Claude Managed Agents
Devboxes can now serve as the execution environment for Claude Managed Agents, giving you a self-hosted sandbox where Claude can do work on your behalf.
When you delegate a task, Claude handles the full loop: reading files, running shell commands, calling tools, and iterating based on results until the task is complete. Anthropic manages the orchestration layer: the model, the agent loop, context management, and error recovery. Execution happens inside your Devbox, which means your code, credentials, and data stay within your own infrastructure rather than a shared environment.
Each agent session runs in a fresh sandbox, so sessions are isolated from one another and from your persistent environments. The diagram below shows how the layers fit together.
Get started with our step-by-step guide, or read the announcement post for more information.
Custom Registry Domains
Custom domains can now be configured to serve container images backed by your nscr.io registry. When a custom domain is set up, images stored in your Namespace registry are pullable under that domain — for example, registry.example.com/image:tag instead of nscr.io/<tenant>/image:tag.
This enables two scenarios:
- Public distribution: Images on the custom domain can be made available for anonymous pulls with no credentials required. This is useful for open-source projects or publicly distributed tooling that want to serve images from their own domain.
- Cross-workspace sharing: Images can be shared between Namespace workspaces or with specific external parties through a domain scoped to a particular tenant, without making them fully public. Authenticated pulls require a valid Namespace token with the appropriate pull permission on the domain.
Custom registry domains are configured at the account level. Contact us to set one up for your organization.
Bazel Remote API
Runner profiles can now opt into the Bazel remote downloader (--experimental_remote_downloader). When enabled, Bazel routes external fetches (HTTP archives, source downloads, and other external dependencies) through the Namespace cache tier. Dependencies fetched once are cached and served locally on subsequent runs, cutting the time spent on network fetches in cold-cache builds.
Alongside this, we've made a set of improvements to the Bazel cache itself. The cache now prefetches blobs from the proxy backend when a request hits, so following calls for the same blob are served from the local cache rather than round-tripping to the backend again. We've also improved the handling of fetch requests in the remote asset API implementation, and tuned the gRPC server for higher request rates.
Summary
Devboxes can now serve as the execution environment for Claude Managed Agents, with Anthropic handling orchestration and execution running inside your own infrastructure. Custom registry domains let you serve container images from your own domain, with support for anonymous public pulls and authenticated cross-workspace access. Bazel users can now route external dependency fetches through the Namespace cache via the remote downloader, and the cache serves subsequent reads faster through blob prefetching and gRPC tuning.