History
- Aug 6, 2026Volumes attach to environments directly.
- Aug 3, 2026The agent runtime moved onto the environment — leaving it unset makes an environment sandbox-only.
Environments
One definition of a runtime — image, tools, secrets, egress — that agents and sandboxes both run.
WhereConsoleTerraform
Introduced Jul 16, 2026 · updated Aug 6, 2026
Environment · build
- runner
- prod-eu-1
- flavor
- ram-2gb
- workspace
- devcontainer-go : 1.2.0
- agent runtime
- codex : 0.146.0
- mcp servers
- files · postgres
- egress rules
- 4 attached
Agent
Starts on a message
Sandbox
Starts when you ask
same image · same secrets · same egress
How it works
One definition, both ways of running.
An agent runs in an environment; a sandbox runs the same one. What an engineer tries by hand and what runs unattended are the same thing.
Compute is a named flavor.
ram-2gb from the runner's catalog, not a YAML block — resolved when the workload starts. Image tags resolve at start too, so pushing a new build rolls out on the next run.
A guard rail against 3 a.m.
Leave the agent runtime unset and the environment hosts sandboxes but never an agent — the mistake fails at write time, not in production at night.
Availability is access control.
internal opens the environment to the whole organization; private only to identities you grant. Running in one reaches its secrets, egress credentials, and volumes — so who may run is a real decision.
See it on your own cluster.
Thirty minutes, your infrastructure, your stack. Or skip the call — it is one Helm release onto a cluster you already run.