ClienttaskCantelop APIuser AClaude Code sandbox/workspaceuser BClaude Code sandbox/workspacemessageMCPCantelop separates many ephemeral Sessions from one durable per-user Workspace.2026-09-24Hosting Claude Code with bring-your-own-subscriptionStepan Arsentjev•3 min read
Lifecycle · ephemeralNetwork · host firewallHost containment · jailResources · memory and vCPUsCompute · Firecracker microVMagent processFive boundaries around one agent process.2026-09-09Running AI agents as untrusted codeStepan Arsentjev•3 min read
SessionSandboxWorkspacemessage 1message 2message 3one ID the whole timeallocate Areuse Aallocate BSandbox Akeep-alive expiresSandbox B/workspace/workspacesame files under A and BtimeThe Session ID and the Workspace outlive any one Sandbox.2026-09-03CantelopStepan Arsentjev•5 min read