The sandbox
The isolated cloud environment agents run in, and how to detect it.
Every agent runs in its own cloud sandbox: an isolated Linux container created for the session, with the session's repositories already cloned, and torn down when the session finishes. Nothing an agent installs or breaks can leak into the next session; the only thing that carries over is the cached image the sandbox boots from, which holds the repositories and anything the config bakes in at image build time.
What's inside
The base image builds on python:3.13: Python 3.13 with pip, Node.js 22 with npm, git, the GitHub CLI (gh), curl, and a C/C++ toolchain (make, g++). Repositories are cloned before the agent starts, and gh is already authenticated against them.
Skills load at startup: each repository's .claude/skills/ at the session's checkout, plus any config-declared skills, installed at ~/.claude/skills/ before the agent begins. See Share skills across your team's agents and repositories.
Each sandbox gets 1 vCPU, 4096 MiB of memory, and a one-hour session timeout. sandbox.compute sizes CPU and memory up to 16 vCPU and 64 GiB, and can shorten the timeout; one hour is the maximum, matching the one-hour lifetime of the sandbox's GitHub token (see Size the compute).
Beyond that, an agent can install tools at run time, or the config can bake tools and dependencies into the image and run setup hooks.
Credentials are scoped and die with the sandbox
The sandbox holds no long-lived secrets. Its GitHub token (GH_TOKEN) is a one-hour installation token minted for that sandbox alone, scoped to the repositories in it; the config's sandbox.github_token can narrow it further, down to read-only or a chosen permission set (see Restrict the GitHub token). Model calls route through the Ellipsis proxy with a synthetic key (a real Anthropic key never enters the sandbox), and the Ellipsis API token can read but not modify your stored sandbox variables. The proxy and API tokens are revoked when the sandbox is torn down; the GitHub token expires on its own within the hour.
Detecting the sandbox
Ellipsis sets ELLIPSIS_SANDBOX_ID in every sandbox, and nowhere else. If your agents need to know whether they are running on the Ellipsis cloud, have them check ELLIPSIS_SANDBOX_ID.
Environment variables
Anything named under an agent's sandbox.variables is an ordinary environment variable in that session: $NPM_TOKEN in shell, os.environ["NPM_TOKEN"] in Python. Only the variables an agent names reach its sandbox. See Inject credentials with sandbox variables.