Claude Code in a repository sandbox

---

Give each coding session a fresh checkout with Claude Code, GitHub CLI, and your Git identity. Start it from a reusable Chalk function, then return to the same work through tmux.

The provisioner below prepares a sandbox with 2 CPUs and 16 GiB of memory and clones your repository. The launch command opens Claude in the checkout.

​

Define the provisioner

Save this as coding_agent_sandbox.py. Replace your-org/your-repo, Your Name, and you@example.com with your repository and Git author identity.

# /// script
# dependencies = ["chalkcompute==2.13.4"]
# ///
import base64
import os
import uuid

import chalkcompute


@chalkcompute.function(secrets=[chalkcompute.Secret.from_chalk_env("GITHUB_TOKEN")], chalk_identity=True)
def coding_agent_sandbox(memory_gib: int = 16) -> chalkcompute.Sandbox:
    """Create a repository checkout with Claude Code installed.

    Args:
        memory_gib: Sandbox memory in GiB.
    """
    sandbox = (
        chalkcompute.Sandbox(
            name="coding-agent-" + str(uuid.uuid4()),
            image=chalkcompute.Image.sandbox()
            .with_claude_code(
                "2.1.270",
                trusted_dirs=["/workspace/repo"],
                permission_mode="bypassPermissions",
            )
            .with_gh()
            .with_tmux()
            .workdir("/workspace/repo"),
            cpu="2",
            memory=f"{memory_gib}Gi",
            network_policy=chalkcompute.NetworkPolicy(
                allowed_hosts={
                    "*": [],
                    "github.com": [
                        chalkcompute.NetworkPolicy.Rule(
                            transforms=[
                                chalkcompute.NetworkPolicy.Transformer(
                                    headers={
                                        "Authorization": "Basic "
                                        + base64.b64encode(
                                            f"x-access-token:{os.environ['GITHUB_TOKEN']}".encode()
                                        ).decode()
                                    }
                                )
                            ]
                        )
                    ],
                }
            ),
            chalk_identity=True,
            env=chalkcompute.GitConfig(name="Your Name", email="you@example.com"),
            tags={
                "provisioner": "coding_agent_sandbox",
                "repository": "your-org/your-repo",
            },
            compute_class=chalkcompute.ComputeClass.HOST,
            resource_detectors=[chalkcompute.ResourceDetector.GITHUB_PULL_REQUESTS],
        )
        .add_credentials(
            ["api.github.com", "uploads.github.com"],
            chalkcompute.Secret.from_chalk_env("GITHUB_TOKEN", alias="GH_TOKEN"),
        )
        .add_credentials(
            "api.anthropic.com",
            chalkcompute.Secret.from_chalk_env(
                "CLAUDE_CODE_OAUTH_TOKEN"
            ),
        )
        .run()
    )
    try:
        sandbox.git.clone(
            url="https://github.com/your-org/your-repo.git",
            path="/workspace/repo",
            branch="main",
        )
    except Exception:
        sandbox.terminate()
        raise
    return sandbox


if __name__ == "__main__":
    coding_agent_sandbox.deploy()
    print("Deployed coding_agent_sandbox")

​

Set up once

Log in to the Chalk environment where you want to run your sessions, save the credentials as Chalk secrets, and deploy the provisioner:

chalk login
chalk secret set GITHUB_TOKEN
claude setup-token
chalk secret set CLAUDE_CODE_OAUTH_TOKEN
uv run --script coding_agent_sandbox.py

The secret commands prompt for their values. Use a GitHub token with access to your repository, and paste the token from claude setup-token into the Claude secret prompt. The token-setup command requires a Claude subscription and a local Claude Code installation.

​

Start Claude

Launch the deployed function from your terminal:

chalk sandbox start coding_agent_sandbox --tmux -- claude

Each launch creates a fresh checkout. The provisioner installs the development tools and configures Git identity and Claude authentication before your session starts. To request more memory, pass the function’s argument:

chalk sandbox start coding_agent_sandbox --arg memory_gib=32 --tmux -- claude

​

Detach and reconnect

Press Ctrl-B, then D to detach. Your sandbox, checkout, and Claude session keep running. To return, select the same sandbox and tmux session:

chalk sandbox attach

Reattaching continues the existing session. It does not create another sandbox or clone your repository again.

​

Finish the session

Push or copy any changes you want to keep, then release the sandbox:

chalk sandbox terminate --id <sandbox-id>

Detaching leaves the sandbox running and billed for its provisioned resources. Terminating removes its ephemeral checkout. Mount a Chalk Volume for files you need across sandbox lifetimes.