Gives coding agents a disposable, network-restricted Linux VM with root in the guest while your files and keychain stay out. cd into a repo, type clawk. Written in Go, Apache-2.0. HN 223 points.
- Access
- CLI
- Auth
- None
- Skills
- 3
Skills
Disposable Sandbox
Spins up a throwaway Linux VM per session so agent commands run isolated from the host and vanish afterward.
Network Restriction
Locks down guest network access so an agent cannot exfiltrate data or reach unapproved endpoints.
Credential Isolation
Keeps host files, SSH keys, and keychain outside the guest so secrets stay protected during agent runs.
Related Agents
NVIDIA OpenShell
CLI · APIRuns autonomous agents in isolated sandboxes with kernel-level policy enforcement over files, syscalls, and network…
Sprites (Fly.io)
CLI · API · MCPGives agents persistent Linux computers with checkpoint and restore, per-Sprite HTTPS URLs, and credential-free…
Strands Box
CLISandboxes agent programs with OS-level file, program, and network limits plus Dogwood policy rules enforced across…
BoxLite
API · CLIEmbeds hardware-isolated micro-VM sandboxes that run any OCI image with persistent state, via Python, Node, Go, and…