Security
This section covers the controls Droneship applies around each sandbox: what it can reach on the network, how it gets tools and credentials, what is recorded, how it’s isolated, and when it stops. It’s for developers deciding how much to hand an agent and how closely to watch it.
Every droneship run gets these controls without a flag: an isolated sandbox, an egress allowlist, its own short-lived identity, model calls through the Highflame gateway, and limits that stop the sandbox when it’s idle or reaches a maximum age. Together they let you give the agent more to do and check on it less.
The defaults
Section titled “The defaults”droneship run claude with no options uses these settings:
| Setting | Default | Change it with |
|---|---|---|
| Egress policy | baseline-secure, and the project’s egress rules |
--policy-bundle; the rules on the console’s Egress page |
| Isolation | KERNEL (gVisor) with --byok or a key saved in the console; OS when you sign in to your plan inside the sandbox |
--isolation, to require a level |
| Model calls | Through the Highflame gateway, paid with your own key or your own plan. With no key sent, the key you saved in the console, or else on a terminal your plan | --byok, --subscription, --direct |
| Credentials (Claude Code, Codex) | A --byok key or a key saved in the console is held by a sidecar outside the sandbox. Your plan’s sign-in is stored in the sandbox |
--byok keeps the key outside; --direct puts it in the sandbox |
| Idle stop | 30 minutes with nobody connected | --idle (0 turns it off) |
| Hard cap | 8 hours | --timeout |
Claude Code runs without asking before each command, because the sandbox is the boundary. Pass --ask to get the prompts back.
Pages in this section
Section titled “Pages in this section”More: droneship run, Harnesses and models, The console.