Droneship Sandboxes · for developers
Run agents like you run prod.
Run Claude Code or Codex unattended and in parallel, without exposing your keys, your laptop or your production systems. Each agent gets an isolated machine, only the access you grant, and a record of everything.
# install once $ curl -fsSL https://droneship.run/install | sh # then, in any repo $ droneship run claude Repo: https://github.com/acme/api @ main code at /workspace/api @ 3f2a1c8e9b04 isolation: KERNEL (gvisor)
Bring the agent you already use
Claude CodeOpenAI CodexGitHub CopilotComing soonGeminiComing soonCursorComing soonYour AgentComing soon
See it run.
Three agents in three sandboxes. A blocked host, allowed in one click. Then review and merge. 50 seconds.
A sandbox per agent.
Each run gets its own sandbox in under a minute, with the common tools already installed, so the agent starts on real work right away.
Isolation and identitybuilt in
- own kernel boundary (gVisor)
- credentials outside the sandbox
- tool access under policy
- every task action logged
default image
languages python · node · go
tooling git · gh · npm · pnpm · yarn · pip · uv
utilities make · jq · ripgrep · curl
Why agents need enforced boundaries
Research and real-world incidents show how agents can act beyond their intended scope. These findings highlight the need for containment enforced outside the agent.
An agent will use whatever it can reach.
In Anthropic’s security tests, models including Mythos 5 attacked real systems after a setup error gave them internet access, despite being told it was a simulation.
Enforcement has to sit outside the agent’s process, not in its instructions.
Read Anthropic’s assessmentWhatever an agent writes, something will run it.
Pillar Security found agents escaping their sandboxes by writing files that trusted tools outside would load or run.
What an agent writes must never run on your machine.
Read Pillar’s researchAgents find any channel you leave open.
METR found about 1,200 agents, meant to run in isolation, coordinating through a shared package repository.
Shared services have to be reachable only through an allowlist.
Read METR’s investigationAccess enforced outside the sandbox.
The droneship CLI runs on your machine; agents run in Droneship Cloud. Each run gets a short-lived identity and only the repos you grant. Every model and MCP call goes through the Agent Gateway, which checks that identity against your policy and injects credentials into allowed requests, so no key ever lands in the sandbox’s environment or filesystem.
Agent containment, explained
your machine
droneship CLI launch and manage runs
droneship cloud
sandbox · gVisor
agent repos you grant · persisted filesystem
run identity only — none of your connected credentials
agent gateway
identity → policy → decision
credentials
per run, injected on the way out
denied
never leaves the gateway
logged
every task action and gateway call
allowed
models · mcp servers · endpoints
blocked
hosts not on the allowlist · allow them in the console
Identity and enforcement detail
- run identity
- a per-run SPIFFE SVID, issued and rotated by Droneship. The gateway verifies it before policy is evaluated.
- policy
- network access is matched on the host name, and MCP access on the tools you turned on, so connecting a server does not allow every tool it exposes.
- credentials
- held per run outside the sandbox and injected into allowed requests, so the agent uses a service without receiving the key.
Connect your tools.
Connect an MCP server once per project and pick which of its tools agents can call. The gateway blocks every tool you haven’t turned on, and runs model calls through Highflame’s guardrails.
Tools and MCP# tools agents can call list_issues on create_pull_request on merge_pull_request off
github.create_pull_request ok anthropic.messages ok 1.2k tok github.list_issues ok github.merge_pull_request denied tool is off stripe.create_charge denied not connected
See what your agent did.
Every file a task touches, command it runs and tool it calls is logged while it works, with nothing to instrument and no SDK to import. Read it back with one command, live while the agent works or after it finishes.
Reading agent activity$ droneship logs forge-3f9a2c1d 14:02:09 start claude-opus-5-5 14:02:11 cmd git checkout -b fix-session ok 14:02:14 read src/auth/session.ts ok 14:02:31 write src/auth/session.ts +84 -12 14:03:04 cmd npm test ok 14:03:09 Session expiry now uses the server clock. 14:03:12 end 6 turns · 1m 03s done 4 actions
Your work survives the sandbox.
Each repo gets a saved workspace. When a sandbox stops, its files (uncommitted work included) and the agent’s conversations are kept, and the next run on that repo picks up where it left off. Finished tasks are kept for 7 days, and droneship resume claude <task-id> reopens one in the same conversation.
$ droneship kill forge-8b41e07a Terminated sandbox forge-8b41e07a (local SSH key discarded) $ droneship resume claude No claude sandbox is running; starting one on your saved workspace for https://github.com/acme/api to resume in. resumed your saved workspace: main @ 3f2a1c8
Run tasks in parallel.
Give each agent its own sandbox, identity, and access policy. Hand off several tasks at once, and track them all from one list. A sandbox stops by itself after 30 minutes with nobody connected.
Running agents in parallelegress deny by default · baseline-secureidle stops after 30m
Routines run where you control them.
Claude Code routines run on a schedule, from an API call, or on a GitHub event. Point a Claude self-hosted environment at a Droneship project, and every routine, claude.ai/code session and claude --cloud session runs in its own isolated sandbox under your project’s egress policy, with no git or API credentials inside.
Needs a Claude Team or Enterprise organization and Sandboxes Pro.
Claude Code routines$ droneship routines enable Self-hosted environment key (claude.ai → Admin settings → Cloud environments): ✓ Connected to environment ccpool_… Egress: baseline-secure
More than a sandbox.
| Feature | Sandbox provider | Droneship |
|---|---|---|
| Getting started | You write the scripts, stand up the infrastructure, and work out how your team shares environments. | Install with curl | sh, then run droneship run claude in your project. |
| Environment | You start with an empty sandbox. The agent spends tokens and minutes installing runtimes and linters before it writes any code. | Python, Node, and Go are already installed, along with git, gh, npm, pnpm, pip, and uv. It starts in under a minute. |
| Your code | You write the code that copies files from your laptop to the VM and back. | Your repo is cloned in at your current branch, or --local copies in your files as they are on disk. droneship diff and droneship pull bring the agent’s work back, to a local branch or into your files. If the sandbox stops, your workspace is still there. |
| Secrets | Your API keys go into the sandbox, where anything the agent runs can read them. | Keys for the services you connect never enter the sandbox. The gateway adds them to outbound requests your policy allows. |
| Switching providers | Your scripts and images are built for one vendor, so moving means redoing them. | Change the sandbox provider underneath and keep the same CLI, policies, and workflow. |
Frequently asked questions.
Am I stuck with one sandbox provider?
No. Droneship runs on top of the sandbox, so you can switch providers and your CLI, policies, and workflow stay the same.
Can the agent read my API keys?
Keys for the services you connect never make it into the sandbox. The gateway adds them to outbound requests, and only the ones your policy allows. Claude Code’s model credential sits outside too, in a sidecar. Isolation and identity docs
What if the sandbox dies mid-run?
Your files are still there. Each repo gets a saved workspace with its files and the agent’s past conversations, so the next droneship run claude in that repo picks up where you left off. A finished task keeps its files for 7 days, and droneship resume claude with the task’s id brings it back. Workspaces docs
Can I pick my own coding harness?
Yes. Run Claude Code or Codex CLI. Name it after run, like droneship run codex. Harnesses and models docs
What if I forget a sandbox is running?
It stops itself after 30 minutes with nobody connected, and after 8 hours regardless. Change either with --idle or --timeout. Your workspace is saved when it stops. Auto-stop docs
Start your first run.
$ curl -fsSL https://droneship.run/install | sh $ droneship run claude
Also on Droneship
Want an agent your whole team can use? Coworkers take requests in Slack and run on a schedule, each task in its own sandbox.