How to host the Claude Agent SDK in production

Anthropic's hosting guide describes the shape plainly: the SDK spawns and supervises a claude CLI subprocess that owns a shell, a working directory, and session files on disk. You need Python 3.10 or later for the Python SDK, or Node.js 18 or later for TypeScript, and both bundle the CLI binary. The container needs outbound HTTPS to api.anthropic.com, or to your cloud provider's endpoint.

That makes each running agent a long-lived process with local state, closer to a small server than a function call. A session doesn't time out on its own, so set a turn limit, and plan for what happens to its files when the container goes away.

Decide on authentication early. The subprocess reads ANTHROPIC_API_KEY, or uses Amazon Bedrock, Claude Platform on AWS, Google Cloud's Agent Platform, or Microsoft Foundry credentials. Use of the SDK falls under Anthropic's Commercial Terms, and unless Anthropic has approved it, a product can't offer claude.ai login or subscription rate limits to its users.

Ephemeral containers are the simplest and safest place to start: create one for each task and destroy it when the task completes. Long-running containers suit agents that take autonomous action, serve content, or handle high-volume message streams, but they need careful per-session memory limits and isolation between tenants.

The hybrid pattern is for conversations that last days but sit idle most of the time. Containers start, load the session from a SessionStore, and save it back, and Anthropic is explicit that the store is required for this pattern, because shutting a container down without one loses the transcript.

Anthropic calls 1 GiB of RAM, 5 GiB of disk, and 1 CPU per agent a reasonable starting point for a freshly started instance. That's a starting point for a fresh instance, so measure your own agents under real load before packing more onto a host.

Compute is rarely the big line. Anthropic says token cost typically dominates container cost by an order of magnitude or more. Track it per run: the SDK's total_cost_usd and costUSD fields are client-side estimates, the modelUsage field gives whole-run token totals, and the Claude Console's Usage and Cost API is the authoritative bill.

The CLI stores each session as a JSONL file under ~/.claude/projects, and resuming works only on a machine where that file still exists. To resume across machines or in serverless environments, mirror transcripts with a SessionStore. Both SDK repositories include runnable reference adapters, including S3, Redis, and Postgres, plus a conformance suite for your own.

Know what the store doesn't cover. It mirrors the conversation, not the filesystem, CLAUDE.md memory files, or other working-directory artifacts, so anything the agent writes to disk needs its own persistence. Mirror writes are best-effort: the subprocess writes locally first, so a store outage doesn't stop the agent, but you should alert on mirror errors.

Anthropic's secure deployment guide recommends a proxy outside the agent's security boundary that injects credentials into outgoing requests, so the agent never sees them. For production, the hosting guide adds a domain allowlist and request logging to that egress proxy. Even the Anthropic key can stay outside: set ANTHROPIC_BASE_URL to route model calls through a proxy that adds the key after the request leaves the container.

Lock the network down. A container with no network access that can reach only the proxy over a Unix socket can't send data to arbitrary servers, even if a prompt injection compromises the agent, and cloud firewall rules should block all egress except to the proxy. For stronger isolation than containers, Anthropic points to gVisor and Firecracker.

If one host serves several customers, keep their settings and memory apart: pass an empty settingSources list so user and project settings aren't loaded, disable auto memory, and give each tenant its own config directory. Then set permissions explicitly, since a matching deny rule blocks a tool even in bypassPermissions mode. For the credential patterns in more depth, see how to give AI agents access without exposing credentials.

Anthropic's cookbook walks through local Docker, Modal, and Kubernetes, and its appendix shows the same Dockerfile deployed to other platforms. Some vendors publish their own SDK guides: Daytona and Modal both show a proxy that keeps the API key out of the sandbox, and Vercel has a guide to installing the SDK in Vercel Sandbox.

The cloud runtimes run any framework in a container. AWS publishes an AgentCore sample for the Claude Agent SDK, and Microsoft's Foundry samples include one that uses Foundry credentials. Google's Agent Runtime and Cloud Run accept any framework that follows their container contract, though we found no Claude-specific guide from Google. Note each runtime's session limits, and pair it with a SessionStore: AgentCore, for one, says its session state is ephemeral.

Claude Managed Agents, in beta, runs the agent loop and a sandbox for you, in Anthropic's cloud or your own. It charges model tokens plus $0.08 per session-hour, and time a session spends idle, waiting for your next message or a tool confirmation, isn't billed. Its cloud sandbox offers up to 8 GB of memory and 10 GB of disk. It isn't eligible for zero data retention or a HIPAA business associate agreement, and it runs Claude models only.

Self-hosting the SDK still wins when you need programmatic control. Anthropic's cookbook lists batch and job-shaped agents, internal tools, agents embedded in your own backend, and regulated environments. For a side-by-side of Managed Agents and the other hosted runtimes, see our guide to Claude Managed Agents alternatives.

Many teams reach for the SDK to automate internal work: a weekly pipeline review, triage of new issues, research on inbound leads. Hosting it means running everything above for jobs that aren't your product.

type.com is built for that work. Each managed agent automation runs a managed Claude or Codex agent with the Space's connections, skills, and memory, plus an isolated Linux sandbox. Runs start from a schedule, Slack, GitHub, Linear, a webhook, email, or RSS, and each one leaves a thread the team can read. Connections stay on type.com's servers, and a scheduled instruction automation pauses after three failed runs in a row. Plans start at $50 a month for two members, including $100 of AI usage at provider rates.