Skip to main content

Clawker

Free, open-source sandbox for running coding agents in Docker on your own machine, behind a deny-by-default egress firewall.

Quickstart

Install, initialize a project, and start your first agent in minutes.
SecurityThreat model, egress firewall, credential forwarding, and observability.
Running agentsParallel agents on git worktrees and one-word command aliases.
Bundles & extensionsHarnesses, stacks, and monitoring extensions you can install or author.
CLI referenceEvery command, flag, and subcommand.

Common tasks

Install ClawkerHomebrew, curl, or build from source.
Configure a projectSet up .clawker.yaml for images, workspaces, and security.
Allow a domainAdd path-scoped egress rules to the deny-by-default firewall.
Run agents on worktreesSpin up agents on separate branches with automatic worktree management.
Monitor agentsOpenTelemetry, OpenSearch, and Prometheus for agent observability.
Build a custom imageLayer packages, language stacks, and build steps on the base image.
Clawker is a free, open-source, local AI coding agent sandbox. It runs coding-agent CLIs like Claude Code, OpenAI Codex, OpenCode, Pi, or any other harness — inside isolated Docker containers on your own machine — no cloud, no subscription, your repo stays on your own machine, never uploaded to a vendor sandbox.The rise of agentic AI has been meteoric, but in the rush to ship model harnesses the industry keeps skipping the risks that come with them. Letting an agent run in permissible modes on your bare-metal machine is fast — until a prompt injection turns it into a data-exfiltration tool with full access to your credentials and network. The harness itself needs a harness.Clawker is that harness. It pairs real network isolation — a deny-by-default egress firewall that blocks outbound traffic except to domains you allow — with git credential forwarding and parallel git-worktree agents, so you get the convenience of local, parallel coding agents and the network security to run them safely. It fills the gap between cloud agent sandboxes (isolated, but your code leaves your machine and you pay for it) and other local agent runners (free, but with no egress control): self-hosted agent infrastructure that is both fully local and security-deep.

What Is an Agent?

In Clawker, an agent is a named container instance running a coding-agent harness. Each agent gets its own isolated environment with its own filesystem, network, and credentials. You can run multiple agents per project (e.g., --agent dev, --agent review) and they operate independently.

What Clawker Does

  • Default-on firewall — Blocks outbound traffic except allowlisted domains: the selected harness’s minimal egress floor (e.g. Anthropic APIs for the claude harness, OpenAI endpoints for codex) plus the domains you allow. Your agent can’t phone home to unexpected endpoints.
  • Seamless credential forwarding — SSH agent, GPG agent, and Git HTTPS credentials forwarded from your host. No manual key copying.
  • Isolated agent environments — Each agent runs in its own Docker container with configurable security controls
  • Bind or snapshot workspaces — Mount your repo for live editing, or copy it for pure isolation
  • Harness bundles — Claude Code and Codex ship built in; per-project images layer your packages, language stacks, and custom build instructions on a pinned Debian substrate, and you can author your own harness bundles
  • Project-scoped namespacing — Multi-agent, multi-project isolation via Docker labels and naming conventions
  • Git worktree integration — Spin up agents on separate branches with automatic worktree management.
  • Command aliases — One-word shortcuts that expand to full invocations (clawker go dev), shareable with your team via project config. See Command Aliases.
  • Monitoring stack — Optional OpenTelemetry Collector + OpenSearch + OpenSearch Dashboards + Prometheus for agent observability
  • Per-decision egress observability — eBPF event stream (allowed / denied / bypassed) flows to OpenSearch alongside Envoy and CoreDNS access logs, so bypass windows leave a full audit trail. See Egress Observability.

How It Works

Clawker sits between your CLI and Docker, adding a security and convenience layer:
Every container, volume, network, and image created by Clawker is tagged with dev.clawker.* labels. Clawker only sees and manages its own resources — it cannot touch anything outside its label scope.