Skip to main content
A Destrier box is a controlled challenge environment built for autonomous security agents to attack. Each box defines its targets, vulnerabilities, objectives, build configuration, and intended solution. Start with the boxes-template repository. It includes the required schema, starter templates, working examples, and automated validation used during review.

​
Choose a box type

A single container-based target suited to lightweight and reproducible challenges. Common uses include web applications, vulnerable services, misconfigurations, and Linux privilege escalation. Container boxes are built from a Dockerfile.

​
What every box includes

  1. Manifest. A box.yaml file that defines the hosts, networks, objectives, static flags, entry point, and build configuration.
  2. Target files. The source files, Dockerfiles, Packer definitions, or disk images needed to create the challenge environment.
  3. Reference solver. A working solution that reviewers can use to verify the intended attack path and objectives.
  4. Documentation. A README.md explaining how the box is structured, built, tested, and solved.

​
Contributor workflow

1

Create a private repository

Create a repository from the Destrier box template and keep it private throughout development, review, and after submission.
2

Choose a template

Start from the container, virtual machine, or network template that best matches your challenge.
3

Build the challenge

Add the vulnerable targets, network layout, objectives, static flags, health checks, and required build files.
4

Add the reference solution

Document the intended attack path and include a solver that demonstrates each required objective.
5

Validate and submit

Validate the box locally, resolve any reported issues, and submit it through the boxr CLI for review.
Keep all box materials private during and after the competition. Paid contributors may also be required to sign a confidentiality agreement.
Last modified on August 8, 2026