Requirements
Cloudflare account, GitHub org, and agent-provider prerequisites for running Tasuku.
Tasuku is an operator-managed system deployed into your own Cloudflare account. Prepare a Cloudflare account on the right plan, a GitHub organization or account for the App you will register, and credentials for at least one agent provider before enabling repositories.
Required
| Requirement | Why it is needed |
|---|---|
| Cloudflare account on the Workers Paid plan | Containers, Durable Objects, Workflows, Queues, D1, R2, and KV are all used by the deployed Worker; the free plan cannot host these bindings. |
| GitHub account or organization | Creates a GitHub App through Tasuku's manifest flow and installs it on the target owner. |
32-byte master key (TASUKU_MASTER_KEY) | Encrypts GitHub App credentials and user-managed secrets sealed in D1. |
Bootstrap token (TASUKU_BOOTSTRAP_TOKEN) | Authorizes first-run organization setup and the initial GitHub App manifest registration. |
| Agent authentication | Codex (ChatGPT device auth), Claude (an OAuth token), or OpenCode must be connected before an agent can run. |
Optional
| Requirement | Why it is needed |
|---|---|
| Docker, running locally | Only needed for bun run deploy --cached, which re-tags the prebuilt runtime image into your Cloudflare account's container registry for faster cold starts. Not required for the Deploy to Cloudflare button or a plain bun run deploy. |
| A Daytona account, or a self-hosted runtime host | Alternative sandbox providers to Cloudflare Containers. Neither is required to get started — see Sandbox providers. |
Cloudflare provisioning
D1, R2, KV, Queues, Durable Objects, Workflows, and Containers are all provisioned automatically from the root wrangler.jsonc, either by the Deploy to Cloudflare button or by wrangler deploy. You do not create any of these resources by hand before deploying. What matters going in is that the target account is already upgraded to Workers Paid — provisioning fails partway through on a free-plan account.
GitHub permissions
The generated App manifest asks for:
- Checks: write (review check runs)
- Contents: write
- Email addresses: read
- Issues: write
- Pull requests: write
It subscribes to the issue_comment, issues, pull_request, pull_request_review, and pull_request_review_comment events. GitHub additionally delivers installation and installation_repositories events to every App; Tasuku uses those to track installation and repository state. Do not reduce these permissions without checking the affected workflow.
Sandbox capacity
Size the sandbox provider for the repositories and toolchains it will execute. Cloudflare Containers ships two instance classes (standard-2 by default, standard-4 for heavier workloads) capped by max_instances in wrangler.jsonc. Daytona and an external runtime host accept their own CPU, memory, and disk fields. See Sandbox providers.
No Docker socket to protect
Unlike the previous self-hosted deployment, nothing in the Cloudflare Container or Daytona providers exposes a Docker socket to Tasuku. An external runtime host runs the same hardened image behind HTTPS and a per-organization bearer token instead — see "External runtime host" in Sandbox providers.
Before continuing
Confirm that you can:
- Sign in to a Cloudflare account on the Workers Paid plan.
- Generate and store
TASUKU_BOOTSTRAP_TOKENandTASUKU_MASTER_KEYoutside the repository. - Authenticate at least one agent provider — Codex device auth, a Claude OAuth token, or OpenCode — once the instance is running.
Then proceed to Installation.