Requirements
What has to be on the machine before tare build runs.
An Anchor workspace
A program on one of the pinned Anchor versions. Nothing in it changes: Tare reads your Cargo.toml and source in place.
Docker
By default both compilations run inside one pinned container image, which carries Rust, the Solana platform tools and the SVM. With --host the CLI uses the tools on your machine instead: Cargo and cargo-build-sbf.
A keypair, for two commands
tare attest and tare flag sign a transaction, so they take a Solana keypair holding SOL. Every other command needs no key and no network account.