Cloud environments and self-hosted runners

The sandbox has a settings layer

[Vendor-documented] Each Claude Code cloud session "runs in a cloud environment." An environment is a named set of sandbox settings: network access, environment variables, network secrets and a setup script. The same environments apply to the desktop app, the mobile app, claude.ai/code, claude --cloud, cloud scheduled tasks and Claude Tag. Project threads use the environment set in the project.¹,²

[Unknown] The session examined here was started from a claude.ai chat. The environment page does not say whether chat sessions, or tasks in a conversation, use these settings.

The environment page also says what happens to an idle VM. The sandbox and its state quotes it and compares it with what was observed.

Network access

[Vendor-documented] Each environment has one network access level for outbound connections.¹

Level	What sessions can reach
None	Nothing through the session's network
Trusted (the default)	Allowlisted domains: package registries, GitHub and cloud SDKs
Full	Any domain
Custom	Your own allowlist, with the defaults if you choose

[Vendor-documented] Four paths skip the allowlist at every level:¹

GitHub, through its own proxy.
The MCP connectors you turn on.
The hosts listed on the environment's network secrets.
The Anthropic API, for Claude Code's own requests.

Setup scripts and the environment cache

[Vendor-documented] A setup script installs tools before Claude Code starts. If it finishes in about five minutes, Anthropic takes a snapshot. A snapshot is a saved copy of the disk. Later sessions start from it. It keeps files the script wrote, not programs that were running. It is rebuilt when you change the script or the allowed hosts, and after about seven days.¹

[Inferred] So a new session still gets a new desk. But the desk starts from a known picture. Speed comes from the cache, not from a VM that stays on.

Variables, network secrets and the GitHub proxy

[Vendor-documented] Environment variables are not private. "Anyone who uses the environment can read the values." For a key, use a network secret. Anthropic's agent proxy "adds the key to requests for the hosts you list, after each request leaves the session's VM, so the key itself stays outside the VM." The GitHub proxy works the same way. It "keeps your real GitHub credentials outside the session's VM."¹ Who may add a network secret depends on the plan. See Appendix: runtime details.

[Inferred] A network secret protects the key, not its use. A tricked agent cannot copy the key out. But it can still send requests to the listed hosts, with the key attached. So use the narrowest key the job needs, such as a read-only key.

[Vendor-documented] On Team and Enterprise plans, an Owner can create environments shared with every member. Do not put secrets in a shared environment's variables, "because every member's sessions read them."¹

Self-hosted environments: the same session in your network

[Vendor-documented] A self-hosted environment "executes Claude Code cloud sessions on infrastructure your organization operates." People start sessions the same way. Only the place changes. A runner is a program on your own hosts. It claims each session from Anthropic's queue, clones the repository and runs Claude Code. "Anthropic never connects into your network." Every connection goes out. Appendix: runtime details shows how runners claim sessions.³

What stays on your machines	What still goes to Anthropic
Repository checkouts, build artifacts, secrets, and files the session creates or changes	The conversation: prompts, responses and tool results. Anthropic stores the transcript so you can resume elsewhere
Your runner image and its tools	The control plane, the Anthropic service that organizes sessions: the queue, orchestration and the claude.ai interface

Basis: vendor-documented.³

[Vendor-documented] Model requests go to the Anthropic API by default. A runner can send them to Amazon Bedrock or Google Cloud's Agent Platform instead. But "session content goes to Anthropic in both cases." Self-hosted environments are in public beta for Team and Enterprise. They are off by default. They are not available with Zero Data Retention or the HIPAA configuration. They have no network secrets, so your deployment provides the keys. Anthropic says most teams are better served by its hosted environments.³,¹

[Vendor-documented] Each self-hosted session carries a signed token that your services can check. It proves which session and environment it belongs to. It shows whether a person or your organization's service identity started it. It does not prove which process presents it.⁴ [Inferred] So it identifies a session, not a worker with narrow scopes. The business layer still adds that. The token's fields are in Appendix: runtime details.

How it maps onto the four layers

Layer	Anthropic-hosted	Self-hosted
UI	claude.ai, the apps, `claude --cloud`, scheduled tasks, Claude Tag	The same
Backend	Anthropic: queue, orchestration, transcript	The same Anthropic control plane
Harness and sandbox	Claude Code in an Anthropic VM, shaped by the environment	Claude Code on your runner, from your image
Model	Anthropic API	Anthropic API, or Bedrock or Google Cloud's Agent Platform

Basis: vendor-documented.³,¹

[Inferred] Environments and runners change what the sandbox can reach and where it runs. They do not decide whether an action is allowed. A self-hosted runner can even widen the reach. See Security boundaries.

Rule to remember: The environment decides where the session runs and what it can reach. Keep keys outside the sandbox and narrow. Keep approval in the service that acts.