TL;DR: Claude Code Managed Agents self-hosted sandboxes shift execution of interactive agent sessions from Anthropic's infrastructure to compute you own and operate, which means your code and credentials never leave your network, you pay directly for the underlying machines instead of a usage premium, and your team becomes responsible for provisioning, scaling, and securing that environment. This is distinct from headless CI/CD use, where Claude Code runs automated pipeline tasks rather than live developer sessions.
Key Takeaways
Self-hosted runners shift infrastructure ownership: You control the sandbox where Claude Code Managed Agents sessions run, including what data leaves it, where it goes, and who can see it.Data residency becomes enforceable, not just promised: Tool execution, files, and egress stay inside your VPC or on-premises network, so sensitive data does not need to touch Anthropic during a session.Cost structure trades predictability for control: You stop paying Anthropic per session and start paying for your own containers; idle costs are now your problem to tune.Self-hosted runners are not the same as headless CI/CD: They are for interactive Claude Code Managed Agents sessions, not short, automated pipeline tasks.Ops ownership is yours: You now handle observability, networking, and incident response for the sandbox layer.
Introduction
Your security team signed off on Claude Code. Your compliance officer asked one question ("where does the data actually go during a session?") and nobody had a clean answer.
What Does "Self-Hosted Runner" Actually Mean for a Claude Code Managed Agents Session?
A Claude Code self-hosted runner is a customer-operated sandbox where tool execution, files, and network egress run entirely on your infrastructure instead of Anthropic's compute.
Teams often mix up three different setups:
- Headless CI/CD (not this): Run Claude Code non-interactively in GitHub Actions; short jobs that exit on completion.
- DIY community setups: Containerized HTTP runners and admin UIs that worked but broke when upstream changed and had no SLA.
- Official self-hosted sandboxes: Interactive Claude Code Managed Agents sessions keep tools, files, and egress inside your infrastructure.
This distinction matters most when sessions keep state and run for a while, such as a code-editing workflow hitting internal APIs and private files. That is the use case self-hosting is built for.
How Do Self-Hosted Runners Change Your Security Posture and Data Residency Compliance?
Self-hosted runners let you prove residency at the network layer: tools, files, and egress never leave your perimeter, so compliance is evidenced at the infrastructure level rather than resting on contractual promises alone.
Key changes your team will own:
- Network egress control: Enforce container or VPC policies that pin sessions to internal APIs, artifact stores, and secret managers. Published patterns exist for running Claude Code through your own gateway, on your own models, and inside your own VPC with full audit logs and cost controls.
- Secrets handling: In a self-hosted setup, credentials can be mounted from your own secret manager so they remain inside your perimeter during a session. Consult your own security architecture for the appropriate integration pattern.
- Audit ownership: Session logs and tool and file access flow into your own SIEM and telemetry stack rather than a vendor's.
Anthropic's docs state that tool execution, files, and egress remain in your infrastructure with self-hosted sandboxes. That boundary closes the residency gap by design.
What Does the Cost Structure Actually Look Like, and Who Pays for Idle Compute?
Self-hosting swaps per-session managed costs for provisioned container costs. Savings require high utilization and good autoscaling; otherwise idle burn eats them.
Table 1: Managed vs. Self-Hosted Cost Dimensions
| Dimension | Anthropic-Managed Compute | Self-Hosted Runners |
|---|---|---|
| Billing unit | Per session / per token | Provisioned container uptime |
| Idle cost | None | You pay for idle containers |
| Predictability | High | Variable (autoscaling matters) |
| Optimization lever | Reduce usage | Right-size, autoscale, spot |
| FinOps visibility | Anthropic dashboard | Your cloud cost tools |
| Burst capacity | Anthropic absorbs | You provision and scale |
Idle costs are easy to underestimate. One documented configuration runs Claude Code with a self-hosted 20B coding model quantized to 4-bit on an A4500 GPU at $0.25/hour, which looks cheap until underused containers sit between sessions.
As a practical rule of thumb used in this guide: plan around average utilization rather than peak load. Steady, high utilization tends to favor self-hosting; spiky or light use often favors managed compute once you include idle time and ops overhead.
What Operational Ownership Does Your Team Silently Inherit, and How Do You Prepare?
With self-hosted Claude Code Managed Agents sessions, your platform team owns failures, spikes, and crashes inside your sandbox. No Anthropic SLA covers your containers.
Consider an agent session that hangs at minute 38. On managed compute, the platform times it out and cleans up. On your own cluster, detecting and reaping that container is your responsibility.
Prepare with these three areas, framed as the framework used in this guide:
- Observability: Track per-session CPU, memory, network, lifecycle events, and hang or runaway alerts with your own tooling. Community dashboards emerged specifically to fill these visibility gaps before official support existed; production-grade telemetry remains your team's responsibility regardless. [5]
- Container networking: Test egress limits and internal access before sessions go live. Misconfigured network rules can surface as apparent model failures, so shipping smoke tests alongside the sandbox configuration is a practical precaution.
- Runbooks: Define failure states, paging paths, cleanup steps, and what session state can be recovered. This groundwork should be in place before you expand your on-call surface.
Frequently Asked Questions
What infrastructure do I need to run Claude Code Managed Agents self-hosted sandboxes on my own cloud or on-premises environment?
Anthropic's documentation describes running Claude Code Managed Agents sessions in self-hosted sandboxes with tool execution, files, and network egress in your own infrastructure. Consult the official docs for current platform requirements, as specifics are subject to change.
How do self-hosted Claude Code Managed Agents sessions handle secrets and credentials differently than Anthropic-managed sessions?
In a self-hosted setup, your infrastructure controls what leaves the perimeter during a session. Credentials can be mounted from your own secret manager so they stay internal. The appropriate integration pattern depends on your own architecture and security requirements.
What compliance and data residency requirements does the self-hosted runner model satisfy that the managed option does not?
Self-hosted sandboxes provide network-level proof of residency because tools, files, and egress remain internal to your infrastructure by design rather than by policy commitment alone.
How is a self-hosted Claude Code Managed Agents session different from using Claude Code headlessly in GitHub Actions?
Headless CI/CD is short, automated, and stateless. Self-hosted runners power interactive, long-lived sessions with tools, files, and persistent state. These are fundamentally different sandbox models with different infrastructure, cost, and ops implications.
Conclusion
Moving to Claude Code Managed Agents self-hosted sandboxes is an ownership decision. You gain residency proof and infrastructure control, and you take on incidents, idle spend, and monitoring in return. Community builds demonstrated the pattern works; official documentation makes it supportable. Running it reliably still requires production-grade ops.
Start with an audit of one Claude Code Managed Agents session. List each tool call, file path, and outbound destination. That inventory becomes the foundation for your network policy and shows you exactly where the gaps are before you commit to the infrastructure shift.
Learn from me
Claude Code in Practice, my Maven cohort. Master Claude Code from fundamentals to advanced orchestration: skills, subagents, hooks, MCP, and production automation. Join the next cohort →
Hire us
Traversaal.ai. We're a team of forward deployed engineers solving the toughest AI problems for Fortune 100 companies: document intelligence, agentic data platforms, and real-time web intelligence, deployed in production. Work with our team to deploy your next agentic ecosystem. Talk to Traversaal.ai →
Join us
Want to solve these problems with us? We're always looking for forward deployed engineers who want to ship production AI. jobs@traversaal.ai
