BUILDBOX-RUN-OCI(1)

📦
version 1.4.16 · 2 versions
, in ubuntu stonking

💖 BUILDBOX-RUN-OCI 💖

okay so bestie, welcome to buildbox-run-oci, which lives in section 1 of the manual (that's the "type it in your terminal, queen" section). this is the whole entire page, no skips, no cuts, we're doing all of it. grab a strawberry 🍓 and let's go.

✨ NAME ✨

buildbox-run-oci — it's literally just buildbox-run-oci, that's the name, that's the girl 💅

🌈 DESCRIPTION 🌈

the vibe of this whole thing is:

usage: debian/buildbox/usr/bin/buildbox-run-oci [OPTIONS]

so you run that path, you throw some options at it, and it does its lil thing. all the options are down below, and there are a lot of them, so no skipping ahead, i'll know 🫶

  • --help — prints this message and then dips. that's it, that's the whole job ✨
  • --version — prints the version info and exits. short and sweet, we love a low-maintenance icon 👑
  • --action=PATH — the path to read the input Action from. that's where the Action is, bestie, go read it.
  • --action-result=PATH — the path to write the output ActionResult to. one goes in, one comes out, very balanced 💖
  • --log-level=LEVEL — (default: info) how much gossip do you want in the logs? pick your fighter: trace / debug / info / warning / error. trace is the girl who tells you EVERYTHING, error is the girl who only speaks when something's on fire 😭
  • --verbose — just sets the log level to debug. one-flag shortcut, we love efficiency ✨
  • --digest-function — set the digest function. you pick it, it uses it, no further questions 💅
  • --log-directory=DIR — writes logs into this directory, and the filenames it uses are exactly this:
debian/buildbox/usr/bin/buildbox-run-oci.<hostname>.<username>.log.<severity level>.<date>.<time>.<pid>

like yes it's long, it's giving "my full legal name", but every piece of it is meaningful and we respect it 🌸

  • --disable-localcas — do not use LocalCAS protocol methods. turning this on is a whole lifestyle change, just so you know 🦋
  • --workspace-path=PATH — where on disk the runner hangs out and uses as its root when it's executing jobs. this is home base, periodt 🏠
  • --stdout-file=FILE — the file that the command's stdout gets redirected into 💙
  • --stderr-file=FILE — same energy, but for stderr 🩷
  • --no-logs-capture — do not capture and upload whatever got written to stdout and stderr. if you don't want it saved, this is the flag, no cap 🙈
  • --collect-execution-stats — gathers execution_stats.proto metrics and attaches the digest of that message in CAS to ActionResult.execution_metadata.auxiliary_metadata. yes it's a mouthful, yes it's correct, i don't make the rules ✨
  • --validate-parameters — just a check-up appointment: it verifies all the required parameters are actually being passed and that no unknown options showed up. it exits with a status code containing the result (0 if successful). think of it as a vibe check before the real thing 🧚
  • --post-action-command=COMMAND — a command to run after the action is done. it can take one parameter, which is the path to the staged directory. heads up: these commands are blocking if --disable-localcas is set 🔥
  • --output-bypass-local-cache — skips caching output blobs in the LocalCAS storage when you're using the LocalCAS API. important: this has no effect if --disable-localcas is set. like, zero. nothing. nada 💀
  • --staging-mode=MODE — specifies how to stage directories and files when handling StageTreeRequest. valid values are: [fuse, copy-or-link, default], where default will favor fuse if it's available. choose wisely bestie 💅
  • --graceful-shutdown-seconds=SECONDS — how long to wait after sending a SIGTERM to the executed command, because of a timeout or a runner shutdown. and btw: by default a SIGKILL is sent immediately. no grace, no warning, just gone 😭
  • --remote=URL — URL for the CAS service 🌐
  • --instance=NAME — name of the CAS instance 🏷️
  • --server-cert=PATH — public server certificate for TLS (PEM-encoded) 🔐
  • --client-key=PATH — private client key for TLS (PEM-encoded) 🔑
  • --client-cert=PATH — public client certificate for TLS (PEM-encoded) 📜
  • --access-token=PATH — access Token for authentication (e.g. JWT, OAuth access token, etc), and it will be included as an HTTP Authorization bearer token. very "she has credentials" of you 👑
  • --token-reload-interval=MINUTES — time to wait before refreshing the access token from disk again. you can optionally slap a suffix on it: M (minutes), H (hours). if you don't give a suffix, the value defaults to minutes. so no suffix = minutes, always ⏰
  • --googleapi-auth — use GoogleAPIAuth when this flag is set. flag on, Google auth on 🌸
  • --credential-helper=PATH — path to the credential helper executable for dynamic authentication. example: --credential-helper=/usr/bin/helper 🧚
  • --retry-limit=INT — number of times to retry on grpc errors. resilience queen 💪
  • --retry-delay=MILLISECONDS — how long to wait before the very first grpc retry ⏳
  • --retry-on-code — which gRPC status code(s) to retry on 🔁
  • --request-timeout=SECONDS — how long to wait for gRPC request responses. patience has a limit, and this is it ⌛
  • --min-throughput=BPS — minimum throughput in bytes per second. the value may be suffixed with K, M, G or T. so you can be dramatic about it if you want ✨
  • --keepalive-time=SECONDS — the period after which a keepalive ping is sent. just checking in, hope you're well 💖
  • --load-balancing-policy — which grpc load balancing policy to use. valid options are 'round_robin' and 'grpclb' 🎀
  • --ra-remote=URL — URL for the Asset service 🗂️
  • --ra-instance=NAME — name of the Asset instance 🏷️
  • --ra-server-cert=PATH — public server certificate for TLS (PEM-encoded) 🔐
  • --ra-client-key=PATH — private client key for TLS (PEM-encoded) 🔑
  • --ra-client-cert=PATH — public client certificate for TLS (PEM-encoded) 📜
  • --ra-access-token=PATH — access Token for authentication (e.g. JWT, OAuth access token, etc), will be included as an HTTP Authorization bearer token 👑
  • --ra-token-reload-interval=MINUTES — time to wait before refreshing the access token from disk again. the following suffixes can be optionally specified: M (minutes), H (hours). value defaults to minutes if the suffix isn't specified ⏰
  • --ra-googleapi-auth — use GoogleAPIAuth when this flag is set 🌸
  • --ra-credential-helper=PATH — path to credential helper executable for dynamic authentication. example: --credential-helper=/usr/bin/helper 🧚
  • --ra-retry-limit=INT — number of times to retry on grpc errors 💪
  • --ra-retry-delay=MILLISECONDS — how long to wait before the first grpc retry ⏳
  • --ra-retry-on-code — which gRPC status code(s) to retry on 🔁
  • --ra-request-timeout=SECONDS — how long to wait for gRPC request responses ⌛
  • --ra-min-throughput=BPS — minimum throughput in bytes per second. the value may be suffixed with K, M, G or T ✨
  • --ra-keepalive-time=SECONDS — the period after which a keepalive ping is sent 💖
  • --ra-load-balancing-policy — which grpc load balancing policy to use. valid options are 'round_robin' and 'grpclb' 🎀
  • --nested-instance=NAME — the instance to use for nested remote execution 🪆
  • --nested-ac-enable-update — allow action cache updates for nested remote execution ✅
ok iconic reminder bestie: some of these interact. if --disable-localcas is set, --output-bypass-local-cache does literally nothing, and --post-action-command commands are blocking. and with no --graceful-shutdown-seconds, the SIGKILL comes immediately. love a flag that tells you the tea upfront 💅

and that's the whole page, fr fr, nothing left out 🌈

buildbox-run-oci version 1.4.16, dated August 2026. shoutout to whoever wrote this and to whatever license you shipped it under, mwah, and to you for reading all 55-ish options like a true main character 👑💜 bye bestie!

📦 where this page comes from