Help

Troubleshooting & cleanup

Every issue below was actually hit and fixed while building this workshop — not hypothetical.

Troubleshooting

"name already in use" on docker run --name kali-tollbooth

Not broken — it means setup already succeeded once for this attendee/session. Either reuse the existing container (skip straight to ./verify.sh) or run ./cleanup.sh first for a clean container.

"Checksum verification failed" installing Claude Code

Transient — the installer script downloads a native binary payload after itself and checksums that separately; an occasional network blip mid-download trips it. Just re-run the same install command:

docker exec kali-tollbooth bash -c "curl -fsSL https://claude.ai/install.sh -o /tmp/install.sh && bash /tmp/install.sh"

Commands fail with "no such file" / "no matches found"

Almost always a wrong working directory. Every command on the Setup page assumes you're in casky-workshops/tollbooth/ — both sections start with a one-line sanity check for exactly this reason:

# Section 1 (inside the Kali container)
docker exec kali-tollbooth test -f /root/tollbooth/verify.sh \
  && echo "[+] mount OK" || echo "[!] wrong directory — re-run from casky-workshops/tollbooth/"

# Section 2 (on the host, before copying evidence)
test -f lab-tollbooth.pcap && echo "[+] correct folder" || echo "[!] cd to casky-workshops/tollbooth first"

Invalid API key inside the Kali container

Almost certainly the quoted-value bug — see the Section 1 prerequisites on the Setup page. docker run --env-file does not strip quotes from .env values the way docker-compose does, so a key copied straight from casky-runner-phase1/.env ends up starting with a literal " character. Re-run the sed fix from the Setup page and confirm with the grep -c '^sk-ant-' check before retrying.

Casky Box itself won't start / docker compose networking errors

That's a casky-runner-phase1 issue, not a TollBooth/OpenDoor one — see that repo's own README troubleshooting section (it covers stale exited-container/network-ID conflicts and has a scripts/fix-stack.sh for it).

Cleanup

./cleanup.sh removes everything a run of this exercise creates outside the tollbooth/ folder: the kali-tollbooth container (Section 1) and any evidence files Section 2 copied into casky-runner-phase1/evidence/. Safe to re-run — it reports what it found and skips what's already gone.

./cleanup.sh                                                  # container + copied evidence
./cleanup.sh --casky-runner-path ../../casky-runner-phase1    # if that repo isn't a sibling of this one
./cleanup.sh --with-image                                      # also remove the kalilinux/kali-rolling image

It does not touch casky-runner-phase1's own containers (casky-runner, casky-db, skill-lab, …) — those are the persistent dev/workshop environment, not per-run litter — and it doesn't delete Postgres investigation records from casky harness runs, since those are history, not litter.

If lab-tollbooth.pcap/cloudtrail//opendoor/ get modified mid-exercise, restore them separately with:

docker exec -w /root/tollbooth kali-tollbooth ./reset.sh

Do this between attendees on the same Kali container — takes under 10 seconds.

Authorized & lawful use only. All data is synthetic and self-contained; no live systems are touched.