bash, read, write, edit, glob, and grep call executes on infrastructure you own.
Point that half at boxd and each session gets a full Linux machine with its own kernel, root, a persistent disk, and an HTTPS domain. The machine boots in milliseconds, goes to standby between turns, and wakes with its filesystem and processes exactly as the last turn left them.
A Claude Managed Agents session. Anthropic runs the agent, the tool calls run in a boxd machine that did not exist when the session started.
How it fits together
A worker inside the machine long-polls Anthropic’s work queue over plain outbound HTTPS. Nothing dials into your network, so the machine can keep every inbound port closed.Set up the Anthropic side
Install theant CLI and sign in:
sk-ant-oat01-… value is the only credential the worker needs, and it is scoped to this one environment’s work queue.

The environment in the Claude Console. Generating the key is the one step that lives here, and the worker count shows when something is connected.
Quickstart, one machine
The fastest working setup is a single machine polling for work. Create it, install the worker, and give it a/workspace to operate in:
~/worker.log.
--auto-hibernate-timeout=0 turns hibernation off for the machine either way. Auto-suspend is set per machine and is off by default. See Suspend, resume, and hibernate.One machine per session
A single machine means every session shares one filesystem. Giving each session a machine of its own buys three things. Sessions cannot see each other’s files. A session that wrecks its machine wrecks only its own. And each machine sleeps on its own schedule. The shape is an orchestrator that turns each queued work item into a machine.Build the snapshot once
Every session machine is created from a snapshot, so the worker and your toolchain are already in place:Run the orchestrator
The orchestrator receives Anthropic’ssession.status_run_started webhook, drains the work queue, and runs each session’s worker in that session’s own machine. When the session ends, it deletes the machine. Put it on its own boxd machine, where the SDK authenticates automatically with no key to manage.
- TypeScript
- Python
https://cma-orchestrator.boxd.sh/webhook in the Claude Console under Manage, then Webhooks, subscribed to session.status_run_started, session.status_terminated, and session.deleted. Put the whsec_ secret it shows next to the environment id and key, in a .env beside the orchestrator file:
204 in ~/orchestrator.log. Anything unsigned gets a 401.
Resume instead of recreate
The worker exits a minute after the session goes idle, and the orchestrator pauses the machine. That takes it tostandby, where it keeps its memory and running processes and bills no vCPU. The orchestrator turns auto-hibernate off on session machines, so a machine stays on standby until its next turn.
When the next turn arrives, the same session resolves to the same machine name, and resuming is sub-millisecond. The agent finds /workspace as it left it, dependencies installed and caches warm. For a long conversation with gaps between turns, that is the difference between re-cloning a repo every time and picking up mid-thought.
The machine is deleted when the session terminates or is deleted, so its state lives exactly as long as the session does.
Without an SDK
Anthropic’s poller can hand each work item to a script instead of running the tool loop itself. That script is the whole orchestrator:agent- machines of finished sessions yourself.
boxd CLI is signed in as you. The in-machine CLI cannot reach an --isolated machine, so exec from inside another machine fails with “not found or not accessible”. To drive isolated workers from code, use an orchestrator like the one above. It runs outside the worker machines and calls the SDK, which takes an API key in BOXD_API_KEY.Credentials the agent can use but never read
Self-hosted environments do not support Anthropic’s vault environment-variable credentials, because the egress is yours. boxd covers the same ground at its own edge. Bind a secret to the hosts it may be sent to, and the machine only ever holds a placeholder:api.stripe.com on the way out. Inside the machine, env, shell history, and the agent’s own transcript contain nothing but an opaque bxds_… string. A prompt injection that talks the agent into printing every secret it can find gets placeholders. Set it once with scope all and every session machine in the organization carries it. An isolated machine receives the variables in its scope through exec sessions, and exec is exactly how the orchestrator starts the worker.
Pair it with a per-machine egress allowlist so the machine can only reach the hosts you name. A machine created from a snapshot starts unrestricted, so set the list in ensure_machine right after create:
Files and repositories
Self-hosted environments rejectfile and github_repository session resources, since Anthropic has no container to mount them into. Two boxd answers, depending on whether the data is shared or per-session:
Shared across every session. Bake it into the snapshot. Clone the repo, install the dependencies, warm the caches, then save. Every session starts with it, with nothing to install or download first.
Per session. Copy it in from the orchestrator before starting the worker, using the session’s own metadata to decide what. Your app sets the metadata when it creates the session, with its org API key:
/workspace, and the orchestrator reads the file out with machines.files.download once the turn ends.
Parallel exploration
A fork copies a running machine’s disk, memory, and processes in under 200ms. Fork a session machine several times mid-task and each copy continues from the same live state, so an agent can try several approaches at once and keep the one that works:bash, or drive it from the orchestrator. Agent swarm intelligence covers the fan-out and merge pattern in full.
What you own
FAQ
Does the machine need a public endpoint?
Does the machine need a public endpoint?
name.boxd.sh.What happens if the machine dies mid-session?
What happens if the machine dies mid-session?
requires_action, waiting for a tool result that will never arrive, and rejects new messages until you send user.interrupt. That abandons the dead call and returns the work item to the queue. The next message starts a turn, the webhook fires, and the orchestrator creates a fresh machine from the snapshot under the same name, since the old one is gone. A polling worker claims the returned item on its own.Do memory stores work?
Do memory stores work?
EnvironmentWorker, which downloads each store to /mnt/memory and syncs it back. The ant CLI worker used here does not mount them. Swap the in-machine worker for a small Python or TypeScript entrypoint calling handle_item() if you need them, and see Anthropic’s notes on memory stores.Which model should the agent use?
Which model should the agent use?
agent.yaml. The environment has nothing to do with model choice, so a self-hosted sandbox costs the same per token as a cloud one.