Quickstart

1. Get an API key

An API key belongs to your organization, not to you personally, and any member can use it. Keys can be revoked at any time; revocation takes effect within about a minute.

2. Log in

The username is ignored — the key is the password.

echo "$SAVANTENVS_API_KEY" | docker login inventory.forallsecure.com -u x --password-stdin

3. Pull an environment

Take an image name from the catalog — signed in with the organization your key belongs to — and pull it by tag. See Tags and entitlements for which tags your organization may pull:

docker pull inventory.forallsecure.com/<environment-name>:v1.0

4. Run it

An environment speaks the Model Context Protocol over standard input and output, so it is run attached and driven by your harness rather than started as a service.

docker run -i --rm \
  --cap-add=SYS_PTRACE \
  --cap-add=SYS_ADMIN \
  --cap-add=NET_ADMIN \
  --security-opt seccomp=unconfined \
  --security-opt apparmor=unconfined \
  --network=none \
  inventory.forallsecure.com/<environment-name>:v1.0

Those flags are not optional. Without SYS_ADMIN the environment cannot start a run of the target program at all — see host requirements for what each one does.

That command uses the image's own entry point, which starts a development server: fine for checking your plumbing, and not something to score with, because it has no resistance to reward hacking.

Running an environment covers both that and the custom form, where you choose the tools, the grading weights and the attempt budget.

If a pull fails

What you see	What it means
`manifest unknown`	Either the image does not exist, or your organization is not entitled to that tag. These are deliberately indistinguishable.
`401 Unauthorized`	The key is wrong, revoked or expired. Log in again.
`403 Forbidden`	Your organization is suspended. The key is valid; access is paused.

If a run fails

What you see	What it means
`unshare: operation not permitted`	`SYS_ADMIN` was not granted. The command is missing the flags above, or the host refuses them.
The server starts but ignores every option	The startup command was appended to the image's own entry point instead of passed with `--entrypoint`. Launching an environment has the detail.

Once a pull succeeds, Using an environment takes you from the image to a graded episode.