On May 21, 2026, a YC P26 startup called Runtime launched on Hacker News with a one-line pitch: “sandboxed coding agents for everyone on a team.” The two founders, Gus and Carlos, previously built Mentum (YC S21), sold it, and then worked at Modern Treasury. The problem they are targeting is specific: tools like Claude Code and Codex are powerful, but so far only engineers have dared to use them. Runtime wants marketing, operations, and data analysts — the non-engineers — to be able to send agents to work safely too.
The launch drew 103 points and 30 comments on its first day. It lands squarely on the biggest friction enterprises hit when adopting coding agents in 2026: the models are strong enough, but nobody will sign off on permissions, environments, and data boundaries.
The Problem Runtime Solves
Runtime’s premise is that context gets defined once by engineering and reused by the whole company. The engineering team configures instructions, skills, and integrations up front; every other department can then drive the same agents inside a controlled environment to do their own work. Triggers come from the web, CLI, Slack, Linear, GitHub, or the API, and every session produces a shareable preview URL — so colleagues who never write code can still inspect what the agent did and produced. That URL matters more than it sounds: it turns an agent run from a black box inside one person’s terminal into an artifact a non-technical reviewer can look at, which is a precondition for anyone outside engineering trusting the output in the first place.
Sandboxes and Environment Snapshots
The technical core is a reproducible execution environment. Runtime snapshots complete environments — multi-service stacks on Docker Compose, Kafka, Redis, databases pre-seeded with data — so agents work under conditions close to production. The sandboxes themselves are orchestrated through providers: E2B, Daytona, EC2, or Kubernetes, chosen by cost and isolation requirements. The provider split is deliberate rather than decorative: the managed options buy fast setup and isolation by default, while EC2 and Kubernetes cover teams whose security posture requires everything to stay inside their own cloud accounts. The effect is to turn an agent’s execution environment from a set of scripts each person figures out alone into versionable, auditable infrastructure.
Governance: Secret Proxy and Guardrails
Governance is the real selling point. Secrets are injected through a managed proxy — never baked into images or scattered across environment variables. At the command layer there are allow and deny lists; at the network layer, egress controls; at the people layer, role-based access control. The marketing teammate’s agent can pull data and draft copy, but it cannot touch the payments stack. For any company with a security review, those are exactly the checkboxes on the procurement list.
Open Core and Pricing
Runtime’s core is open source — the launch thread describes an Apache-2.0 and AGPLv3 combination — and the business model is a flat fee plus actual compute cost, with an explicit promise of no token markup. That pricing directly answers the developer suspicion that agent platforms profit by marking up tokens. The same day, Andrej Karpathy announced he is joining Anthropic — the company behind Claude Code is pulling in talent and ecosystem partners at once, and middleware like Runtime that wraps Claude Code in a governance frame only rises with that tide.
The Hard Questions from HN
The comment thread was more honest than the landing page. One commenter asked where Anthropic stands given its ever-shifting rules around Claude Code usage, naming the risk of a platform betting on a single agent CLI. Another pressed on whether every sandbox run ends in a PR — and who cleans up code that marketing should never have submitted. A founder building a similar product asked why the team left fly.io and how the setup handles keys that genuinely must live on disk, the messier corner of secret management that a proxy architecture does not automatically solve. Others compared it against existing FOSS sandbox options and asked what the actual difference is, while one user pointed out that some self-hosting docs linked from GitHub still return 404s. One more comment is worth keeping: static analysis and runtime sandboxing are complements, not rivals — Runtime limits the blast radius when something goes wrong, but it is not the whole safety story on its own. These are the right questions for a product at this stage, and they double as a checklist for watching what it does next.
Sources
- Launch HN: Runtime (YC P26) – Sandboxed coding agents for everyone on a team — Hacker News
- Runtime — runtm.com
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.