---
title: Cratera
description: Cratera is an open-source, self-hosted code execution engine that securely runs untrusted code inside isolated Firecracker microVMs. Built for online …
product: Marketplace
url: https://docs.digitalocean.com/products/marketplace/catalog/cratera/
last_updated: "2026-09-15"
---

> **For AI agents:** The documentation index is at [https://docs.digitalocean.com/llms.txt](https://docs.digitalocean.com/llms.txt). Markdown versions of pages use the same URL with `index.html.md` in place of the HTML page (for example, append `index.html.md` to the directory path instead of opening the HTML document).

# Cratera

Generated on 15 Sep 2026 from [the Cratera catalog page](https://marketplace.digitalocean.com/apps/cratera)

Cratera is an open-source, self-hosted code execution and judge engine for online judges, programming assessments, AI coding tools, and internal code runners.

Submitted code executes inside Firecracker microVMs using KVM virtualization, a separate guest Linux kernel, and no guest network interface. Cratera provides an authenticated HTTP API, configurable execution limits, bounded job scheduling, and snapshot-based startup.

This image includes Cratera 1.2.0 with a minimal Rust-only guest environment. Additional languages require rebuilding the guest image. A unique API key is generated during initial setup, and the API listens on localhost by default.

Developed and supported by the Cratera project.

## Software Included

| Package | Version | License |
|---|---|---|
| [Cratera](https://github.com/cratera-project/cratera) | [1.2.0](https://github.com/cratera-project/cratera/tree/v1.2.0) | [Apache-2.0](https://github.com/cratera-project/cratera/blob/v1.2.0/LICENSE) |

## Creating an App using the Control Panel

Click the **Deploy to DigitalOcean** button to create a Droplet based on this 1-Click App. If you aren’t logged in, this link will prompt you to log in with your DigitalOcean account.

[![Deploy to DO](https://www.deploytodo.com/do-btn-blue.svg)](https://cloud.digitalocean.com/droplets/new?image=cratera)

## Creating an App using the API

In addition to creating a Droplet from the Cratera 1-Click App using the control panel, you can also use the [DigitalOcean API](https://docs.digitalocean.com/reference/api). As an example, to create a 4GB Cratera Droplet in the SFO2 region, you can use the following `curl` command. You need to either save your [API access token](https://docs.digitalocean.com/reference/api/create-personal-access-token/index.html.md) to an environment variable or substitute it in the command below.

```shell
curl -X POST -H 'Content-Type: application/json' \
         -H 'Authorization: Bearer '$TOKEN'' -d \
        '{"name":"choose_a_name","region":"sfo2","size":"s-2vcpu-4gb","image":"cratera"}' \
        "https://api.digitalocean.com/v2/droplets"
```

## Getting Started After Deploying Cratera

## Getting Started

Connect to your Droplet using your SSH key:

```
ssh root@YOUR_DROPLET_IP
```

Wait for initial provisioning to complete:

```
cloud-init status --wait
```

Cratera may need additional time to prepare its initial microVM snapshot. Check the service status:

```
systemctl status cratera --no-pager
```

Run the included Rust example:

```
cd /opt/cratera && bash examples/submit.sh rust
```

A successful response includes `"passed": true` and `"verdict": "AC"`.

Configuration and the generated API key are stored in `/opt/cratera/.env`. Keep this file private. By default, the API listens on `127.0.0.1:3100`.

View service logs:

```
journalctl -u cratera -n 50 --no-pager
```

To access the API securely from your computer, establish an SSH tunnel:

```
ssh -N -L 3100:127.0.0.1:3100 root@YOUR_DROPLET_IP
```

You can then access Cratera locally at `127.0.0.1:3100`.

## Access from the Internet

Cratera listens on `127.0.0.1:3100` by default.

For remote access, configure a Cloudflare Tunnel that forwards your hostname to `http://127.0.0.1:3100` and protect it with Cloudflare Access service tokens.

Requests must include both the Cloudflare service-token headers and:

```
Authorization: Bearer <CRATERA_INTERNAL_KEY>
```

Alternatively, you can expose Cratera through a local Caddy or Nginx HTTPS reverse proxy.