Deploy self-hosted environments to production changedself-hosted-environments-deploy
Nearest release: v2.1.321, published 2 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 9 Nov 2026 22:00 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 9 Nov 2026 22:07 UTC.
Upstream edited
Recorded here
Lines+13added
Lines−2removed
From line
19
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits58to this page, all time
The whole hunk
from line 19, old and new numbered
/
from line 19
1919 * **With [Anthropic-managed git](#use-the-anthropic-git-proxy)**: with such a credential, Claude reaches GitHub directly instead of through Anthropic-managed git.
2020 * **Without Anthropic-managed git**: a clone credential can stay in the image if you scope it as tightly as [Ship git config in your image](#ship-git-config-in-your-image) describes.
2121* **Keep the environment secret off session-running hosts**: the environment secret can register runners and pick up any session queued on the environment. On a fixed fleet it lives on every runner host, where any session's code can read the secret file. Prefer [on-demand runners](https://code.claude.com/docs/en/self-hosted-environments-configuration.md#on-demand-runners), where the secret stays on the orchestrator host, which never runs user code, and each runner receives a single-use work order that registers exactly one runner. On a fixed fleet, treat the environment-secret file as readable by every session and rotate the secret after any suspected session compromise.
22 * **After a suspected compromise**: have an [Owner](https://code.claude.com/docs/en/cloud-environments.md#organization-shared-environments) create a new secret and revoke the old one from the environment's **Configuration** tab, then roll out the new one. Anthropic refuses every orchestrator and runner on the old secret, on-demand runners from its work orders included. Your runners exit, interrupting their sessions.
2223* **Default-deny network egress**: restrict runner and session container outbound traffic at your own network boundary on every environment; [Default-deny egress](#default-deny-egress) covers what to allow and why.
2324* **Least-privilege host IAM**: the compute identity attached to the runner host, such as an instance profile or node service account, should grant only what the runner itself needs. Sessions should obtain their own credentials through your wrapper script rather than inheriting the host's.
2425* **Block the cloud metadata endpoint from sessions**: keeping sessions off the host identity requires blocking their access to the cloud metadata endpoint, and subnet-level egress policies don't intercept link-local metadata traffic, so block it in the container itself:
from line 200
199200> [!WARNING]
200201>
201202> With `--use-anthropic-git-proxy` set, the runner deletes and replaces the global git config of the user it runs as, and keeps no backup. It does this at startup and before each session. A login or credential helper you kept there is lost. Settings that [`--configure-git`](#let-the-runner-configure-git) writes survive. Run the runner as a dedicated user or in a container, never as your own user.
203>
204> The global git config is all three of `~/.gitconfig`, the file that `GIT_CONFIG_GLOBAL` names if you set it, and the whole `$XDG_CONFIG_HOME/git` directory, by default `~/.config/git`.
202205
203206Keep git settings that aren't secret, such as identity and `safe.directory`, in the system git configuration.
204207
from line 246
243246* **A line containing `remote: access denied by the git proxy`**: a session that Anthropic serves can still be refused, for example when organization policy denies git access for the session, or the session isn't authorized for the repository. The runner's log then shows a line containing `remote: access denied by the git proxy`, and the rest of that line says why.
244247* **`GitHub authentication required`**: this appears when the session's creator has no working GitHub connection on claude.ai. The session's clone fails, and the git error contains `GitHub authentication required. Please reconnect your GitHub account.` Ask that person to connect or reconnect GitHub in their claude.ai settings.
245248
246After you fix the cause, start the failed sessions again.
249After you fix the cause, restart the runners that failed the sessions, then have each creator send a message in their session or an Owner select **Retry**.
247250
248251#### Turn the Anthropic git proxy off
249252
from line 264
261264
262265Provide credentials that work without a prompt for every git host the runners' sessions use, github.com included. Any credential that was in the runner user's global git config is gone, because the runner deleted that config while `--use-anthropic-git-proxy` was set. [Ship credentials in your image](#ship-git-config-in-your-image) or use a [`checkout` lifecycle hook](https://code.claude.com/docs/en/self-hosted-environments-configuration#checkout).
263266
267To keep credentials in the [global git config](#git-proxy-replaces-global-git-config) instead, [stop the runners](#shutdown-timing) first, because a runner started with the flag rewrites it before each session. Then delete `$XDG_CONFIG_HOME/git`, by default `~/.config/git`, and replace `~/.gitconfig`, or the file that `GIT_CONFIG_GLOBAL` names, with your own.
268
264269**3. Open the network path**
265270
266271Allow the runner to reach each git host the runners' sessions use on port 443 or 22. See the git host row in [Network requirements](#network-requirements).
from line 508
503508
504509## Kubernetes
505510
506The runner serves `GET /healthz` on port 8080 by default, configurable with `--health-port`, so Kubernetes probes work with no extra setup. The endpoint returns `200` whenever the process is alive, so the probes below detect a dead process, not a stuck one; to catch a runner that stopped polling, alert on the `last_poll_age_seconds` series from [`/metrics`](https://code.claude.com/docs/en/self-hosted-environments-reference#prometheus-metrics). The Deployment below mounts the environment secret from a Kubernetes Secret, points the liveness and readiness probes at `/healthz`, and sets a 90-second termination grace period. See [Shutdown timing](#shutdown-timing) for why the grace period matters.
511The runner serves `GET /healthz` on port 8080 by default, configurable with `--health-port`. After startup, the endpoint returns `200` whenever the process is alive, so the probes below detect a dead process, not a stuck one. To catch a runner that stopped polling, alert on the `last_poll_age_seconds` series from [`/metrics`](https://code.claude.com/docs/en/self-hosted-environments-reference#prometheus-metrics).
507512
513The Deployment below mounts the environment secret from a Kubernetes Secret, points the liveness and readiness probes at `/healthz`, and sets a 90-second termination grace period. See [Shutdown timing](#shutdown-timing) for why the grace period matters.
514
508515The manifest sets no CPU or memory `resources` on the runner container. Add a block sized for the capacity you run, as [Size CPU and memory for sessions](#size-cpu-and-memory-for-sessions) describes.
509516
510517```yaml theme={null}
from line 567
560567 secret:
561568 secretName: claude-runner-environment-secret
562569```
570
571> [!NOTE]
572>
573> If the pod's events show the liveness probe failing during startup, raise its `initialDelaySeconds` or add a `startupProbe`. Nothing answers on the health port until the runner has registered and finished its startup checks. With the settings above, Kubernetes restarts a runner that isn't serving within about 90 seconds.
563574
564575The Deployment above lives in a `claude-runners` namespace. Create the namespace first:
565576
No line in this hunk matches that.