --disable-localcas is set. cleanup crew, assemble. 🧹
  • --output-bypass-local-cache — Skip caching output blobs in the LocalCAS storage when using the LocalCAS API. This has no effect if --disable-localcas is set. cache? never heard of her. (only if --disable-localcas isn't set, bestie.) 💅
  • --staging-mode=MODE — Specify how to stage directories and files when handling StageTreeRequest. Valid values are: [fuse, copy-or-link, default], where default would favor fuse if it is available. choose your staging era. 🎭
  • --graceful-shutdown-seconds=SECONDS — How long to wait after sending a SIGTERM to the executed command due to a timeout or runner shutdown. By default a SIGKILL is sent immediately. give 'em a moment before the ultimate yeet. ⏳
  • --remote=URL — URL for CAS service. where we're going, we need a URL. 🌐
  • --instance=NAME — Name of the CAS instance. name drop. 👑
  • --server-cert=PATH — Public server certificate for TLS (PEM-encoded). secure the bag. 🔒
  • --client-key=PATH — Private client key for TLS (PEM-encoded). keep it secret, keep it safe. 🤫
  • --client-cert=PATH — Public client certificate for TLS (PEM-encoded). public flex. 📜
  • --access-token=PATH — Access Token for authentication (e.g. JWT, OAuth access token, etc), will be included as an HTTP Authorization bearer token. bearer token, slay. 🎫
  • --token-reload-interval=MINUTES — Time to wait before refreshing access token from disk again. The following suffixes can be optionally specified: M (minutes), H (hours). Value defaults to minutes if suffix not specified. refresh, refresh, refresh. 🔄
  • --googleapi-auth — Use GoogleAPIAuth when this flag is set. google auth has entered the chat. 🔵
  • --credential-helper=PATH — Path to credential helper executable for dynamic authentication. Example: --credential-helper=/usr/bin/helper. dynamic auth, dynamic vibes. 🦋
  • --retry-limit=INT — Number of times to retry on grpc errors. if at first you don't succeed... 🔁
  • --retry-delay=MILLISECONDS — How long to wait before the first grpc retry. ...wait a bit, then try again. ⏱️
  • --retry-on-code — Which gRPC status code(s) to retry on. pick your retry triggers. 🎯
  • --request-timeout=SECONDS — How long to wait for gRPC request responses. patience is a virtue, but not infinite. ⏰
  • --min-throughput=BPS — Minimum throughput in bytes per second. The value may be suffixed with K, M, G or T. speed floor, no cap. 🏎️
  • --keepalive-time=SECONDS — The period after which a keepalive ping is sent. just checking in, bestie. 📡
  • --load-balancing-policy — Which grpc load balancing policy to use. Valid options are 'round_robin' and 'grpclb'. balance like a boss. ⚖️

and now, the RA (remote asset) variants, because she's thorough: 🎀

  • --ra-remote=URL — URL for Asset service. asset service, but make it RA. 🏦
  • --ra-instance=NAME — Name of the Asset instance. RA instance name drop. 👑
  • --ra-server-cert=PATH — Public server certificate for TLS (PEM-encoded). RA TLS, secure. 🔒
  • --ra-client-key=PATH — Private client key for TLS (PEM-encoded). RA private key, shh. 🤫
  • --ra-client-cert=PATH — Public client certificate for TLS (PEM-encoded). RA public cert, flex. 📜
  • --ra-access-token=PATH — Access Token for authentication (e.g. JWT, OAuth access token, etc), will be included as an HTTP Authorization bearer token. RA bearer token, same energy. 🎫
  • --ra-token-reload-interval=MINUTES — Time to wait before refreshing access token from disk again. The following suffixes can be optionally specified: M (minutes), H (hours). Value defaults to minutes if suffix not specified. RA token refresh, periodt. 🔄
  • --ra-googleapi-auth — Use GoogleAPIAuth when this flag is set. RA Google auth, say less. 🔵
  • --ra-credential-helper=PATH — Path to credential helper executable for dynamic authentication. Example: --credential-helper=/usr/bin/helper. RA dynamic auth, same helper example (yes, really). 🦋
  • --ra-retry-limit=INT — Number of times to retry on grpc errors. RA retry limit, go off. 🔁
  • --ra-retry-delay=MILLISECONDS — How long to wait before the first grpc retry. RA retry delay, wait for it. ⏱️
  • --ra-retry-on-code — Which gRPC status code(s) to retry on. RA retry codes, choose wisely. 🎯
  • --ra-request-timeout=SECONDS — How long to wait for gRPC request responses. RA timeout, don't wait forever. ⏰
  • --ra-min-throughput=BPS — Minimum throughput in bytes per second. The value may be suffixed with K, M, G or T. RA throughput floor. 🏎️
  • --ra-keepalive-time=SECONDS — The period after which a keepalive ping is sent. RA keepalive, checking in. 📡
  • --ra-load-balancing-policy — Which grpc load balancing policy to use. Valid options are 'round_robin' and 'grpclb'. RA load balancing, balanced. ⚖️

and the rest of the lineup, bestie: 🌸

  • --nested-instance=NAME — Instance to use for nested remote execution. nested? in this economy? 🪆
  • --nested-ac-enable-update — Allow action cache updates for nested remote execution. nested action cache updates, go off. 🗂️
  • --bind-mount=HOSTPATH:PATH — Bind mount file or directory from host into sandbox. bring the outside in. 🚪
  • --enable-tmp-outputs — Allow capturing outputs under /tmp directory in the sandbox. /tmp outputs? she's capturing everything. 📸
  • --ro-bind-mount=[CONTENT:]HOST_PATH:CHROOT_PATH — Bind a read-only path from HOST_PATH on the host filesystem to CHROOT_PATH inside the constructed chroot. If CONTENT is set, the bind only happens if the action has a property inject=CONTENT. read-only, no touchy. ✋
  • --oci-auth-token=PATH — Path to authentication token file for private registries. private registry token, keep it lowkey. 🔐
  • --num-parallel-layer-threads=N — Set the number of parallel threads for OCI layer processing. Default: min(hardware-concurrency, 8). threads go brrr. 🧵

that's the whole manual, bestie. this page is from buildbox-run-bubblewrap 1.4.16, dated August 2026, and it's part of the BUILDBOX-RUN-BUBBLEWRAP(1) manual. now go run something iconic. 💅✨

📦 where this page comes from