DigitalOcean Harness Runtime Overview
Harness Runtime provides managed microVM sandboxes to run agent harnesses and execute code, with session lifecycle controls, Workspace, connections, and optional Action Gateway tools.
DigitalOcean Harness Runtime Conceptspublic
Generated on 17 Oct 2026
DigitalOcean Harness Runtime provides managed, hardware-isolated microVM sandboxes with built-in tools such as Chromium to run harnesses and execute arbitrary code. Rich lifecycle APIs preserve conversational history and working state across sessions, letting you pause, resume, and fork work to control costs and adapt to the nonlinear nature of agentic workflows. Scale complete agents such as Claude Code or use sandboxes independently for code execution, all through the same service. See What You Can Build for example use cases.
Managed Agents Architecture
How Harness Runtime, Action Gateway, and the DigitalOcean services around them fit together to run and govern AI agents.
Agent Adapters
Harness Runtime adapters select which coding agent or framework runs in the sandbox and which platform features, such as approvals and checkpoints, apply to the session.
Environments and Sandboxes
A Harness Runtime environment is a reusable configuration object defining what an agent needs to do work, and a sandbox is the isolated microVM a session provisions from it.
Sessions
A Harness Runtime session is one running instance of an environment, with its own sandbox, state, and history, and a run is a single agent turn inside it.
Permission Policies
Harness Runtime permission policies allow, require approval for, or deny the actions an agent takes, and set the filesystem and network access of the sandbox it runs in.
Approvals
Harness Runtime pauses an agent and requests human approval when its permission policy marks an action as ask, and you can approve, reject, or defer from the terminal or out of band.
Secrets and Configuration
How Harness Runtime environments carry configuration, credentials, and scoped secrets, which bind a credential to one HTTPS destination so it never enters the sandbox.
Network Egress
A Harness Runtime sandbox reaches any host by default, and naming even one allowed host turns on an allowlist that denies everything else.
Audit Logs
Harness Runtime audit logs record each action an agent takes in a session, the policy decision that applied, and who responded to approval requests.