diff --git a/common/config/rush/pnpm-lock.yaml b/common/config/rush/pnpm-lock.yaml
index a8e71bcb95..76ccf39d97 100644
--- a/common/config/rush/pnpm-lock.yaml
+++ b/common/config/rush/pnpm-lock.yaml
@@ -3469,6 +3469,12 @@ packages:
     requiresBuild: true
     dev: false
 
+  /esbuild/0.12.26:
+    resolution: {integrity: sha512-YmTkhPKjvTJ+G5e96NyhGf69bP+hzO0DscqaVJTi5GM34uaD4Ecj7omu5lJO+NrxCUBRhy2chONLK1h/2LwoXA==}
+    hasBin: true
+    requiresBuild: true
+    dev: false
+
   /escalade/3.1.1:
     resolution: {integrity: sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==}
     engines: {node: '>=6'}
@@ -10004,7 +10010,7 @@ packages:
       '@types/node': 16.7.5
       '@types/ws': 7.4.7
       '@typescript-eslint/eslint-plugin': 4.28.5_a8e83fcad666e1ba86be4b2e27a20aea
-      esbuild: 0.12.24
+      esbuild: 0.12.26
       eslint: 7.32.0
       eslint-plugin-import: 2.23.4_eslint@7.32.0
       eslint-plugin-node: 11.1.0_eslint@7.32.0
@@ -10118,7 +10124,7 @@ packages:
     dev: false
 
   file:projects/tool.tgz_6c259fadfeb3a4b20890aefe87070b8b:
-    resolution: {integrity: sha512-ZofT4DyGFGWG0s/geyBOmQalsgWxw6y563CJnfSX1NPSgQ9rkuWIfe2MyoTS1sOA5PhmNSzcBr//La4ZjR0gyw==, tarball: file:projects/tool.tgz}
+    resolution: {integrity: sha512-Z0BaX1B1yinHaiai353t9rj20BUpViVPFU9rX9LC0dA8wvHQ/5WY8jgEmhwrHYhq/+iauybdXG8tBCJLBQTeBQ==, tarball: file:projects/tool.tgz}
     id: file:projects/tool.tgz
     name: '@rush-temp/tool'
     version: 0.0.0
@@ -10126,6 +10132,7 @@ packages:
       '@types/heft-jest': 1.0.2
       '@typescript-eslint/eslint-plugin': 4.28.5_a8e83fcad666e1ba86be4b2e27a20aea
       commander: 8.1.0
+      esbuild: 0.12.26
       eslint: 7.32.0
       eslint-plugin-import: 2.23.4_eslint@7.32.0
       eslint-plugin-node: 11.1.0_eslint@7.32.0
@@ -10183,7 +10190,7 @@ packages:
       aws-sdk: 2.969.0
       body-parser: 1.19.0
       cors: 2.8.5
-      esbuild: 0.12.24
+      esbuild: 0.12.26
       eslint: 7.32.0
       eslint-plugin-import: 2.23.4_eslint@7.32.0
       eslint-plugin-node: 11.1.0_eslint@7.32.0
@@ -10302,7 +10309,7 @@ packages:
       '@types/minio': 7.0.10
       '@types/node': 16.7.5
       '@typescript-eslint/eslint-plugin': 4.28.5_a8e83fcad666e1ba86be4b2e27a20aea
-      esbuild: 0.12.24
+      esbuild: 0.12.26
       eslint: 7.32.0
       eslint-plugin-import: 2.23.4_eslint@7.32.0
       eslint-plugin-node: 11.1.0_eslint@7.32.0
diff --git a/dev/tool/Dockerfile b/dev/tool/Dockerfile
new file mode 100644
index 0000000000..fd008d9923
--- /dev/null
+++ b/dev/tool/Dockerfile
@@ -0,0 +1,7 @@
+FROM node
+
+WORKDIR /usr/src/app
+
+COPY bundle.js ./
+
+CMD [ "bash" ]
diff --git a/dev/tool/build.sh b/dev/tool/build.sh
new file mode 100755
index 0000000000..0301e46926
--- /dev/null
+++ b/dev/tool/build.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+#
+#  Copyright © 2020, 2021 Anticrm Platform Contributors.
+#  Copyright © 2021 Hardcore Engineering Inc.
+#  
+#  Licensed under the Eclipse Public License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License. You may
+#  obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
+#  
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+#
+
+rushx bundle
+rushx docker:build
+rushx docker:push
diff --git a/dev/tool/package.json b/dev/tool/package.json
index c626e70ae8..99ea1da303 100644
--- a/dev/tool/package.json
+++ b/dev/tool/package.json
@@ -7,7 +7,10 @@
   "scripts": {
     "build": "heft build",
     "lint:fix": "eslint --fix src",
-    "start": "ts-node src/index.ts"
+    "start": "ts-node src/index.ts",
+    "bundle": "esbuild src/index.ts --bundle --minify --platform=node > bundle.js",
+    "docker:build": "docker build -t anticrm/tool .",
+    "docker:push": "docker push anticrm/tool"
   },
   "devDependencies": {
     "@anticrm/platform-rig":"~0.6.0",
@@ -17,7 +20,8 @@
     "eslint-plugin-promise":"4",
     "eslint-plugin-node":"11",
     "eslint":"^7.32.0",
-    "ts-node":"^10.2.1"
+    "ts-node":"^10.2.1",
+    "esbuild":"^0.12.26"
   },
   "dependencies": {
     "mongodb":"^4.1.1",
diff --git a/dev/tool/run.sh b/dev/tool/run.sh
new file mode 100755
index 0000000000..08bdee1315
--- /dev/null
+++ b/dev/tool/run.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+#  Copyright © 2020, 2021 Anticrm Platform Contributors.
+#  Copyright © 2021 Hardcore Engineering Inc.
+#  
+#  Licensed under the Eclipse Public License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License. You may
+#  obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
+#  
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+#
+
+export MONGODB_ROOT_PASSWORD=$(kubectl get secret --namespace default mng-mongodb -o jsonpath="{.data.mongodb-root-password}" | base64 --decode)
+export MINIO_ACCESS_KEY=$(kubectl get secret --namespace default minio -o jsonpath="{.data.access-key}" | base64 --decode)
+export MINIO_SECRET_KEY=$(kubectl get secret --namespace default minio -o jsonpath="{.data.secret-key}" | base64 --decode)
+
+kubectl run anticrm-tool --rm --tty -i --restart='Never' \
+  --env="MONGO_URL=mongodb://root:$MONGODB_ROOT_PASSWORD@mng-mongodb:27017/" \
+  --env="MINIO_ACCESS_KEY=$MINIO_ACCESS_KEY" \
+  --env="MINIO_SECRET_KEY=$MINIO_SECRET_KEY" --image anticrm/tool --command -- bash
diff --git a/dev/tool/src/index.ts b/dev/tool/src/index.ts
index b364739c05..d63e1593dd 100644
--- a/dev/tool/src/index.ts
+++ b/dev/tool/src/index.ts
@@ -18,7 +18,7 @@ import { program } from 'commander'
 import { MongoClient, Db } from 'mongodb'
 import { getAccount, createAccount, assignWorkspace, createWorkspace } from '@anticrm/account'
 
-const mongodbUri = process.env.MONGODB_URI ?? 'mongodb://localhost:27017'
+const mongodbUri = process.env.MONGO_URL ?? 'mongodb://localhost:27017'
 
 async function withDatabase (uri: string, f: (db: Db) => Promise<any>): Promise<void> {
   console.log(`connecting to database '${uri}'...`)