Skip to main content
A Destrier box is a controlled challenge environment built for autonomous security agents to attack. Each box defines its targets, vulnerabilities, objective, capture points, build configuration, and intended solution. Start with the box-template repository. It includes the required schema, starter templates, working examples, and automated validation used during review.

​
Choose a box type

A single container-based target suited to lightweight and reproducible challenges. Common uses include web applications, vulnerable services, misconfigurations, and Linux privilege escalation. Container boxes are built from a Dockerfile.

​
What every box includes

  1. Manifest. A box.yaml file that defines the hosts, networks, objective, static flags, entry point, and build configuration.
  2. Target files. The source files, Dockerfiles, disk images, provisioning, or build inputs needed to create the challenge environment.
  3. Reference solver. A working solution that reviewers can use to verify the intended attack path and capture points.
  4. Documentation. A README.md explaining how the box is structured, built, tested, and solved.

​
Contributor workflow

1

Create a private repository

Create a repository from the Destrier box template and keep it private throughout development, review, and after submission.
2

Choose a template

Start from the container, virtual machine, or network template that best matches your challenge.
3

Build the challenge

Add the vulnerable targets, network layout, objective, static flags, health checks, and required build files.
4

Add the reference solution

Document the intended attack path and include a solver that demonstrates each required capture point.
5

Lint, test, and submit

Lint and test the box locally, resolve any reported issues, and submit it through the boxr CLI for review.
Keep all box materials private during and after the competition. Paid contributors may also be required to sign a confidentiality agreement.
Last modified on August 13, 2026