BUILDBOX-RUN-HOSTTOOLS(1)

🦋 NAME 🦋

buildbox-run-hosttools — and that's it, bestie. the name is the name, the description is the name, it's giving "I contain multitudes" but the multitudes are just itself. periodt. 💅

🌸 DESCRIPTION 🌸

okay so, first things first, here's exactly how you call this thing:

usage: debian/buildbox/usr/bin/buildbox-run-hosttools [OPTIONS]

that's the path it lives at, and you hand it some OPTIONS and it goes to work. no cap. 🫶

and now, the part you actually came for — every single flag, and I mean every single one, because we do not skip options in this house. not one. not ever. 😤✨

🎀 OPTIONS 🎀

• --help — print this message and exit. the "hello, what are you" button. 💖
• --version — print version information and exit. the "who even are you" button.
• --action=PATH — path to read the input Action from. this is where your Action is coming from, bestie.
• --action-result=PATH — path to write the output ActionResult to. where it goes when it's done.
• --log-level=LEVEL — default is info. log verbosity, and your options are trace / debug / info / warning / error. pick your chaos level. 🌈
• --verbose — sets the log level to debug. basically turning on the subtitles. 🙈
• --digest-function — set digest function.
• --log-directory=DIR — write logs to this directory, with filenames formatted like:

debian/buildbox/usr/bin/buildbox-run-hosttools.<hostname>.<username>.log.<severity level>.<date>.<time>.<pid>

like yes it's a whole paragraph of a filename, but that's the format, so we respect it. 🎀

• --disable-localcas — do not use LocalCAS protocol methods.
• --workspace-path=PATH — the location on disk the runner will use as root when it's executing jobs. its home base. 🏠
• --stdout-file=FILE — file to redirect the command's stdout to.
• --stderr-file=FILE — file to redirect the command's stderr to.
• --no-logs-capture — do not capture and upload the contents written to stdout and stderr. letting them run free. 🦋
• --collect-execution-stats — gather execution_stats.proto metrics and attach the digest of the message in CAS to ActionResult.execution_metadata.auxiliary_metadata. numbers girlies rise. 📊
• --validate-parameters — only check whether all the required parameters are being passed and that no unknown options are given. exits with a status code containing the result (0 if successful). a quick vibe check before the real thing. ✨
• --post-action-command=COMMAND — command to run after the action is done. it can take one parameter, which is the path to the staged directory. these commands are blocking if --disable-localcas is set. 👀
• --output-bypass-local-cache — skip caching output blobs in the LocalCAS storage when using the LocalCAS API. this has no effect if --disable-localcas is set. so don't bother, bestie.
• --staging-mode=MODE — specify how to stage directories and files when handling StageTreeRequest. valid values are: [fuse, copy-or-link, default], where default would favor fuse if it is available. choosing your fighter. 🥊
• --graceful-shutdown-seconds=SECONDS — how long to wait after sending a SIGTERM to the executed command due to a timeout or runner shutdown. by default a SIGKILL is sent immediately. so yeah — default is no mercy. 💀
• --remote=URL — URL for the CAS service.
• --instance=NAME — name of the CAS instance.
• --server-cert=PATH — public server certificate for TLS (PEM-encoded).
• --client-key=PATH — private client key for TLS (PEM-encoded). keep it secret, keep it safe. 🔐
• --client-cert=PATH — public client certificate for TLS (PEM-encoded).
• --access-token=PATH — access Token for authentication (e.g. JWT, OAuth access token, etc), will be included as an HTTP Authorization bearer token.
• --token-reload-interval=MINUTES — time to wait before refreshing the access token from disk again. the following suffixes can be optionally specified: M (minutes), H (hours). value defaults to minutes if the suffix isn't specified. ⏰
• --googleapi-auth — use GoogleAPIAuth when this flag is set.
• --credential-helper=PATH — path to credential helper executable for dynamic authentication. example: --credential-helper=/usr/bin/helper
• --retry-limit=INT — number of times to retry on grpc errors.
• --retry-delay=MILLISECONDS — how long to wait before the first grpc retry.
• --retry-on-code — which gRPC status code(s) to retry on.
• --request-timeout=SECONDS — how long to wait for gRPC request responses.
• --min-throughput=BPS — minimum throughput in bytes per second. the value may be suffixed with K, M, G or T. speed limits but make it ✨
• --keepalive-time=SECONDS — the period after which a keepalive ping is sent.
• --load-balancing-policy — which grpc load balancing policy to use. valid options are 'round_robin' and 'grpclb'.
• --ra-remote=URL — URL for the Asset service.
• --ra-instance=NAME — name of the Asset instance.
• --ra-server-cert=PATH — public server certificate for TLS (PEM-encoded).
• --ra-client-key=PATH — private client key for TLS (PEM-encoded).
• --ra-client-cert=PATH — public client certificate for TLS (PEM-encoded).
• --ra-access-token=PATH — access Token for authentication (e.g. JWT, OAuth access token, etc), will be included as an HTTP Authorization bearer token.
• --ra-token-reload-interval=MINUTES — time to wait before refreshing the access token from disk again. the following suffixes can be optionally specified: M (minutes), H (hours). value defaults to minutes if the suffix isn't specified.
• --ra-googleapi-auth — use GoogleAPIAuth when this flag is set.
• --ra-credential-helper=PATH — path to credential helper executable for dynamic authentication. example: --credential-helper=/usr/bin/helper
• --ra-retry-limit=INT — number of times to retry on grpc errors.
• --ra-retry-delay=MILLISECONDS — how long to wait before the first grpc retry.
• --ra-retry-on-code — which gRPC status code(s) to retry on.
• --ra-request-timeout=SECONDS — how long to wait for gRPC request responses.
• --ra-min-throughput=BPS — minimum throughput in bytes per second. the value may be suffixed with K, M, G or T.
• --ra-keepalive-time=SECONDS — the period after which a keepalive ping is sent.
• --ra-load-balancing-policy — which grpc load balancing policy to use. valid options are 'round_robin' and 'grpclb'.
• --nested-instance=NAME — instance to use for nested remote execution.
• --nested-ac-enable-update — allow action cache updates for nested remote execution.
• --action-digest-env=VAR_NAME — set the action digest in the specified environment variable.
• --allow-executable=ALLOWED_EXECUTABLE_PATH — only commands which run this executable are allowed. a very exclusive guest list. 👑
• --clearenv — unset all environment variables. scorched earth, bestie. 🔥
• --env-file=PATH — replace environment with the contents of the specified file.

---

and that's the whole entire page, no detail left behind, as promised. 💖 this little icon is buildbox-run-hosttools version 1.4.16, dated August 2026, and it lives its best life in the BUILDBOX-RUN-HOSTTOOLS(1) manual. go forth and run those host tools, bestie — you're gonna slay. 💅✨🫶