diff --git a/.github/workflows/machine-download.yaml b/.github/workflows/machine-download.yaml
new file mode 100644
index 0000000..ef866c4
--- /dev/null
+++ b/.github/workflows/machine-download.yaml
@@ -0,0 +1,69 @@
+name: machine-download
+on:
+    workflow_call:
+    pull_request:
+        paths:
+            - .github/workflows/machine-download.yaml
+            - packages/machine-download/**
+concurrency:
+    group: ${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: true
+permissions:
+    contents: read
+    packages: write
+    id-token: write
+    actions: write
+jobs:
+    build:
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v3
+
+            - name: Get package tag/version
+              id: package-version
+              if: ${{ github.event_name == 'push' }}
+              run: |
+                  jq -r '"PACKAGE_VERSION=\(.version)"' packages/machine-download/package.json >> "$GITHUB_OUTPUT"
+
+            - name: Docker meta
+              id: meta
+              uses: docker/metadata-action@v4
+              with:
+                  images: |
+                      docker.io/cartesi/machine-download,enable=${{ github.event_name != 'pull_request' }}
+                      ghcr.io/cartesi/machine-download
+                  tags: |
+                      type=raw,value=${{ steps.package-version.outputs.PACKAGE_VERSION }},enable=${{ github.event_name == 'push' }}
+                      type=ref,event=pr
+                  labels: |
+                      org.opencontainers.image.title=Cartesi Machine Download
+                      org.opencontainers.image.description=Cartesi Machine Download from IPFS
+
+            - name: Set up Docker Buildx
+              uses: docker/setup-buildx-action@v2
+
+            - name: Login to GitHub Container Registry
+              uses: docker/login-action@v2
+              with:
+                  registry: ghcr.io
+                  username: ${{ github.actor }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Login to DockerHub
+              uses: docker/login-action@v2
+              with:
+                  username: ${{ secrets.DOCKER_USERNAME }}
+                  password: ${{ secrets.DOCKER_PASSWORD }}
+
+            - uses: depot/setup-action@v1
+            - name: Build and push
+              uses: depot/bake-action@v1
+              with:
+                  project: ${{ vars.DEPOT_PROJECT }}
+                  workdir: packages/machine-download
+                  files: |
+                      ./docker-bake.hcl
+                      ./docker-bake.platforms.hcl
+                      ${{ steps.meta.outputs.bake-file }}
+                  push: true
diff --git a/charts/applications-crd/.helmignore b/charts/applications-crd/.helmignore
new file mode 100644
index 0000000..0e8a0eb
--- /dev/null
+++ b/charts/applications-crd/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/charts/applications-crd/Chart.yaml b/charts/applications-crd/Chart.yaml
new file mode 100644
index 0000000..ebf974e
--- /dev/null
+++ b/charts/applications-crd/Chart.yaml
@@ -0,0 +1,11 @@
+apiVersion: v2
+name: cartesi-applications-crd
+description: A Helm chart for Cartesi Application Custom Resource Definitions (CRDs)
+maintainers:
+  - name: endersonmaia
+    email: endersonmaia@gmail.com
+    url: https://github.com/endersonmaia
+type: application
+version: 0.1.0
+sources:
+  - https://github.com/cartesi/helm-charts/
diff --git a/charts/applications-crd/ci/test-values.yaml.tpl b/charts/applications-crd/ci/test-values.yaml.tpl
new file mode 100644
index 0000000..a2c5e8b
--- /dev/null
+++ b/charts/applications-crd/ci/test-values.yaml.tpl
@@ -0,0 +1 @@
+{{- /* empty file */}}
\ No newline at end of file
diff --git a/charts/applications-crd/templates/rollups.cartesi.io_applications.yaml b/charts/applications-crd/templates/rollups.cartesi.io_applications.yaml
new file mode 100644
index 0000000..4c180d9
--- /dev/null
+++ b/charts/applications-crd/templates/rollups.cartesi.io_applications.yaml
@@ -0,0 +1,90 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+    name: applications.rollups.cartesi.io
+spec:
+    group: rollups.cartesi.io
+    names:
+        kind: Application
+        listKind: ApplicationList
+        plural: applications
+        singular: application
+    scope: Namespaced
+    versions:
+        - name: v1alpha1
+          schema:
+              openAPIV3Schema:
+                  description: Application is the Schema for the applications API
+                  properties:
+                      apiVersion:
+                          description:
+                              "APIVersion defines the versioned schema of this representation
+                              of an object. Servers should convert recognized schemas to the latest
+                              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
+                          type: string
+                      kind:
+                          description:
+                              "Kind is a string value representing the REST resource this
+                              object represents. Servers may infer this from the endpoint the client
+                              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
+                          type: string
+                      status:
+                          description: Status defines the observed state of Application
+                          type: object
+                      metadata:
+                          type: object
+                      spec:
+                          description: Spec defines the desired state of Application
+                          type: object
+                          properties:
+                              address:
+                                  description: Address of the application
+                                  type: string
+                                  pattern: '^0x([a-zA-Z0-9]){40}$'
+                                  x-kubernetes-validations:
+                                        - rule: "self != oldSelf"
+                                          message: "cannot change address"
+                              blockHash:
+                                  description: Block hash of the block which deployed the application
+                                  type: string
+                                  pattern: '^0x([a-zA-Z0-9]){64}$'
+                                  x-kubernetes-validations:
+                                        - rule: "self != oldSelf"
+                                          message: "cannot change blockHash"
+                              blockNumber:
+                                  description: Block number of the block which deployed the application
+                                  type: string
+                                  x-kubernetes-validations:
+                                        - rule: "self != oldSelf"
+                                          message: "cannot change blockNumber"
+                              transactionHash:
+                                  description: Transaction hash of the transaction which deployed the application
+                                  type: string
+                                  pattern: '^0x([a-zA-Z0-9]){64}$'
+                                  x-kubernetes-validations:
+                                        - rule: "self != oldSelf"
+                                          message: "cannot change transactionHash"
+                              location:
+                                  description: Location of the cartesi machine snapshot
+                                  type: string
+                                  x-kubernetes-validations:
+                                   - rule: "self != oldSelf"
+                                     message: "cannot change location"
+                  type: object
+          additionalPrinterColumns:
+                - name: Application
+                  type: string
+                  description: Address of the application
+                  jsonPath: .spec.address
+                - name: Location
+                  type: string
+                  description: Location of the cartesi machine snapshot
+                  jsonPath: .spec.location
+                - name: Age
+                  type: date
+                  jsonPath: .metadata.creationTimestamp
+          served: true
+          storage: true
+          subresources:
+              status: {}
\ No newline at end of file
diff --git a/charts/applications-crd/values.yaml b/charts/applications-crd/values.yaml
new file mode 100644
index 0000000..fa81ada
--- /dev/null
+++ b/charts/applications-crd/values.yaml
@@ -0,0 +1 @@
+# empty file
diff --git a/packages/machine-download/Dockerfile b/packages/machine-download/Dockerfile
new file mode 100644
index 0000000..93b136f
--- /dev/null
+++ b/packages/machine-download/Dockerfile
@@ -0,0 +1,5 @@
+FROM golang:1.20-bookworm as builder
+RUN go install github.com/ipfs/ipget@latest
+
+FROM debian:bookworm-20230725
+COPY --from=builder /go/bin/ipget /usr/local/bin/
diff --git a/packages/machine-download/README.md b/packages/machine-download/README.md
new file mode 100644
index 0000000..0ff2972
--- /dev/null
+++ b/packages/machine-download/README.md
@@ -0,0 +1,13 @@
+# Cartesi Machine Download
+
+This Docker image provides an utility to download Cartesi Machines stored in IFPS using the [CAR](https://ipld.io/specs/transport/car/carv1/) format, and extracting to a local folder.
+
+## Usage
+
+The following command will download the Cartesi Machine with the given hash and extract it to the given folder:
+
+```shell
+docker run -t cartesi/machine-download:devel bafybeibdpcfqtcqhgjzmo5wzi3kraxdu6f4wm2hzna4tj2enkepzvldjtq /tmp
+```
+
+Obviously, the output directory can be in a volume mapped to outside the docker container.
diff --git a/packages/machine-download/docker-bake.hcl b/packages/machine-download/docker-bake.hcl
new file mode 100644
index 0000000..d71acab
--- /dev/null
+++ b/packages/machine-download/docker-bake.hcl
@@ -0,0 +1,6 @@
+target "docker-metadata-action" {}
+target "docker-platforms" {}
+
+target "default" {
+  inherits = ["docker-metadata-action", "docker-platforms"]
+}
diff --git a/packages/machine-download/docker-bake.override.hcl b/packages/machine-download/docker-bake.override.hcl
new file mode 100644
index 0000000..704c02c
--- /dev/null
+++ b/packages/machine-download/docker-bake.override.hcl
@@ -0,0 +1,3 @@
+target "default" {
+  tags = ["cartesi/machine-download:devel"]
+}
diff --git a/packages/machine-download/docker-bake.platforms.hcl b/packages/machine-download/docker-bake.platforms.hcl
new file mode 100644
index 0000000..40168da
--- /dev/null
+++ b/packages/machine-download/docker-bake.platforms.hcl
@@ -0,0 +1,6 @@
+target "docker-platforms" {
+    platforms = [
+        "linux/amd64",
+        "linux/arm64"
+    ]
+}
diff --git a/packages/machine-download/package.json b/packages/machine-download/package.json
new file mode 100644
index 0000000..8b20d25
--- /dev/null
+++ b/packages/machine-download/package.json
@@ -0,0 +1,8 @@
+{
+    "name": "@cartesi/machine-download",
+    "private": true,
+    "version": "0.1.0",
+    "scripts": {
+        "build": "docker buildx bake"
+    }
+}