← cracked.bot

The Toolbox

The base image every Cracked Robot session boots from.

What it is

Cracked Robot runs autonomous build and verify sessions on ephemeral machines — one machine per session, destroyed when the session ends. Every machine boots from one shared base image, the Toolbox: the infrastructure tooling a session reaches for, pre-installed, so no session spends its budget re-installing the same setup.

It is infra only. Project dependencies (requirements.txt, package.json) stay in each project's repo and are installed by the session inside its own checkout — the image never bakes in a project.

Structure

  • Base — Debian bookworm with Python 3.12 (python:3.12-slim).
  • Vendor layer — the CLI roster below, installed from each vendor's own signed repository or installer.
  • Verification layer — Playwright with Chromium and its system libraries at a shared, world-readable path, so a project pinning a different Playwright version re-downloads only the browser build.
  • Gate — the build ends by running every tool's --version; any broken tool fails the build, so a dead CLI can never ship.

No secrets live in the image. Credentials (a 1Password Service Account token, a scoped GitHub token, deploy tokens) are injected per-session at boot and die with the machine.

Available plugins

Runtimes

The fleet's stacks: Django + Python backends, Next.js frontends.

  • python 3.12backend runtime; pip included
  • uvfast Python package manager (uv pip / uv run)
  • node 22 LTSNext.js builds; npm + npx included

Credentials & cloud

Every credential arrives per-session via env — the image holds no secrets.

  • op1Password CLI — resolves op:// secret references just-in-time
  • ghGitHub CLI — repos, PRs, checks
  • awsAWS CLI v2
  • gcloudGoogle Cloud CLI

Data

Matches the fleet's PostgreSQL 16.

  • psql / pg_dumppostgresql-client-16
  • libpq-devbuilds psycopg and friends from source when needed

Verification

Verify sessions run the project's own test suites as the eval gate.

  • playwright + chromiumbrowser e2e, system deps pre-installed at a shared path
  • build-essentialcompiles C-extension wheels during dependency installs

Basics

The everyday hands.

  • gitcheckouts, branches, commits
  • rg (ripgrep)fast code search
  • jqJSON on the command line
  • curl / ssh / gnupg / unziptransport and packaging plumbing

MCP servers

Model Context Protocol tooling needs no baking in: remote MCP servers (like GitHub's hosted endpoint) are reached over the network, and package-distributed MCP servers run on demand via npx — Node 22 in the image is what makes that instant.

Image

cr-runners:toolbox-latest

linux/amd64 · built and version-gated on every push. This page tracks the image; when the roster changes, so does this list.