Code walkthrough · Coding agents

Your repo.
Claude, ready to work.

Give each coding session a fresh checkout with Claude Code, GitHub CLI and your Git identity. Start it from a reusable Chalk function, detach, and return to the same work through tmux.

See the example Read the guide

A function that returns a sandbox

One launch command. Your development environment.

This is the same provisioner pattern used to work on Chalk's Python Compute SDK. Replace the repository and Git identity, save your credentials as Chalk secrets, and deploy the function in your own environment.

The example requests 2 CPUs and 16 GiB of memory on a Chalk host. The CLI discovers the function from its Sandbox return type and starts Claude after cloning finishes.

The commands run against your authenticated Chalk environment. Follow the setup tab before starting your first session.

# /// script
# dependencies = ["chalkcompute==2.13.4"]
# ///
import base64
import os
import uuid

import chalkcompute


@chalkcompute.function(secrets=[chalkcompute.Secret.from_chalk_env("GITHUB_TOKEN")], chalk_identity=True)
def coding_agent_sandbox(memory_gib: int = 16) -> chalkcompute.Sandbox:
    """Create a repository checkout with Claude Code installed.

    Args:
        memory_gib: Sandbox memory in GiB.
    """
    sandbox = (
        chalkcompute.Sandbox(
            name="coding-agent-" + str(uuid.uuid4()),
            image=chalkcompute.Image.sandbox()
            .with_claude_code(
                "2.1.270",
                trusted_dirs=["/workspace/repo"],
                permission_mode="bypassPermissions",
            )
            .with_gh()
            .with_tmux()
            .workdir("/workspace/repo"),
            cpu="2",
            memory=f"{memory_gib}Gi",
            network_policy=chalkcompute.NetworkPolicy(
                allowed_hosts={
                    "*": [],
                    "github.com": [
                        chalkcompute.NetworkPolicy.Rule(
                            transforms=[
                                chalkcompute.NetworkPolicy.Transformer(
                                    headers={
                                        "Authorization": "Basic "
                                        + base64.b64encode(
                                            f"x-access-token:{os.environ['GITHUB_TOKEN']}".encode()
                                        ).decode()
                                    }
                                )
                            ]
                        )
                    ],
                }
            ),
            chalk_identity=True,
            env=chalkcompute.GitConfig(name="Your Name", email="you@example.com"),
            tags={
                "provisioner": "coding_agent_sandbox",
                "repository": "your-org/your-repo",
            },
            compute_class=chalkcompute.ComputeClass.HOST,
            resource_detectors=[chalkcompute.ResourceDetector.GITHUB_PULL_REQUESTS],
        )
        .add_credentials(
            ["api.github.com", "uploads.github.com"],
            chalkcompute.Secret.from_chalk_env("GITHUB_TOKEN", alias="GH_TOKEN"),
        )
        .add_credentials(
            "api.anthropic.com",
            chalkcompute.Secret.from_chalk_env(
                "CLAUDE_CODE_OAUTH_TOKEN"
            ),
        )
        .run()
    )
    try:
        sandbox.git.clone(
            url="https://github.com/your-org/your-repo.git",
            path="/workspace/repo",
            branch="main",
        )
    except Exception:
        sandbox.terminate()
        raise
    return sandbox


if __name__ == "__main__":
    coding_agent_sandbox.deploy()
    print("Deployed coding_agent_sandbox")

From provisioner to working session

Deploy the setup once. Call it whenever you need a new workspace, and attach to an existing sandbox when you want to continue.

Prepare a checkout

A deployed Python function creates a sandbox, installs Claude Code and GitHub CLI, and clones your repository's main branch. Typed arguments let each developer choose the memory they need.

Start Claude

chalk sandbox start calls the provisioner and opens Claude in the checkout. Git author settings and repository trust are ready before the session starts.

Come back to the same work

tmux keeps the session running when you detach. Reattach to the same sandbox and continue with the existing terminal, files and agent context.

Credentials scoped to their hosts

The sandbox sees placeholders for GitHub CLI and Claude authentication. The network proxy replaces them with the real secrets in headers to the configured GitHub and Anthropic hosts. The provisioner separately configures authenticated HTTPS cloning.

This example uses Claude subscription authentication and permits general outbound traffic for development. Customize the network policy for your repository's tools.

Keep the session. Release it when done.

Detaching leaves the sandbox running with its checkout and tmux session. Push the changes you want to keep, then terminate the sandbox to release its resources. Mount a Chalk Volume for files you need across sandbox lifetimes.

Deploy your own coding sandbox

Your repo.Claude, ready to work.