# Claude Managed Agents Environments
An **environment** is the sandbox configuration for [[Claude Managed Agents|managed agent]] sessions. You create it once with `config` (type, packages, networking) and reference its ID when starting sessions. Two types: `cloud` (Anthropic-managed, covered here) and `self_hosted` (sandboxes on your own infrastructure through a worker; see the self-hosted section of [[Claude Managed Agents]]). Each session gets its own **isolated container instance**: sessions never share filesystem state, even if they point at the same environment.
## Container basics
- Ubuntu 24.04 LTS, x86_64 (was 22.04 when this note was written)
- Up to 8 GB memory, 10 GB disk
- ~~Network disabled by default.~~ API-created environments default to `unrestricted` networking when `networking` is omitted; the Console form and Claude Studio start at `limited`. Always set it explicitly
## Pre-installed runtimes
Python 3.10 to 3.13 (pip, uv, poetry; NumPy, pandas, Matplotlib, openpyxl, python-docx, python-pptx, pypdf preinstalled); Node.js 20, 21, 22 (default) (npm, yarn, pnpm, bun); Go 1.24 (default) and 1.25; Rust stable (rustup); Java OpenJDK 21 (maven, gradle); Ruby 3.1 to 3.3 (bundler, gem); PHP 8.3 (composer); C/C++ (GCC 13 and Clang; make, cmake, ninja).
Databases: PostgreSQL 16 and Redis 7 servers plus clients are installed but not running by default; SQLite through language bindings.
Utilities: `git`, `curl`, `wget`, `jq`, `yq`, `ripgrep`, `tmux`, `make`, `cmake`, `vim`, `nano`, archive tools, docker (limited availability).
Documents and media: `ffmpeg`, ImageMagick, `pandoc`, headless LibreOffice, Poppler and `qpdf`, `tesseract` (English), TeX Live.
Browser automation: Playwright (Python and Node.js) with Chromium at `/opt/pw-browsers/chromium` (not on `PATH`); use the preinstalled Playwright rather than installing another version. No Firefox or WebKit.
## Packages field
Auto-installs before the agent runs. Cached across sessions that share the environment. Install order is alphabetical: apt, cargo, gem, go, npm, pip.
```json
{
"packages": {
"pip": ["pandas", "numpy==2.2.0"],
"npm": ["
[email protected]"],
"apt": ["ffmpeg"]
}
}
```
Version pinning is optional; default is latest. With `limited` networking, `packages` requires `allow_package_managers: true`, otherwise the create request fails with a 400.
## Networking modes
`networking` controls **container outbound access**: it does *not* constrain `web_search` / `web_fetch` tools' allowed domains.
| Mode | Behavior |
|---|---|
| `unrestricted` | Full outbound except a safety blocklist. What an API request gets if it omits `networking` |
| `limited` | Only `allowed_hosts` (bare hostnames or wildcards like `*.example.com`; no scheme, port or path) plus optional `allow_package_managers` and `allow_mcp_servers`. With nothing set, no host is allowed; blocked requests get a 403 naming the host |
For production, always use `limited` and give only the minimum access the agent needs. The web tools run on Anthropic's servers; restrict them with `allowed_domains` / `blocked_domains` on their toolset entries instead (see [[Claude Managed Agents Tools]]).
Caveats from the docs:
- Access is per host, not per operation: an allowed host (GitHub with `allow_package_managers`) also accepts uploads such as `git push`. A prompt-injected agent could exfiltrate files that way. Mitigation: set `bash` to `always_ask` or `auto`, or keep `allow_package_managers` off when you don't need `packages`
- With `allow_mcp_servers: false`, session creation fails (400) if the agent, or an agent it can delegate to, declares an MCP server whose host isn't in `allowed_hosts`
- The default `always_allow` policy on the agent toolset plus `unrestricted` networking means nothing pauses outbound requests
- [[Claude Managed Agents|Vault]] environment-variable secrets are only substituted for hosts allowed at BOTH the credential level and the environment level
```json
{
"networking": {
"type": "limited",
"allowed_hosts": ["api.example.com"],
"allow_mcp_servers": true,
"allow_package_managers": true
}
}
```
## Lifecycle
- Environments persist until archived or deleted
- **Not versioned**: if you change an environment, you lose the ability to map session state back to the old config, so log updates externally
- `archive` makes it read-only but keeps existing sessions alive. A [[Claude Managed Agents|scheduled deployment]] that uses an archived environment records a failed run and auto-pauses
- `delete` only works if no sessions still reference it
## References
- https://platform.claude.com/docs/en/managed-agents/environments
- Cloud sandbox reference (old URL `/cloud-containers` now redirects here): https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference
- Scheduled deployments (failure behavior): https://platform.claude.com/docs/en/managed-agents/scheduled-deployments
- Vaults (allowed hosts): https://platform.claude.com/docs/en/managed-agents/vaults
## Related
- [[Claude Managed Agents]]
- [[Claude Managed Agents Sessions]]
- [[Claude Managed Agents Tools]]