{"slug": "show-hn-droneship-sandbox-for-your-coding-agents", "title": "Show HN: Droneship – sandbox for your coding agents", "summary": "Droneship launched a cloud runtime that runs coding agents such as Anthropic's Claude Code and OpenAI's Codex inside isolated gVisor sandboxes via a single command, `droneship run claude`, with each run receiving its own SPIFFE SVID identity and no access to the user's credentials. The service routes agent traffic through an Agent Gateway that enforces hostname and MCP tool allowlists and injects credentials into permitted requests, citing Anthropic's security tests, Pillar Security's sandbox-escape research and a METR investigation in which roughly 1,200 agents used a shared package repository to communicate despite intended isolation. GitHub Copilot, Gemini and Cursor support is listed as coming soon, and sandboxes ship with Python, Node and Go plus git, gh, npm, pnpm, yarn, pip, uv, make, jq, ripgrep and curl preinstalled.", "body_md": "Cloud Runtime for Agents\n\n# Run agents like you run prod.\n\nLaunch Claude Code or Codex (more agents coming soon) on an isolated cloud machine with one command. Give it real work without giving it your credentials.\n\n``` bash\n# install once\n$ curl -fsSL https://droneship.run/install | sh\n\n# then, in any repo\n$ droneship run claude\nRepo: https://github.com/acme/api @ main\n  code at /workspace/api @ 3f2a1c8e9b04\n  isolation: KERNEL (gvisor)\n```\n\n## See it run.\n\nThree agents in three sandboxes. A blocked host, allowed in one click. Then review and merge. 50 seconds.\n\nBring the agent you already use\n\n- Claude Codedroneship run claude\n- OpenAI Codexdroneship run codex\n- GitHub CopilotComing soondroneship run copilot\n- GeminiComing soondroneship run gemini\n- CursorComing soondroneship run cursor\n- Your AgentComing soondroneship run python\n\n## A sandbox per agent.\n\nEach run gets its own sandbox, started in under a minute from an image with the common toolchain already in place, so the agent’s first command is real work rather than installing a language runtime.\n\n[Isolation and identity](https://droneship.run/docs/security/isolation-and-identity/)\n\n- own kernel boundary (gVisor)\n- credentials outside the sandbox\n- tool access under policy\n- every task action logged\n\n**languages** python · node · go\n\n**tooling** git · gh · npm · pnpm · yarn · pip · uv\n\n**utilities** make · jq · ripgrep · curl\n\n## Why agents need enforced boundaries\n\nResearch and real-world incidents show how agents can act beyond their intended scope. These findings highlight the need for containment enforced outside the agent.\n\n### An agent will use whatever it can reach.\n\nIn Anthropic’s security tests, models including Mythos 5 attacked real systems after a setup error enabled internet access—despite being told they were in a simulation.\n\nEnforcement has to sit outside the agent’s process, not in its instructions.\n\n[Read Anthropic’s assessment](https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents)\n\n### Whatever an agent writes, something will run it.\n\nPillar Security found that agents could cross sandbox boundaries by writing files that trusted tools outside the sandbox would then load or run.\n\nThe machine that consumes what an agent writes must not be your own.\n\n[Read Pillar’s research](https://www.pillar.security/blog/the-week-of-sandbox-escapes)\n\n### Agents find any channel you leave open.\n\nMETR found that roughly 1,200 agents used a shared package repository to communicate and coordinate, despite being intended to run in isolation.\n\nShared services have to be reachable only through an allowlist.\n\n[Read METR’s investigation](https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/)\n\n## Access enforced outside the sandbox.\n\nThe CLI runs on your machine. Each agent run gets its own sandbox and identity in Droneship Cloud, with access only to the repos you grant. An integrated Agent Gateway routes calls, enforces policy, and automatically injects credentials into allowed requests—so your agent can use connected services without receiving the raw keys.\n\n[How the security model works](https://droneship.run/docs/security/)\n\nAgent containment, explained\n\n**droneship CLI** launch and manage runs\n\n**agent** repos you grant · persisted filesystem\n\nrun identity only — none of your connected credentials\n\nidentity → policy → decision\n\nper run, injected on the way out\n\nnever leaves the gateway\n\nevery task action and gateway call\n\nmodels · mcp servers · endpoints\n\nhosts not on the allowlist · allow them in the console\n\n## Identity and enforcement detail\n\n- run identity\n- a per-run SPIFFE SVID, issued and rotated by Droneship. The gateway verifies it before policy is evaluated.\n- policy\n- network access is matched on the host name, and MCP access on the tools you turned on, so connecting a server does not allow every tool it exposes.\n- credentials\n- held per run outside the sandbox and injected into allowed requests, so the agent uses a service without receiving the key.\n\n## Connect your tools.\n\nConnect an MCP server once for your project and choose which of its tools agents can call. The integrated Agent Gateway refuses any tool you have not turned on, and checks model calls with Highflame’s guardrails.\n\n[Tools and MCP](https://droneship.run/docs/security/tools-and-mcp/)\n\n```\n# tools agents can call\nlist_issues              on\ncreate_pull_request      on\nmerge_pull_request       off\ngithub.create_pull_request   ok\nanthropic.messages           ok      1.2k tok\ngithub.list_issues           ok\ngithub.merge_pull_request    denied  tool is off\nstripe.create_charge         denied  not connected\n```\n\n## See what your agent did.\n\nEvery file a task touches, command it runs and tool it calls is logged while it works, with nothing to instrument and no SDK to import. Read it back with one command, live while the agent works or after it finishes.\n\n[Reading agent activity](https://droneship.run/docs/security/activity/)\n\n``` bash\n$ droneship logs forge-3f9a2c1d\n14:02:09  start   claude-opus-5-5\n14:02:11  cmd     git checkout -b fix-session   ok\n14:02:14  read    src/auth/session.ts           ok\n14:02:31  write   src/auth/session.ts           +84 -12\n14:03:04  cmd     npm test                      ok\n14:03:09          Session expiry now uses the server clock.\n14:03:12  end     6 turns · 1m 03s              done\n4 actions\n```\n\n## Your work survives the sandbox.\n\nEach repo gets a saved workspace. When a sandbox stops, its files stay there, uncommitted work included, with Claude’s past conversations. The next run on that repo starts from them. A finished task keeps its files for 7 days, and `droneship resume claude` with the task’s id brings it back in the same conversation.\n\n[Workspaces](https://droneship.run/docs/guides/workspaces/)\n\n``` bash\n$ droneship kill forge-8b41e07a\nTerminated sandbox forge-8b41e07a (local SSH key discarded)\n\n$ droneship resume claude\nNo claude sandbox is running; starting one on your saved\nworkspace for https://github.com/acme/api to resume in.\n  resumed your saved workspace: main @ 3f2a1c8\n```\n\n## Run tasks in parallel.\n\nGive each agent its own sandbox, identity, and access policy. Hand off several tasks at once, and track them all from one list. A sandbox stops by itself after 30 minutes with nobody connected.\n\n[Running agents in parallel](https://droneship.run/docs/workflows/parallel/)\n\n## Routines run where you control them.\n\nClaude Code routines run Claude on a schedule, from an API call or on a GitHub event. Connect a Claude self-hosted environment to a Droneship project, and every routine, claude.ai/code or `claude --cloud` session gets its own isolated sandbox with your project’s egress policy. No git or API credentials inside.\n\nNeeds a Claude Team or Enterprise organization and a Droneship plan other than Free or Trial.\n\n[Claude Code routines](https://droneship.run/docs/guides/claude-routines/)\n\n``` bash\n$ droneship routines enable\nSelf-hosted environment key (claude.ai → Admin settings → Cloud environments):\n✓ Connected to environment ccpool_…\n  Egress: baseline-secure\n```\n\n## More than a sandbox.\n\n| Feature | Sandbox provider | Droneship | \n|---|---|---|\n| Getting started | You write the scripts, stand up the infrastructure, and work out how your team shares environments. | Install with `curl \\| sh` , then run`droneship run claude` in your project. | \n| Environment | You start with an empty sandbox. The agent spends tokens and minutes installing runtimes and linters before it writes any code. | Python, Node, and Go are already installed, along with git, gh, npm, pnpm, pip, and uv. It starts in under a minute. | \n| Your code | You write the code that copies files from your laptop to the VM and back. | Your repo is cloned in at your current branch. `droneship diff` and`droneship pull` bring the agent’s work back to a local branch. If the sandbox stops, your workspace is still there. | \n| Secrets | Your API keys go into the sandbox, where anything the agent runs can read them. | Keys for the services you connect never enter the sandbox. The gateway adds them to outbound requests your policy allows. | \n| Switching providers | Your scripts and images are built for one vendor, so moving means redoing them. | Change the sandbox provider underneath and keep the same CLI, policies, and workflow. | \n\nPricing\n\n## Free during early access.\n\nSign in and start running agents. No card needed.\n\n### Free\n\n- Up to 5 sandboxes running at the same time\n- 30 sandbox hours a month\n- Allowed sites, Connectors, logs and review in the console\n- You bring your own model access: your Claude or ChatGPT plan, or your own API key\n\n### Pro\n\n- No limit on running sandboxes or sandbox hours\n- Larger machines, and sandboxes that stay on when idle\n- Claude Code routines on your own Droneship machines\n- More projects and team members\n- Contact [sales@highflame.com](mailto:sales@highflame.com)\n\nSandbox hours count the time each sandbox runs. On Free, sandboxes use the standard size and stop when idle, and a sandbox stops when the month’s hours run out.\n\n## Frequently asked questions.\n\n## Am I stuck with one sandbox provider?\n\nNo. Droneship runs on top of the sandbox, so you can switch providers and your CLI, policies, and workflow stay the same.\n\n## Can the agent read my API keys?\n\nKeys for the services you connect never make it into the sandbox. The gateway adds them to outbound requests, and only the ones your policy allows. Claude Code’s model credential sits outside too, in a sidecar. [Isolation and identity docs](https://droneship.run/docs/security/isolation-and-identity/)\n\n## What if the sandbox dies mid-run?\n\nYour files are still there. Each repo gets a saved workspace with its files and the agent’s past conversations, so the next `droneship run claude` in that repo picks up where you left off. A finished task keeps its files for 7 days, and `droneship resume claude` with the task’s id brings it back. [Workspaces docs](https://droneship.run/docs/guides/workspaces/)\n\n## Can I pick my own coding harness?\n\nYes. Run Claude Code or Codex CLI. Name it after `run`, like `droneship run codex`. [Harnesses and models docs](https://droneship.run/docs/guides/harnesses-and-models/)\n\n## What if I forget a sandbox is running?\n\nIt stops itself after 30 minutes with nobody connected, and after 8 hours regardless. Change either with `--idle` or `--timeout`. Your workspace is saved when it stops. [Auto-stop docs](https://droneship.run/docs/security/auto-stop/)\n\n## Start your first run.\n\n``` bash\n$ curl -fsSL https://droneship.run/install | sh\n$ droneship run claude\n```\n\n", "url": "https://wpnews.pro/news/show-hn-droneship-sandbox-for-your-coding-agents", "canonical_source": "https://droneship.run/", "published_at": "2026-11-04 04:20:56+00:00", "updated_at": "2026-11-04 04:50:09.832314+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "developer-tools", "ai-infrastructure"], "entities": ["Droneship", "Claude Code", "OpenAI Codex", "Anthropic", "Pillar Security", "METR", "GitHub Copilot", "gVisor"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-droneship-sandbox-for-your-coding-agents", "markdown": "https://wpnews.pro/news/show-hn-droneship-sandbox-for-your-coding-agents.md", "text": "https://wpnews.pro/news/show-hn-droneship-sandbox-for-your-coding-agents.txt", "jsonld": "https://wpnews.pro/news/show-hn-droneship-sandbox-for-your-coding-agents.jsonld"}}