# Best sandbox for Claude Code in 2027

Runtime Cloud (withruntime.com) gives each headless session its own kernel, no key inside, for 80% less than E2B.

## Which sandbox is best for Claude Code?

It depends on who starts the sessions. For headless sessions your own code
starts, Runtime is the lowest
bill of the sandboxes priced below: $16.25 for a
thousand half-hour sessions, against $32.11 on
Cloudflare Sandbox and $82.80 on E2B. Each session
gets a microVM with its own kernel, and the Anthropic key never enters it.
Pick Anthropic's cloud sessions if you work from Claude's own apps with a
subscription and want nothing to set up.

## Which isolation does Anthropic recommend for Claude Code?

Anthropic's [sandbox environments page](https://code.claude.com/docs/en/sandbox-environments),
read on 25 October 2026, ranks the options from a per-command sandbox to a
separate machine:

| Approach Anthropic lists | What it isolates                         | When Anthropic suggests it                                     |
| ------------------------ | ---------------------------------------- | -------------------------------------------------------------- |
| Sandboxed Bash tool      | Shell commands only                      | Fewer prompts on your own machine; "not sufficient" unattended |
| Sandbox runtime          | The whole process, on the host's kernel  | Unattended runs without Docker                                 |
| Dev or custom container  | A full environment, on the host's kernel | A standard team environment                                    |
| Virtual machine          | A full operating system, its own kernel  | Untrusted repositories and code; kernel-level separation       |
| Cloud sessions           | An Anthropic-managed VM                  | Work from any device, with a Claude subscription               |

For an untrusted repository the page names "a dedicated virtual machine", and
lists Firecracker microVMs among the ways to get one. It also says to "always
run `--dangerously-skip-permissions` sessions inside a container, a VM, or the
sandbox runtime", and that Claude Code refuses that flag as root.

## What makes a sandbox good for Claude Code?

- **Its own kernel.** A container shares the host's kernel, so a kernel bug
  is a way out. A microVM boots its own.
- **A key the session cannot leak.** Anthropic's dev container warning is that
  skipping permissions does not stop a malicious project from exfiltrating
  what is inside, "including the Claude Code credentials". A sandbox that
  holds only a placeholder for the key has nothing to leak.
- **Egress you set from outside.** Rules the host enforces cannot be widened
  by root in the sandbox, so Claude Code can be held to `api.anthropic.com`
  and your package registry.
- **A session that may run long.** A time limit that ends a session mid-task
  throws its work away; the sandbox should run while Claude works.
- **A start that does not wait for npm.** An image with Claude Code baked in
  once means every session starts with it installed.

## What do Claude Code sessions cost on each sandbox?

A thousand headless sessions a month, each 30 minutes on a 2 vCPU, 4 GiB
sandbox and busy for 180 CPU-seconds while Claude reads, edits and runs tests:

| Provider           | Isolation                 | A month of sessions                   | Runtime costs less by                   |
| ------------------ | ------------------------- | ------------------------------------- | --------------------------------------- |
| Runtime Cloud      | Firecracker microVM       | $16.25    |                                         |
| Cloudflare Sandbox | A container in its own VM | $32.11 | 49% |
| Vercel Sandbox     | Firecracker microVM       | $48.80     | 67%     |
| E2B                | Firecracker microVM       | $82.80        | 80%        |
| Daytona            | Containers by default     | $82.80    | 80%    |
| Modal              | gVisor, a shared kernel   | $118.98      | 86%      |

The model's tokens cost more than any of these machines; the sandbox is the
part of the bill that the choice of provider decides.

## When might another sandbox fit better?

- **Claude Code on the web.** With a Claude subscription, Anthropic's cloud
  sessions run Claude Code in an Anthropic-managed VM with nothing to set up.
  A sandbox you hold is for sessions your own code starts, sizes and keeps.

## Runtime Cloud

Runtime gives each Claude Code session a Firecracker microVM with its own
Linux kernel, runs it as a non-root user so `--dangerously-skip-permissions`
starts, and never puts the Anthropic key inside. The key is a Runtime secret:
the sandbox holds a placeholder that the host replaces only on HTTPS requests
to `api.anthropic.com`. `sbx.network.set({ allow: [...] })` sets the egress
rules from outside. A sandbox has no time limit: it runs while it works, and
when credit or a cap runs out it pauses by default instead of throwing the
work away. Bake Claude Code into a [custom image](/docs/images) once, and
every session starts with it installed.

A thousand half-hour headless sessions a month, each busy for three
CPU-minutes, the job in the table above, cost
$16.25 on Runtime, 80%
less than on E2B, at rates checked 25 October 2026. A session that pauses
between a user's turns costs only storage while paused, at
$0.08 per GB a month.

### A run on Runtime, recorded 1 October 2026

The whole setup is a secret, a sandbox and one command:

```bash no-run
printf %s "$ANTHROPIC_API_KEY" | npx withruntime secrets set ANTHROPIC_API_KEY --host api.anthropic.com
```

```ts check
import { Sandbox } from "withruntime";

await using sbx = await Sandbox.create({ timeoutSeconds: 3600 });
await sbx.exec("npm install -g @anthropic-ai/claude-code", { check: true, timeoutMs: 600_000 });
console.log((await sbx.exec("claude --version")).stdout);
const run = await sbx.exec(
  ["claude", "-p", "Write and run a FizzBuzz in Python.", "--output-format", "json"],
  {
    timeoutMs: 1_800_000,
  },
);
console.log(JSON.parse(run.stdout).result);
```

On 1 October 2026 we ran the install and the version check against a fresh
production sandbox, without a model call:

```text
npm install -g @anthropic-ai/claude-code   exit 0
claude --version                           2.1.287 (Claude Code)
```

The npm package installed as it is, on Ubuntu 24.04 with Node.js 24, and the
CLI started as the sandbox's own user. Cloning a repository, the headless flags
and copying the diff back are in [Claude Code in a sandbox](/integrations/claude-code).

### Can Claude Code use Runtime as a tool instead?

Yes. Claude Code on your laptop can start and use sandboxes through Runtime's
MCP server: `claude mcp add runtime -- npx -y withruntime mcp` gives it tools to
create a sandbox, run commands, share a port and fork. That keeps the editor
experience local and sends the risky part, running the code, to a microVM. The
two directions are covered in [MCP tools](/docs/mcp#tools) and the
[editors guide](/docs/editors).

To run your first sessions free, sign in with `npx withruntime login`. Scripts
that start Claude Code on another provider's sandbox switch over with the
[migration guide](/docs/migrate).

## Sources

Checked 25 October 2026.

- [Choose a sandbox environment](https://code.claude.com/docs/en/sandbox-environments):
  the approaches compared, the virtual machine recommendation for untrusted
  code, and the root and `--dangerously-skip-permissions` rules
- [Development containers](https://code.claude.com/docs/en/devcontainer): the
  credentials exfiltration warning
- Each provider's published rates, checked 25 October 2026, as the
  [pricing guide](/docs/pricing) lists them
- The recorded run: `@anthropic-ai/claude-code` 2.1.287 from npm, in a
  production sandbox on 1 October 2026