Help

Troubleshooting & cleanup

Every issue below was actually hit and fixed while building this workshop — not hypothetical.

Troubleshooting

"name already in use" on docker run --name casky-tollbooth

Not broken — it means setup already succeeded once for this attendee/session. Either reuse the existing container (skip straight to ./verify.sh) or run ./cleanup.sh first for a clean container.

"Checksum verification failed" installing Claude Code

Transient — the installer script downloads a native binary payload after itself and checksums that separately; an occasional network blip mid-download trips it. This happens at docker build time (baked into the image) — only relevant if you're rebuilding rather than pulling from GHCR. Just re-run the build, Docker's layer cache means everything before that RUN step is skipped:

docker build -t casky-tollbooth .

Commands fail with "no such file" / "no matches found"

Almost always a wrong working directory. Every command on the Setup page assumes you're in casky-workshops/tollbooth/ — both sections start with a one-line sanity check for exactly this reason:

# Section 1 (inside the Kali container)
docker exec casky-tollbooth test -f /root/tollbooth/verify.sh \
  && echo "[+] mount OK" || echo "[!] wrong directory — re-run from casky-workshops/tollbooth/"

# Section 2 (on the host, before copying evidence)
test -f lab-tollbooth.pcap && echo "[+] correct folder" || echo "[!] cd to casky-workshops/tollbooth first"

Invalid API key inside the Kali container

Almost certainly the quoted-value bug — see the Section 1 prerequisites on the Setup page. docker run --env-file does not strip quotes from .env values the way docker-compose does, so a key copied straight from casky-box/.env ends up starting with a literal " character. Re-run the sed fix from the Setup page and confirm with the grep -c '^sk-ant-' check before retrying.

Casky Box itself won't start / docker compose networking errors

That's a casky-box issue, not a TollBooth/OpenDoor one — check docker compose logs in that folder (stale exited-container/network-ID conflicts are the usual cause — docker compose down then up -d again clears most of them).

Cleanup

./cleanup.sh removes everything a run of this exercise creates outside the tollbooth/ folder: the casky-tollbooth container (Section 1) and any evidence files Section 2 copied into casky-box/evidence/. Safe to re-run — it reports what it found and skips what's already gone.

./cleanup.sh                                                  # container + copied evidence
./cleanup.sh --casky-box-path ../casky-box                    # if casky-box/ was moved elsewhere
./cleanup.sh --with-image                                      # also remove the casky-tollbooth image

It does not touch Casky Box's own containers (casky-runner, casky-db, casky-ui, …) — those are shared across workshops/attendees, not per-run litter — and it doesn't delete Postgres investigation records from casky harness runs, since those are history, not litter.

If lab-tollbooth.pcap/cloudtrail//opendoor/ get modified mid-exercise, restore them separately with:

docker exec -w /root/tollbooth casky-tollbooth ./reset.sh

Do this between attendees on the same Kali container — takes under 10 seconds.

Authorized & lawful use only. All data is synthetic and self-contained; no live systems are touched.