BUILDBOX-RUN-BUBBLEWRAP(1)

NAME
buildbox-run-bubblewrap - buildbox-run-bubblewrap

DESCRIPTION
usage: debian/buildbox/usr/bin/buildbox-run-bubblewrap [OPTIONS]

--help
    Print this message and exit

--version
    Print version information and exit

--action=PATH
    Path to read input Action from

--action-result=PATH
    Path to write output ActionResult to

--log-level=LEVEL
    (default: info) Log verbosity: trace/debug/info/warning/error

--verbose
    Set log level to debug

--digest-function
    Set digest function

--log-directory=DIR
    Write logs to this directory with filenames: debian/buildbox/usr/bin/buildbox-run-bubblewrap.<hostname>.<user name>.log.<severity level>.<date>.<time>.<pid>

--disable-localcas
    Do not use LocalCAS protocol methods

--workspace-path=PATH
    Location on disk which runner will use as root when executing jobs

--stdout-file=FILE
    File to redirect the command's stdout to

--stderr-file=FILE
    File to redirect the command's stderr to

--no-logs-capture
    Do not capture and upload the contents written to stdout and stderr

--collect-execution-stats
    Gather `execution_stats.proto` metrics and attach the digest of the message in CAS to `ActionResult.execution_metadata.auxiliary_metadata`

--validate-parameters
    Only check whether all the required parameters are being passed and that no unknown options are given. Exits with a status code containing the result (0 if successful).

--post-action-command=COMMAND
    Command to run after the action is done. It can take one parameter which is the path to the staged directory. These commands are blocking if --disable-localcas is set.

--output-bypass-local-cache
    Skip caching output blobs in the LocalCAS storage when using the LocalCAS API. This has no effect if `--disable-localcas` is set.

--staging-mode=MODE
    Specify how to stage directories and files when handling StageTreeRequest. Valid values are: [fuse, copy-or-link, default], where `default` would favor `fuse` if it is available.

--graceful-shutdown-seconds=SECONDS
    How long to wait after sending a SIGTERM to the executed command due to a timeout or runner shutdown. By default a SIGKILL is sent immediately

--remote=URL
    URL for CAS service

--instance=NAME
    Name of the CAS instance

--server-cert=PATH
    Public server certificate for TLS (PEM-encoded)

--client-key=PATH
    Private client key for TLS (PEM-encoded)

--client-cert=PATH
    Public client certificate for TLS (PEM-encoded)

--access-token=PATH
    Access Token for authentication (e.g. JWT, OAuth access token, etc), will be included as an HTTP Authorization bearer token.

--token-reload-interval=MINUTES Time to wait before refreshing access token from disk again. The following suffixes can be optionally specified: M (minutes), H (hours). Value defaults to minutes if suffix not specified.

--googleapi-auth
    Use GoogleAPIAuth when this flag is set.

--credential-helper=PATH
    Path to credential helper executable for dynamic authentication. Example: --credential-helper=/usr/bin/helper

--retry-limit=INT
    Number of times to retry on grpc errors

--retry-delay=MILLISECONDS
    How long to wait before the first grpc retry

--retry-on-code
    Which gRPC status code(s) to retry on

--request-timeout=SECONDS
    How long to wait for gRPC request responses

--min-throughput=BPS
    Minimum throughput in bytes per second. The value may be suffixed with K, M, G or T.

--keepalive-time=SECONDS
    The period after which a keepalive ping is sent

--load-balancing-policy
    Which grpc load balancing policy to use. Valid options are 'round_robin' and 'grpclb'

--ra-remote=URL
    URL for Asset service

--ra-instance=NAME
    Name of the Asset instance

--ra-server-cert=PATH
    Public server certificate for TLS (PEM-encoded)

--ra-client-key=PATH
    Private client key for TLS (PEM-encoded)

--ra-client-cert=PATH
    Public client certificate for TLS (PEM-encoded)

--ra-access-token=PATH
    Access Token for authentication (e.g. JWT, OAuth access token, etc), will be included as an HTTP Authorization bearer token.

--ra-token-reload-interval=MINUTES Time to wait before refreshing access token from disk again. The following suffixes can be optionally specified: M (minutes), H (hours). Value defaults to minutes if suffix not specified.

--ra-googleapi-auth
    Use GoogleAPIAuth when this flag is set.

--ra-credential-helper=PATH Path to credential helper executable for dynamic authentication.
    Example: --credential-helper=/usr/bin/helper

--ra-retry-limit=INT
    Number of times to retry on grpc errors

--ra-retry-delay=MILLISECONDS How long to wait before the first grpc retry

--ra-retry-on-code
    Which gRPC status code(s) to retry on

--ra-request-timeout=SECONDS How long to wait for gRPC request responses

--ra-min-throughput=BPS
    Minimum throughput in bytes per second. The value may be suffixed with K, M, G or T.

--ra-keepalive-time=SECONDS The period after which a keepalive ping is sent

--ra-load-balancing-policy
    Which grpc load balancing policy to use. Valid options are 'round_robin' and 'grpclb'

--nested-instance=NAME
    Instance to use for nested remote execution

--nested-ac-enable-update
    Allow action cache updates for nested remote execution

--bind-mount=HOSTPATH:PATH
    Bind mount file or directory from host into sandbox

--enable-tmp-outputs
    Allow capturing outputs under /tmp directory in the sandbox

--ro-bind-mount=[CONTENT:]HOST_PATH:CHROOT_PATH
    Bind a *read-only* path from HOST_PATH on the host filesystem to CHROOT_PATH inside the constructed chroot. If CONTENT is set, the bind only happens if the action has a property `inject=CONTENT`

--oci-auth-token=PATH
    Path to authentication token file for private registries

--num-parallel-layer-threads=N
    Set the number of parallel threads for OCI layer processing. Default: min(hardware-concurrency, 8)