Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

44•celrenheit•58m ago

Comments

prairieroadent•35m ago

why not just a docker container

matheusmoreira•5m ago

Because that means you are sharing kernel with the sandboxed agent. Virtualization presents an infinitely smaller attack surface.

ebeirne•29m ago

love what youve done here. i will be using this in the future.

matheusmoreira•28m ago

> clawk forward add my-project 3000

> clawk network allow my-project api.example.com

Can you describe the implementation details? How did you implement the firewall without root?

I vibecoded virtdev, a virtual machine orchestration project just like this one:

https://github.com/matheusmoreira/virtdev

It was designed to not require root, and the nftables firewall ended up becoming the only exception. I'm very curious about how you implemented this. Did you find a better way?

celrenheit•9m ago

Thanks! There's no packet firewall at all, no iptables/nftables. On macOS the VM's NIC is a Virtualization.framework file-handle device. The daemon runs gvproxy, which terminates the guest's connections and re-dials them as host sockets, so I filter with an allow-list right before the dial. One caveat, since you asked about root specifically: that's the macOS path, and it only works thanks to the fd NIC. Firecracker on Linux only speaks a TAP, which needs root, so there I do shell out to sudo, but just for the device. The filtering is still the same userspace allow-list.

bitwize•26m ago

Errbody gangsta until the agent figures out it's in a container and finds an exploit that lets it break out of container jail...

matheusmoreira•24m ago

I developed a VM project just like this one. Asked Fable to stress test it and try to break out of containment, and to my surprise it didn't manage to. Fable didn't get downgraded to Opus either, for some reason.

Would have thrown Mythos at it if I had access to it.

arcanemachiner•10m ago

Isn't Fable just Mythos + guardrails? Sounds like you did throw Mythos at it.

bad_haircut72•26m ago

Sprites from Fly io does this beautifully, claude comes preinstalled, its great

daitangio•24m ago

I am developing a super light similar thing here

https://github.com/daitangio/take-ai-control

It is docker + vscode friendly. I tested it with major systems (copilot, codex, Claude Code and pi.dev) Comments Wellcome!

felooboolooomba•23m ago

I use mkosi: https://github.com/systemd/mkosi

Which is just a front for systemd-nspawn. It's annoying you have to edit the config.nspawn to mount a directory if you start it with the "shell" command, instead of booting. But apart from that, it's brilliant.

NortySpock•14m ago

Have you seen https://news.ycombinator.com/item?id=48892015 and yoloai? https://github.com/kstenerud/yoloai

Seems like both projects are following very similar approaches.

guywithahat•8m ago

Funny that they're both written independently and in Go. Sometimes there's just a best way to do things I guess

rvz•12m ago

This is like the 30th AI sandbox project on Show HN. Why this one over the rest?

vqtska•10m ago

I still don't understand the point of all these VMs and containers for agents. Just create a separate user on your machine without sudo privileges, switch to it in your terminal and run all the agents you want without it being able to reach your files. What am I missing?

altcognito•8m ago

In a corporate environment they may not have that option

bheadmaster•8m ago

VMs and containers are fairly isolated and reproducible. A separate user on your machine still depends on the programs installed locally.

bpavuk•7m ago

you can also simply use Landlock and bwrap on Linux. Pi even has a plugin for that https://pi.dev/packages/pi-landstrip

petesergeant•4m ago

am I doing that once per project, or?

3form•3m ago

Well, for one, Debian and Debian-based distros make your home directory readable by everyone by default.

Security is riddled by traps. If you can afford best possible level of isolation, why not do it?

kstenerud•10m ago

yoloAI does something similar:

- Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker

- Sandbox on Mac using Docker, Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators).

- Network restriction

- Secrets control (file mounts or credentials broker)

- NO ambient data (ENV is replaced with a minimal, local-to-sandbox one, no host-side filesystem access beyond what you explicitly allow)

- Workdir protection: Your work dir is never modified until you apply the changes, either standalone or as a git commit. You can also diff before applying.

- Uses copy-on-write if your filesystem supports it (most modern ones do)

- Has built-in support for claude, codex, gemini, aider, and opencode, but you can also launch it in "shell" mode and run whatever you want.

- Supports VS code tunnels, so you can remotely access in VS code if you don't want to use the terminal.

- Full lifecycle support: Launch, attach, stop, restart, wait, one-shot, clone, destroy

- MCP passthrough

- FOSS

https://github.com/kstenerud/yoloai

anoop_kumar•9m ago

why not just use something like smol VMs? So many VM's and I am confused on which one to use for what. I think we now need a VM orchestrator!

htrp•8m ago

how does this compare with the aws lambda microvms?

petesergeant•4m ago

Yet another one, only I wrote this one, so I prefer it: https://github.com/pjlsergeant/byre

aftbit•4m ago

Does Codex run its own sandbox? I see that sometimes it runs commands without asking, which then fail for some reason, and it asks to run them again "outside of the sandbox"

From Eurovision to NATO, Canada Edges Closer to Europe

GLP-1 implant is the latest bet to help patients maintain their weight loss

Woodruff: You shouldn't trust trusted publishing

Extension that replaces clickbait YouTube thumbs and titles via transcript

Trump says the US controls the Strait of Hormuz and should get paid for it

From A.I To The Deep State, Michel Foucault foresaw it all

There Are Databases Everywhere for Those with the Eyes to See

Build email automation in n8n that works – MailKite

The art and engineering of Sega CD Silpheed

Auth and Curl

Joys of cancelling a TBB task group

Show HN: Harpist – convert any website into a refined and documented API

Omarchy 4 concerns, am I the only one?

Codex GPT 5.6 Sol Reduced to 258K Context Window

Dell sued by Finnish company over $70M price increase for data centre servers

Software freezes and energy powers on as US PE deal value falls 38% in Q2 2026

LLM Honeypots: The Perfect Use for LLMs

Z.ai founder backs open-source AI as global security debate intensifies

Sysdig documents the first ransomware attack run end to end by an AI agent

Show HN: Hackney – Compare Uber, Lyft, Waymo, and Robotaxi Prices

Salience-Driven Development

Tikos – Turn any study material into a question bank (local-first, open-source)

The Death of Open Channels

Precursor

Indian scientists are mapping the brain's last frontier

Sydney MP pushes to bring human composting to Australia as burial costs rise

LinkedIn, a mass grave of ghost jobs, is now becoming a dating app

Red Hat will support your RHEL forever now – for a price

There's no way this bond market can fund the markets needs without higher yields

Detained by settlers, US Democrat Ro Khanna now faces pro-Israel attacks