What happened. Clawk is an open source tool (Apache-2.0) that runs a coding agent (Claude Code, Codex, or a shell) inside an isolated Linux VM. Your project gets mounted, the agent has root access within the VM, but can’t reach the rest of your machine or call external servers unless explicitly permitted. One command (clawk) starts the session, clawk destroy wipes everything, and a broken session recovers in seconds. It collected 175 stars and 119 points on Hacker News within hours.

Why it matters. Coding agents are useful when you actually let them work: install packages, run scripts, start servers. But on your laptop you have two bad choices: approve every command (and spend time saying yes), or skip the checks and hope that an rm -rf or a stolen token doesn’t hit something important. Clawk gives you a third option: the agent works in a separate environment where it can do whatever it wants, while your files, SSH keys, and the rest of your machine stay out of reach. The network is filtered upstream: a connection to an unlisted domain gets blocked by the VM’s firewall, not by a rule in the prompt. As we covered on July 12, the security model is the same as Clodex: treat the agent’s output as untrusted input and verify locally.

If you want to try it. The README on GitHub (clawkwork/clawk) shows installation and basic usage. Heads up: the project is marked pre-1.0 with possible breaking changes across versions.

In detail

The context

Coding agents (as in the sqlite-utils rewrite, or Terry Tao’s recovery of 1999 Java applets) only work if they can actually execute: read files, modify them, install dependencies, test the code they wrote. The problem is that all this behavior happens on your laptop, with access to your files, your keys, your network.

There are two existing alternatives:

• You approve every command. The agent asks permission at each step, and you end up responding to a prompt every few seconds. Useful for spot checks, unsustainable for long sessions.
• You skip approvals (--dangerously-skip-permissions in many tools). The agent executes everything on its own, but a mistake or ambiguous request can delete important files or expose sensitive data.

Clawk starts from the observation that the agent doesn’t need access to your system: it only needs the project it’s working on.

How it works

When you run clawk in a folder, the tool:

1. Creates an isolated Linux VM (via containerization or virtualization technologies; technical details are in the repo).
2. Mounts the project folder inside the VM.
3. Launches the agent (Claude Code, OpenCode, or a shell) inside the VM.
4. Sets up a network-level firewall that blocks all outbound connections except to explicitly permitted domains (GitHub is pre-authorized, the rest you add if needed).
5. Forwards your system’s ssh-agent, so the agent can do git push without your private keys entering the VM.

The agent can do anything inside the VM: install packages, modify files, delete and rebuild. If it tries to connect to an unlisted server (e.g., curl https://tracker.evil.example), the connection fails at the network level. If a session goes wrong, clawk destroy && clawk restarts from scratch.

The limits

The security model is clear: Clawk blocks connections to unknown servers, not to ones you’ve permitted. This means:

• If you authorize GitHub, the agent can read files in the project and do git push: anything the agent reads can be published.
• The network filter stops direct connections, but if the agent exfiltrates data through an authorized channel (for example hiding it in a commit), Clawk won’t catch it.
• The VM isolates the filesystem and local credentials, not the agent’s logic: if the prompt contains malicious instructions (indirect injection), the agent executes them.

In other words: Clawk protects you from destructive mistakes (the rm -rf that wipes the whole disk) and unauthorized exfiltration attempts, but it doesn’t protect you from yourself if you give the agent access to sensitive resources or if the project itself contains secrets.

Availability and community

The project is on GitHub (clawkwork/clawk), licensed Apache-2.0, with documentation on architecture and security model. It’s marked pre-1.0: expect breaking changes and rough edges. The Hacker News discussion (112 comments) covers use cases, comparisons with Docker and devcontainers, and implementation details.

Practical implications

Clawk represents a shift in approach: instead of asking the agent to behave well (via rules in the prompt), you build an environment where the agent can’t do damage even if it messes up. It’s the same principle behind Clodex: treat the model’s output as untrusted input and verify locally.

This approach isn’t universal: if your day-to-day work requires the agent to access internal services or company databases, Clawk doesn’t replace them. But for local development on self-contained open source or internal projects, it offers a practical balance between operational freedom and security.