Claude Managed Agents Self-Hosted: Setup and Real Costs

Do not index

Claude Managed Agents self-hosted sandboxes let Anthropic keep running the agent loop and the model while every bash and file command runs on a Linux machine you control. You create a self_hosted environment, run Anthropic's worker on your machine, and each session waits in a queue until your worker claims it. On Agent37, that machine is a sandbox that costs $4.76 a month left on around the clock, or cents a month when it sleeps between turns.

We built this end to end on Agent37 in October 2026 and published the code. This guide covers what self-hosting changes, when it is worth the extra work, what it adds to Anthropic's own meter, and four problems we hit so you can skip them.

What Claude Managed Agents self-hosted sandboxes change

By default, every Managed Agents session gets a fresh Linux container on Anthropic's infrastructure, with common languages and tools preinstalled. A self-hosted sandbox moves one thing: tool execution. Claude still runs on Anthropic's side and decides what to do next. A program you run, called a worker, carries out each bash and file call and posts the result back.

Here is the split, from Anthropic's environment guide:

ㅤ	Cloud environment	Self-hosted sandbox
Where commands run	Anthropic's container	Your worker
Files and processes	On Anthropic's side	Stay on your worker
Still sent to Anthropic	Conversation, tool results, files, skills, memory	Conversation, tool results, skills, memory
Network rules	Set on the environment	Your own policy
Installed software	A preinstalled set plus what you add	Whatever your image has
What you operate	Nothing	The host, its hardening, the environment key

Two things stay where they were. Tool results still travel to Anthropic, because that is how the model reads them. Web search and web fetch also run on Anthropic's side. So self-hosting keeps your files and processes on your machine, while the conversation itself still lives with Anthropic.

When a self-hosted sandbox is worth it

Anthropic's own advice is to start with the cloud environment. Self-host when one of these is true:

The data can't leave your network. Source code, customer files, or a database dump stay on the worker. Only what a command prints goes back.

The agent needs internal services. Commands run inside your network, so the agent can reach a private API or package registry.

You want your own toolchain. Compilers, CLIs, and internal packages live in the image instead of being installed at the start of every session.

The work should persist. A cloned repo and its installed dependencies can still be there next week.

The job needs a different machine. More cores, more memory, or a full VM that runs Docker.

The cost is that you become the operator. You harden the image, control egress, rotate the environment key, and keep sessions apart. You also give up a few cloud features. Anthropic won't mount file or github_repository resources into a self-hosted session (the request fails with a 400), vault environment-variable credentials don't apply, and the sandbox has only what your image installs.

How the worker and the queue fit together

A self_hosted environment is a work queue. Setup takes four steps.

Create the environment. In the Claude Console choose Environments, then Create environment, then Self-hosted. Or use the API:

curl https://api.anthropic.com/v1/environments \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -H "anthropic-beta: managed-agents-2026-04-01" \
  -H "content-type: application/json" \
  -d '{"name": "agent37", "config": {"type": "self_hosted"}}'

Generate an environment key. Open the environment in the Console and click Generate environment key. This step is Console-only, even for an environment you created through the API. The worker signs in with this key. A regular Claude API key in its place fails with 401 Invalid bearer token.

Start the worker on a Linux host with /bin/bash and outbound HTTPS. It needs no open port and no public URL:

export ANTHROPIC_ENVIRONMENT_ID="env_..."
export ANTHROPIC_ENVIRONMENT_KEY="sk-ant-oat01-..."
ant beta:worker poll --workdir /workspace

Create sessions that target the environment. Each one waits until a worker claims it. To confirm the worker is connected, call GET /v1/environments/{id}/work/stats and check that workers_polling is at least 1.

The ant worker serves one session at a time and holds it for a minute after each turn, so a quick follow-up skips the queue. To run sessions in parallel, start more workers on the same environment. They all poll one queue, and each session goes to the first free worker.

What it costs: Anthropic's meter plus your machine

Anthropic bills Managed Agents on two things: tokens at the normal model rates, and $0.08 per session-hour while a session is running. Time a session spends idle, waiting for your next message, is free. Web search adds $10 per 1,000 searches. Our Claude Managed Agents pricing breakdown walks through the full math.

Anthropic's pricing page makes no exception for self-hosted environments, so plan on the same $0.08. In the cloud environment, the container is included in that rate. When you self-host, your machine becomes an extra line. That is the honest trade: you pay a little more and get control in return. The job is to keep that extra line small.

On Agent37, compute bills per minute while a sandbox is awake, and disk bills for as long as it exists. The default sandbox has 2 vCPU, 4 GB RAM, and 4 GB disk:

Setup	What it does	Agent37 cost
One always-on worker	Serves sessions one at a time, never sleeps	$4.76 a month
One sandbox per session	Agent works about 10 minutes a day, sleeps the rest	About $0.40 a month per session
A sleeping sandbox	Keeps the session's files, uses no compute	About $0.36 a month for 4 GB
Full VM, always on	Its own kernel, runs Docker	$11.36 a month

These are sandbox costs only. Tokens and session runtime still bill to your Claude account. The full rate card is on our pricing page.

Two ways to run it on Agent37

One always-on worker

Build an image with the ant CLI as its main process, publish it as a template, and create one sandbox with the environment ID and key in its env. The worker starts polling within seconds. Our setup guide has the Dockerfile and every command.

Leave auto-sleep off for this setup. The worker's polling is outbound traffic, which doesn't count as activity, so a sleeping sandbox would stop claiming sessions. This shape suits a team agent or a single pipeline. Sessions share one disk, so pick the next option when customers must not see each other's files.

One sandbox per session

Our open-source example gives every session its own computer. A Node.js orchestrator of about 100 lines runs on your server and long-polls the queue with the Anthropic SDK's WorkPoller. For each session it claims, it finds that session's sandbox or creates one with auto-sleep on. Then it starts ant beta:worker run through Agent37's exec API, which wakes a sleeping sandbox first.

npm install
cp .env.example .env    # fill in the four keys
node create-agent.mjs   # prints AGENT_ID, add it to .env
node orchestrator.mjs   # leave this running
node chat.mjs "Clone https://github.com/sindresorhus/slugify into /workspace, install its dependencies, and run its tests."

In our test the agent cloned the repo, installed its dependencies, and reported all 25 tests passing. Ten minutes later the sandbox was asleep, billing disk alone. The next message woke it, and the agent went straight back to the code: no clone, no install. Three parallel sessions, each counting primes in a different language on its own sandbox, finished in 13 seconds.

Only the environment key and that session's secret enter the sandbox. Your Claude API key and Agent37 key stay with the orchestrator, out of reach of anything the agent runs.

Four problems we hit building it

git log hung for two minutes. The bash tool runs on a terminal, so any command that opens a pager waits for a keypress until the tool times out. Set PAGER=cat in the worker's environment.

Our client quit after the first tool call. While the worker runs a tool, the session reports idle with a stop reason of requires_action. Treat a turn as finished only when the session goes idle for any other reason.

A sleeping sandbox never claims work. The worker's calls out to Anthropic don't keep it awake. Run the worker always on, or wake the sandbox from outside, which is what the orchestrator does.

Inputs are yours to stage. With no file or github_repository resources, clone or download inputs into /workspace before the session starts, or let the agent fetch them.

FAQ

Does a self-hosted sandbox lower the Claude Managed Agents bill?

No. Tokens and the $0.08 session-hour still apply, and your sandbox adds a line on top. Self-host for control and persistence, then keep the sandbox cheap.

Does my data stay off Anthropic's servers?

Your files and processes stay on the worker. The conversation history and every tool result still go to Anthropic, because the model needs them to continue.

Can one worker run several sessions at once?

The ant worker runs one session at a time. Start several workers on the same environment, or give each session its own sandbox as the example does.

Which sandbox providers work?

Any Linux host with /bin/bash and outbound HTTPS. Anthropic links guides for providers including Cloudflare, Daytona, E2B, Modal, and Vercel. Agent37 runs Anthropic's stock ant worker with no changes.

Can the agent run Docker?

Not on a standard Agent37 sandbox, which uses gVisor. Create a full VM instance instead. Its agent37-ubuntu template includes Docker.

Run your first self-hosted session

If you already have a Managed Agents agent, nothing in it changes. Create a self-hosted environment, point a sandbox at it, and your next session runs its commands on a computer you control. Clone the example repo for one sandbox per session, or follow the always-on guide.

Create your first sandbox. New Cloud accounts get $5 of starter credit after adding a card, which covers an always-on worker for about a month. If you are still deciding between Managed Agents and running your own agent loop, read our guide to the Claude Agent SDK sandbox or the Claude Managed Agents alternatives.

Using Cursor as well? The same machines run Cursor self-hosted agents, where Cursor keeps the agent loop and your instance runs the commands.

Claude Managed Agents Self-Hosted Sandboxes: Setup, Costs, and Working Code