Run Claude Code in an isolated cloud sandbox.

One API call gives Claude Code a real Linux machine — repo checked out, tools installed, network locked down, and nothing left behind when the session ends.

Start building Template reference

TEMPLATE

claude-code

AUTH

ANTHROPIC_API_KEY

ISOLATION

gVisor

EGRESS

default-deny

OVRIN / SANDBOX 4C0D {{ statusLabel }}

import ovrin

client = ovrin.Client()

sandbox = client.sandboxes.create(
    template="claude-code",
    env={"ANTHROPIC_API_KEY": key},
    timeout=3600,
)

result = sandbox.run(
    'claude "fix the failing auth test"'
)
print(result.stdout)

>claude working…▌

gVisor · 2 vCPU · 4 GiB {{ elapsed }}

Why a sandbox

Claude Code is happiest with a whole machine.

It reads files, runs your test suite, installs packages and edits in place. On a laptop that is fine. In production — parallel sessions, untrusted repos, agent-authored shell commands — it needs a boundary.

Parallel sessions, no collisions

Fan out one session per branch, ticket or customer. Each gets its own filesystem and process table.

Destructive commands stay contained

The agent can rewrite the tree, drop a local database, or wedge a build. The blast radius is one disposable sandbox.

Network on a leash

Default-deny egress. Allowlist api.anthropic.com, your registry and your git host. Nothing else resolves.

Session lifecycle

Five calls, start to finish.

CREATE

Sandbox boots on the claude-code template.

SEED

Clone the repo, write config into /workspace.

PROMPT

Run claude with the task. Stream stdout back.

COLLECT

Read the diff and artifacts off the filesystem.

KILL

Environment gone. Memory kept, if you asked for it.

FULL SESSION · PYTHON

sbx = client.sandboxes.create(template="claude-code", env={"ANTHROPIC_API_KEY": key})

sbx.run("git clone https://github.com/acme/api /workspace/api")
sbx.files.write("/workspace/api/CLAUDE.md", house_rules)

out = sbx.run('cd /workspace/api && claude "fix the failing auth test"')
diff = sbx.run("cd /workspace/api && git diff").stdout

client.memory.add(f"auth test fixed: {out.stdout[:200]}")
sbx.kill()