# Cloud environments and self-hosted runners (/claude-and-chatgpt-2/architecture/cloud-environments-and-self-hosted-runners) --- type: Document title: "Cloud environments and self-hosted runners" description: "The settings layer of the cloud sandbox: network access, setup scripts, variables, network secrets and the GitHub proxy. Also how a self-hosted environment runs the same session in your network." status: stable order: 0.435 ksor: owner: team:panaversity audience: [ public ] approval: by: process:panaversity at: 2026-11-09T20:42:36Z chapter: "F00A" part: Front expert_status: required concepts: [ "Cloud environments" ] last_verified: 2026-11-09 sources: - id: cloud-environments title: "Configure cloud environments (Anthropic, verified 2026-11-09)" resource: https://code.claude.com/docs/en/cloud-environments - id: self-hosted title: "Self-hosted environments (Anthropic, verified 2026-11-09)" resource: https://code.claude.com/docs/en/self-hosted-environments - id: self-hosted-identity title: "Verify session identity in self-hosted environments (Anthropic, verified 2026-11-09)" resource: https://code.claude.com/docs/en/self-hosted-environments-identity - id: claude-projects title: "Let Claude coordinate ongoing work with Projects (Anthropic, verified 2026-11-09)" resource: https://code.claude.com/docs/en/claude-projects generated: at: 2026-11-09T20:42:36Z by: process:panaversity trust_tier: unverified build_id: sha256:46fd53c5d7ab1c14f6347908d45c9fdaecda4d914439923ee878bdcecd57803e dirty: true ksor_version: 0.0.60 --- ### The sandbox has a settings layer **[Vendor-documented]** Each Claude Code cloud session "runs in a cloud environment." An **environment** is a named set of sandbox settings: network access, environment variables, network secrets and a setup script. The same environments apply to the desktop app, the mobile app, claude.ai/code, `claude --cloud`, cloud scheduled tasks and Claude Tag. Project threads use the environment set in the project.[^cloud-environments],[^claude-projects] **[Unknown]** The session examined here was started from a claude.ai chat. The environment page does not say whether chat sessions, or tasks in a conversation, use these settings. The environment page also says what happens to an idle VM. [The sandbox and its state](the-sandbox-and-its-state.md#when-the-vm-is-paused-restored-or-replaced) quotes it and compares it with what was observed. ### Network access **[Vendor-documented]** Each environment has one network access level for outbound connections.[^cloud-environments] | Level | What sessions can reach | | --- | --- | | None | Nothing through the session's network | | Trusted (the default) | Allowlisted domains: package registries, GitHub and cloud SDKs | | Full | Any domain | | Custom | Your own allowlist, with the defaults if you choose | **[Vendor-documented]** Four paths skip the allowlist at every level:[^cloud-environments] - GitHub, through its own proxy. - The MCP connectors you turn on. - The hosts listed on the environment's network secrets. - The Anthropic API, for Claude Code's own requests. ### Setup scripts and the environment cache **[Vendor-documented]** A **setup script** installs tools before Claude Code starts. If it finishes in about five minutes, Anthropic takes a **snapshot**. A snapshot is a saved copy of the disk. Later sessions start from it. It keeps files the script wrote, not programs that were running. It is rebuilt when you change the script or the allowed hosts, and after about seven days.[^cloud-environments] **[Inferred]** So a new session still gets a new desk. But the desk starts from a known picture. Speed comes from the cache, not from a VM that stays on. ### Variables, network secrets and the GitHub proxy **[Vendor-documented]** Environment variables are not private. "Anyone who uses the environment can read the values." For a key, use a **network secret**. Anthropic's agent proxy "adds the key to requests for the hosts you list, after each request leaves the session's VM, so the key itself stays outside the VM." The GitHub proxy works the same way. It "keeps your real GitHub credentials outside the session's VM."[^cloud-environments] Who may add a network secret depends on the plan. See [Appendix: runtime details](appendix-runtime-details.md#network-secrets). **[Inferred]** A network secret protects the key, not its use. A tricked agent cannot copy the key out. But it can still send requests to the listed hosts, with the key attached. So use the narrowest key the job needs, such as a read-only key. **[Vendor-documented]** On Team and Enterprise plans, an Owner can create environments shared with every member. Do not put secrets in a shared environment's variables, "because every member's sessions read them."[^cloud-environments] ### Self-hosted environments: the same session in your network **[Vendor-documented]** A **self-hosted environment** "executes Claude Code cloud sessions on infrastructure your organization operates." People start sessions the same way. Only the place changes. A **runner** is a program on your own hosts. It claims each session from Anthropic's queue, clones the repository and runs Claude Code. "Anthropic never connects into your network." Every connection goes out. [Appendix: runtime details](appendix-runtime-details.md#how-a-runner-handles-a-session) shows how runners claim sessions.[^self-hosted] | What stays on your machines | What still goes to Anthropic | | --- | --- | | Repository checkouts, build artifacts, secrets, and files the session creates or changes | The conversation: prompts, responses and tool results. Anthropic stores the transcript so you can resume elsewhere | | Your runner image and its tools | The control plane, the Anthropic service that organizes sessions: the queue, orchestration and the claude.ai interface | **Basis:** vendor-documented.[^self-hosted] **[Vendor-documented]** Model requests go to the Anthropic API by default. A runner can send them to Amazon Bedrock or Google Cloud's Agent Platform instead. But "session content goes to Anthropic in both cases." Self-hosted environments are in public beta for Team and Enterprise. They are off by default. They are not available with Zero Data Retention or the HIPAA configuration. They have no network secrets, so your deployment provides the keys. Anthropic says most teams are better served by its hosted environments.[^self-hosted],[^cloud-environments] **[Vendor-documented]** Each self-hosted session carries a signed token that your services can check. It proves which session and environment it belongs to. It shows whether a person or your organization's service identity started it. It does not prove which process presents it.[^self-hosted-identity] **[Inferred]** So it identifies a session, not a worker with narrow scopes. The [business layer](from-personal-worker-to-business-worker.md) still adds that. The token's fields are in [Appendix: runtime details](appendix-runtime-details.md#the-self-hosted-session-token). ### How it maps onto the four layers | Layer | Anthropic-hosted | Self-hosted | | --- | --- | --- | | UI | claude.ai, the apps, `claude --cloud`, scheduled tasks, Claude Tag | The same | | Backend | Anthropic: queue, orchestration, transcript | The same Anthropic control plane | | Harness and sandbox | Claude Code in an Anthropic VM, shaped by the environment | Claude Code on your runner, from your image | | Model | Anthropic API | Anthropic API, or Bedrock or Google Cloud's Agent Platform | **Basis:** vendor-documented.[^self-hosted],[^cloud-environments] ![Two places a cloud session can run. Anthropic-hosted: Claude Code runs in a VM shaped by the environment. The agent proxy adds network secrets outside the VM, and the GitHub proxy swaps in your real token. Self-hosted: a runner in your network claims the session and runs Claude Code, which reaches internal services and your git host. Traffic to Anthropic is outbound only, and model requests can go to Bedrock or Agent Platform instead. A callout says environments change where a session runs and what it reaches, not what it may do.](img/two-places-a-cloud-session-can-run.png) **[Inferred]** Environments and runners change what the sandbox can reach and where it runs. They do not decide whether an action is allowed. A self-hosted runner can even widen the reach. See [Security boundaries](security-boundaries.md). > **Rule to remember:** The environment decides where the session runs and what it can reach. Keep keys outside the sandbox and narrow. Keep approval in the service that acts. [^cloud-environments]: As verified on November 9, 2026. Configure cloud environments, Anthropic. [^self-hosted]: As verified on November 9, 2026. Self-hosted environments were in public beta on Team and Enterprise plans and off by default. Self-hosted environments, Anthropic. [^self-hosted-identity]: As verified on November 9, 2026. Verify session identity in self-hosted environments, Anthropic. [^claude-projects]: As verified on November 9, 2026. Let Claude coordinate ongoing work with Projects, Anthropic.