For engineers: VS Code and the terminal
The browser window and VS Code are one and the same environment (a Debian container on our host, your home folder on a persistent volume). Use either path or both.
The installer
On the client-area main page pick "Windows" or "Mac/Linux". The client area gives you one command (or a file to double-click) with a one-time token: it lives 20 minutes, is accepted only from the IP address it was requested from, and only once. The installer sets up VS Code, the Remote - SSH extension and Claude Code, generates an SSH key, hands its public part to the client area, waits until the environment is ready and writes the vision host into ~/.ssh/config. VS Code opens straight into the environment.
A second computer: the "Computers" card on the main page - the same installer for an existing environment. Keys of lost devices are revoked there as well.
What is inside
- Claude Code and Gemini CLI (its own Node); sign in to Claude with
claude, then/loginwith your account. vault- the personal vault; already signed in, the 8-hour token renews itself. Your own secrets:vault kv put <personal branch>/<system> login=<login> password=-(the value via stdin, never on the command line).- PowerShell with the Microsoft Graph and Exchange Online modules,
pywinrm,ldap3,ansible,terraform,ssh,git, Python 3 withpipandpipx. - A files page at 127.0.0.1:8080 inside the environment (password in
~/.files-password) - open it through port forwarding in the VS Code Ports tab. - The "Connections" page on port 8090 - OAuth to Google/Microsoft on your behalf.
A package is missing - onboard-install <package>: the host installs it without waiting for an administrator, and the package goes into the image for everyone.
Permissions and the safety catch
The agent's permissions depend on the role (analyst, engineer, tenant-admin) and are set by the platform in ~/.claude/settings.json; you may add your own, the platform part is not removed. The safety catch is a hook on every command of both agents: irreversible asks, foreign is refused, everything is written to ~/.onboard-guard.log. These files belong to the platform; editing them by hand is pointless - they are rewritten.
Network
Outbound from the environment: HTTPS, git over SSH to GitHub/Bitbucket, and whatever is explicitly opened for your company (its servers, routers). Other private networks are closed. Need access to a company system - write to the administrator; access is opened by a per-person rule and recorded.
Resources
10 GB of home folder by default, CPU and memory limits by role. Not enough - say so, it is extended without re-creating anything. The container is re-created when the image is updated and you have no active sessions; the home folder and settings are kept.