Droneship runs Claude Code or Codex in a gVisor cloud sandbox where the agent never sees your keys
Shown on HN Nov 4, droneship run claude clones your repo into its own sandbox with Python, Node and Go preinstalled, while a gateway outside it allowlists hosts and individual MCP tools and injects credentials into allowed calls, logging every file, command and tool call. It's free in early access for up to 5 sandboxes and 30 sandbox hours a month, with Copilot, Gemini and Cursor support listed as coming soon.