Documentation
Run Claude Code or Codex in a Runzivo sandbox
Connect to a sandbox over SSH, sign in to Claude Code or Codex with your own account or key, and keep credentials out of commands and source control.
Connect over SSH
On macOS or Linux, install rzv and OpenSSH, create a sandbox and wait until it is running. Write its SSH host entry once, then connect and work in /workspace. Sandbox SSH from Windows is not supported yet.
Claude Code and Codex are included in the developer image, signed out. Each sends requests from the sandbox straight to its provider, and the provider bills you for them. Runzivo bills sandbox infrastructure only.
rzv sandboxes ssh-config <sandbox-id> --write
ssh <sandbox-id>.rzvSign in to Claude Code
With a Claude subscription, run claude in the sandbox and follow the login prompt. No browser opens in the sandbox: open the login URL on your computer, sign in and paste the code back into the sandbox. The login is saved in ~/.claude in the sandbox.
With an Anthropic API key, enter the key inside the sandbox, not on your computer's command line. The key lasts only as long as that shell.
read -rs ANTHROPIC_API_KEY && export ANTHROPIC_API_KEY
claudeSign in to Codex
With an OpenAI API key, pipe it from your password manager over SSH, which is encrypted from your computer to the sandbox. With a ChatGPT plan, run codex login --device-auth in the sandbox, open the link on your computer and enter the code. OpenAI calls device code sign-in beta, and it must be turned on in your ChatGPT security settings or by your workspace admin.
<password-manager-command> | ssh <sandbox-id>.rzv 'codex login --with-api-key'Turn off Codex's own sandbox
Codex's own workspace-write mode needs bubblewrap, which the image does not include. The sandbox is already its own virtual machine, so turn off Codex's own sandbox in ~/.codex/config.toml. Codex can then change any file in the sandbox and reach the network.
sandbox_mode = "danger-full-access"Keep keys out of commands
- Do not pass keys with rzv sandboxes exec --env or inside an exec command. Runzivo keeps the exec request until the sandbox host receives it, and your shell history records it.
- Never put a key or a saved sign-in in /workspace or in source control.
- While the sandbox runs, workspace members with sandboxes:write can open a shell in it and read a saved login, a key file or a key in a running shell.
- Coding agents run commands and change files in the sandbox. Review the changes and run your tests before you push.
Stop, start and clean up
A stop and start keeps the sandbox disk: /workspace, ~/.claude, ~/.codex and their settings are still there. Running agent sessions end, so start them again. A new sandbox starts signed out.
A sandbox lives 8 hours by default, or 12 or 24 hours where host capacity permits. Stopping does not pause the lifetime. At expiry or deletion, the sandbox and its files, including any saved sign-in, are removed. Push the work you need first. Sign out before stopping if you do not want a sign-in kept.
# in the sandbox
claude auth logout
codex logout
# on your computer
rzv sandboxes delete <sandbox-id>