For AI agents: The documentation index is at https://docs.digitalocean.com/llms.txt. Markdown versions of pages use the same URL with index.html.md in place of the HTML page (for example, append index.html.md to the directory path instead of opening the HTML document).

Harness Runtime is a set of services that gives every agent its own microVM execution environment and governed tool access so that developers can scale agentic work without having to build and maintain infrastructure themselves. You define an environment, which pairs a coding agent with the sandbox, credentials, permissions, and tools it runs with. You can create an environment in the Control Panel or describe it in a YAML spec, start a session from it with doctl, and interact through an attached terminal or the Control Panel. Optionally, connect tools through Action Gateway.

When to Use Harness Runtime

Use Harness Runtime when you want to:

• Run coding agents such as Codex CLI, Claude Code, or OpenCode, or general purpose agent frameworks such as LangGraph and Hermes, in a managed sandbox instead of on your laptop or a self-managed Droplet.
• Keep agent work isolated per session with pause, resume, and remove controls.
• Require human approval for sensitive actions with a permission policy.
• Optionally connect tools through Action Gateway without embedding provider credentials in the model context.

Core Components

Environment Spec

The environment spec is a YAML file that declares the adapter, sandbox size, environment variables and secrets, permissions, and optional tools. It is the single document that defines an environment, and you submit it with doctl or build the equivalent in the Control Panel. For the field list, see the environment spec reference.

Sandboxes and Sessions

The sandbox is the isolated Linux machine the agent works on, and the environment decides its size and image. It has no access to your repositories or credentials until the spec grants them, though its outbound network access is unrestricted until the spec sets an egress allowlist.

A session is a running instance of an environment. One environment can have many sessions over time. Starting one provisions the sandbox, boots the configured adapter, and gives you a session to attach to or open in the Control Panel. You pause a session to stop compute charges while preserving its state, resume it to pick up where you left off, and remove it to release the sandbox.

Connect your terminal to a live session with doctl harness-runtime launch, or view sessions and chat history in the Control Panel. For Codex sessions, doctl harness-runtime start-proxy exposes a local WebSocket that your local Codex CLI connects to.

Permission Policy

A permission policy allows, denies, or requires approval for the agent’s actions before it continues. It is what separates an agent that can read your code from one that can push to it. Actions set to ask raise an approval that you answer in the terminal or out of band.

Action Gateway

Action Gateway is an optional managed MCP endpoint that gives agents access to tools, APIs, and SaaS connectors through a single endpoint. You can use the Control Panel or declare tools in the environment spec, group them into versioned Toolbelts, and control tool permissions. You can also use Action Gateway as a standalone MCP endpoint from the Python SDK, TypeScript SDK, or any MCP client.

One Adapter Works Differently

With adapters such as codex, DigitalOcean runs the agent and watches what it does, which is what makes permissions, approvals, and checkpoints possible. With agent: codex-agentapi, OpenAI runs the agent and DigitalOcean supplies only the sandbox, so those features do not apply. Both use the same environment spec and the same session commands. See Agent Adapters for the full comparison.