welldundun/autonomous-claude-sandbox
Overview
This skill deploys Claude Code on Cloudflare Sandboxes to run autonomous AI coding tasks in isolated containers via a simple API. It provides deployment scripts, deterministic CLI tools, and a small Worker API for health checks, execution, and result retrieval. The skill focuses on secure token management, container isolation, and repeatable workflows for setup, testing, and monitoring.
How this skill works
The skill uses a Cloudflare Worker backed by sandbox containers that run Claude Code. A per-request isolated container executes the provided task and writes results to R2; a durable object coordinates sandbox instances and metadata. Deterministic shell tools are included to validate prerequisites, deploy, test, execute tasks, gather diagnostics, and generate authentication tokens.
When to use it
- When you need to run autonomous Claude Code tasks in an isolated, repeatable environment
- When you want a simple API to delegate code generation or execution to Claude in containers
- When deploying or updating a Cloudflare Sandbox Worker with Claude Code
- When validating deployment health, testing live workers, or retrieving task results
- When implementing secure token rotation and audit-ready task storage in R2
Best practices
- Use the cloudflare/sandbox base image and export the Sandbox class as required by the SDK
- Grant only required permissions (containers:write) and follow least-privilege principles
- Store CLAUDE_CODE_OAUTH_TOKEN and SERVER_AUTH_TOKEN as Wrangler secrets; rotate tokens regularly
- Use provided check and test tools before deploying to catch common configuration errors
- Run tasks with --permission-mode flags, not dangerously skipping permission checks
Example use cases
- Autonomously generate and test small scripts or code snippets inside an isolated container
- Batch process developer tasks by posting jobs to the /execute endpoint and storing outputs in R2
- CI jobs that validate environment and deploy or upgrade the Worker with automation
- Troubleshoot production issues by running diagnostics and test-deployment scripts
- Provide a secure API gateway for internal teams to run Claude Code tasks without exposing tokens
FAQ
POST to /execute with Authorization: Bearer <SERVER_AUTH_TOKEN> and a JSON body containing task and optional timeout.
Where are task outputs stored?
Task outputs are saved to an R2 bucket; short-term stdout is returned in the API response and persisted for retrieval.
