Claude Agent SDK hosts a Claude Code subprocess beside your application and uses local disk for parts of session and project state. Production deployment must isolate that process, provision its workspace and runtime dependencies, scope network and credentials, persist required state, control concurrency, and treat each tenant or trust domain as a security boundary.
You will choose an ephemeral, long-running, or hybrid session pattern and design a container boundary appropriate to the agent’s tools.
Default to ephemeral isolated jobs unless continuity requirements justify long-lived workers.
Do not mount the host Docker socket, home directory, or broad cloud credentials.
Prefer a proxy/broker pattern: the agent authenticates to a trusted gateway using workload identity; the gateway holds provider/service credentials, applies tenant policy, filters destinations, and records usage. For external services, issue short-lived, least-privilege credentials scoped to the run.
Queue work, enforce per-tenant and global concurrency, use admission control, and autoscale on queue age plus resource saturation—not merely request count. Preserve session affinity only where required. Ensure cancellation terminates subprocesses and descendants.
Test cross-container filesystem access, metadata-service access, forbidden egress, process escape, resource exhaustion, secret leakage, workspace cleanup, session restore, and abrupt worker termination.
Failure injection: Kill the container after a tool side effect but before result delivery. A new worker must reconcile the idempotency record and checkpoint instead of repeating the side effect.
Write a Kubernetes job/container security specification with pod security context, read-only root filesystem, ephemeral volume, egress policy, workload identity, resource limits, deadline, and teardown verification.