clawkwork/clawk

What it solves

clawk provides a secure, disposable Linux environment for autonomous coding agents (like Claude Code, Codex, or pi). It eliminates the risk of running agents with full permissions on your host machine—where a single destructive command or leaked token could be catastrophic—by giving the agent its own dedicated virtual machine (VM) instead of your own.

How it works

clawk boots a lightweight Linux VM using Apple's Virtualization.framework (on macOS) or Firecracker (on Linux). It mounts your local code repository into the guest VM via virtio-fs, allowing the agent to edit files in real-time. To ensure security, it implements a DNS-aware outbound network filter in userspace (below the guest), which blocks all traffic to unknown servers by default while allowing common registries like GitHub and npm.

Key technical details include:

• OCI Image Rootfs: It pulls standard OCI images to create the VM's root filesystem without requiring a Docker daemon.
• Persistence: Agent conversation history and the repository are stored on the host, while the VM disk is disposable and re-cloned from the image on every boot.
• Connectivity: It uses a vsock bridge for control and forwards the host's ssh-agent so the agent can push code without needing private keys inside the VM.

Who it’s for

Developers who use autonomous AI coding agents and want to run them with full autonomy (bypassing permission prompts) without compromising the security of their host machine's files, keychain, and network.

Highlights

• Disposable Sandboxes: Quickly destroy and recreate VMs without losing your code or agent conversation history.
• Zero-Config Setup: Boot a sandbox for a directory in one command without needing Dockerfiles or devcontainer settings.
• Network Allow-listing: Strict outbound traffic control with a log of all denied connection attempts.
• OCI Compatibility: Use any OCI image as the root filesystem to provide the exact toolchain your project needs.
• Ticket Mode: Manage multi-repo tasks by creating a single sandbox with git worktrees for multiple repositories and coordinated PRs.
• Resource Efficiency: Idle VMs automatically release memory and suspend to disk to minimize host overhead.