Cloud Runtime for Agents
Run agents like you run prod.
Launch Claude Code or Codex (more agents coming soon) on an isolated cloud machine with one command. Give it real work without giving it your credentials.
# install once $ curl -fsSL https://droneship.run/install | sh # then, in any repo $ droneship run claude Repo: https://github.com/acme/api @ main code at /workspace/api @ 3f2a1c8e9b04 isolation: KERNEL (gvisor)
See it run.
Three agents in three sandboxes. A blocked host, allowed in one click. Then review and merge. 50 seconds.
Bring the agent you already use
- Claude Codedroneship run claude
- OpenAI Codexdroneship run codex
- GitHub CopilotComing soondroneship run copilot
- GeminiComing soondroneship run gemini
- CursorComing soondroneship run cursor
- Your AgentComing soondroneship run python
A sandbox per agent.
Each run gets its own sandbox, started in under a minute from an image with the common toolchain already in place, so the agent’s first command is real work rather than installing a language runtime.
Isolation and identitybuilt in
- own kernel boundary (gVisor)
- credentials outside the sandbox
- tool access under policy
- every task action logged
default image
languages python · node · go
tooling git · gh · npm · pnpm · yarn · pip · uv
utilities make · jq · ripgrep · curl
Why agents need enforced boundaries
Research and real-world incidents show how agents can act beyond their intended scope. These findings highlight the need for containment enforced outside the agent.
An agent will use whatever it can reach.
In Anthropic’s security tests, models including Mythos 5 attacked real systems after a setup error enabled internet access—despite being told they were in a simulation.
Enforcement has to sit outside the agent’s process, not in its instructions.
Read Anthropic’s assessmentWhatever an agent writes, something will run it.
Pillar Security found that agents could cross sandbox boundaries by writing files that trusted tools outside the sandbox would then load or run.
The machine that consumes what an agent writes must not be your own.
Read Pillar’s researchAgents find any channel you leave open.
METR found that roughly 1,200 agents used a shared package repository to communicate and coordinate, despite being intended to run in isolation.
Shared services have to be reachable only through an allowlist.
Read METR’s investigationAccess enforced outside the sandbox.
The CLI runs on your machine. Each agent run gets its own sandbox and identity in Droneship Cloud, with access only to the repos you grant. An integrated Agent Gateway routes calls, enforces policy, and automatically injects credentials into allowed requests—so your agent can use connected services without receiving the raw keys.
How the security model worksAgent containment, explained
your machine
droneship CLI launch and manage runs
droneship cloud
sandbox · gVisor
agent repos you grant · persisted filesystem
run identity only — none of your connected credentials
agent gateway
identity → policy → decision
credentials
per run, injected on the way out
denied
never leaves the gateway
logged
every task action and gateway call
allowed
models · mcp servers · endpoints
blocked
hosts not on the allowlist · allow them in the console
Identity and enforcement detail
- run identity
- a per-run SPIFFE SVID, issued and rotated by Droneship. The gateway verifies it before policy is evaluated.
- policy
- network access is matched on the host name, and MCP access on the tools you turned on, so connecting a server does not allow every tool it exposes.
- credentials
- held per run outside the sandbox and injected into allowed requests, so the agent uses a service without receiving the key.
Connect your tools.
Connect an MCP server once for your project and choose which of its tools agents can call. The integrated Agent Gateway refuses any tool you have not turned on, and checks model calls with Highflame’s guardrails.
Tools and MCP# tools agents can call list_issues on create_pull_request on merge_pull_request off
github.create_pull_request ok anthropic.messages ok 1.2k tok github.list_issues ok github.merge_pull_request denied tool is off stripe.create_charge denied not connected
See what your agent did.
Every file a task touches, command it runs and tool it calls is logged while it works, with nothing to instrument and no SDK to import. Read it back with one command, live while the agent works or after it finishes.
Reading agent activity$ droneship logs forge-3f9a2c1d 14:02:09 start claude-opus-5-5 14:02:11 cmd git checkout -b fix-session ok 14:02:14 read src/auth/session.ts ok 14:02:31 write src/auth/session.ts +84 -12 14:03:04 cmd npm test ok 14:03:09 Session expiry now uses the server clock. 14:03:12 end 6 turns · 1m 03s done 4 actions
Your work survives the sandbox.
Each repo gets a saved workspace. When a sandbox stops, its files stay there, uncommitted work included, with Claude’s past conversations. The next run on that repo starts from them. A finished task keeps its files for 7 days, and droneship resume claude with the task’s id brings it back in the same conversation.
$ droneship kill forge-8b41e07a Terminated sandbox forge-8b41e07a (local SSH key discarded) $ droneship resume claude No claude sandbox is running; starting one on your saved workspace for https://github.com/acme/api to resume in. resumed your saved workspace: main @ 3f2a1c8
Run tasks in parallel.
Give each agent its own sandbox, identity, and access policy. Hand off several tasks at once, and track them all from one list. A sandbox stops by itself after 30 minutes with nobody connected.
Running agents in parallelegress deny by default · baseline-secureidle stops after 30m
Routines run where you control them.
Claude Code routines run Claude on a schedule, from an API call or on a GitHub event. Connect a Claude self-hosted environment to a Droneship project, and every routine, claude.ai/code or claude --cloud session gets its own isolated sandbox with your project’s egress policy. No git or API credentials inside.
Needs a Claude Team or Enterprise organization and a Droneship plan other than Free or Trial.
Claude Code routines$ droneship routines enable Self-hosted environment key (claude.ai → Admin settings → Cloud environments): ✓ Connected to environment ccpool_… Egress: baseline-secure
More than a sandbox.
| Feature | Sandbox provider | Droneship |
|---|---|---|
| Getting started | You write the scripts, stand up the infrastructure, and work out how your team shares environments. | Install with curl | sh, then run droneship run claude in your project. |
| Environment | You start with an empty sandbox. The agent spends tokens and minutes installing runtimes and linters before it writes any code. | Python, Node, and Go are already installed, along with git, gh, npm, pnpm, pip, and uv. It starts in under a minute. |
| Your code | You write the code that copies files from your laptop to the VM and back. | Your repo is cloned in at your current branch. droneship diff and droneship pull bring the agent’s work back to a local branch. If the sandbox stops, your workspace is still there. |
| Secrets | Your API keys go into the sandbox, where anything the agent runs can read them. | Keys for the services you connect never enter the sandbox. The gateway adds them to outbound requests your policy allows. |
| Switching providers | Your scripts and images are built for one vendor, so moving means redoing them. | Change the sandbox provider underneath and keep the same CLI, policies, and workflow. |
Pricing
Free during early access.
Sign in and start running agents. No card needed.
Free
- Up to 5 sandboxes running at the same time
- 30 sandbox hours a month
- Allowed sites, Connectors, logs and review in the console
- You bring your own model access: your Claude or ChatGPT plan, or your own API key
Pro
- No limit on running sandboxes or sandbox hours
- Larger machines, and sandboxes that stay on when idle
- Claude Code routines on your own Droneship machines
- More projects and team members
- Contact sales@highflame.com
Sandbox hours count the time each sandbox runs. On Free, sandboxes use the standard size and stop when idle, and a sandbox stops when the month’s hours run out.
Frequently asked questions.
Am I stuck with one sandbox provider?
No. Droneship runs on top of the sandbox, so you can switch providers and your CLI, policies, and workflow stay the same.
Can the agent read my API keys?
Keys for the services you connect never make it into the sandbox. The gateway adds them to outbound requests, and only the ones your policy allows. Claude Code’s model credential sits outside too, in a sidecar. Isolation and identity docs
What if the sandbox dies mid-run?
Your files are still there. Each repo gets a saved workspace with its files and the agent’s past conversations, so the next droneship run claude in that repo picks up where you left off. A finished task keeps its files for 7 days, and droneship resume claude with the task’s id brings it back. Workspaces docs
Can I pick my own coding harness?
Yes. Run Claude Code or Codex CLI. Name it after run, like droneship run codex. Harnesses and models docs
What if I forget a sandbox is running?
It stops itself after 30 minutes with nobody connected, and after 8 hours regardless. Change either with --idle or --timeout. Your workspace is saved when it stops. Auto-stop docs
Start your first run.
$ curl -fsSL https://droneship.run/install | sh $ droneship run claude