Skip to main content
Clawker is a free, open-source, local AI coding agent sandbox. It runs coding-agent CLIs like Claude Code, OpenAI Codex, OpenCode, Pi, or any other harness — inside isolated Docker containers on your own machine — no cloud, no subscription, your repo stays on your own machine, never uploaded to a vendor sandbox. The rise of agentic AI has been meteoric, but in the rush to ship model harnesses the industry keeps skipping the risks that come with them. Letting an agent run in permissible modes on your bare-metal machine is fast — until a prompt injection turns it into a data-exfiltration tool with full access to your credentials and network. The harness itself needs a harness. Clawker is that harness. It pairs real network isolation — a deny-by-default egress firewall that blocks outbound traffic except to domains you allow — with git credential forwarding and parallel git-worktree agents, so you get the convenience of local, parallel coding agents and the network security to run them safely. It fills the gap between cloud agent sandboxes (isolated, but your code leaves your machine and you pay for it) and other local agent runners (free, but with no egress control): self-hosted agent infrastructure that is both fully local and security-deep.

Quick Start

Get up and running with Clawker in minutes

Installation

All installation methods: Homebrew, curl, source build

Configuration

Configure projects with .clawker.yaml

CLI Reference

Complete command reference for all CLI commands

​
What Is an Agent?

In Clawker, an agent is a named container instance running a coding-agent harness. Each agent gets its own isolated environment with its own filesystem, network, and credentials. You can run multiple agents per project (e.g., --agent dev, --agent review) and they operate independently.

​
What Clawker Does

  • Default-on firewall — Blocks outbound traffic except allowlisted domains: the selected harness’s minimal egress floor (e.g. Anthropic APIs for the claude harness, OpenAI endpoints for codex) plus the domains you allow. Your agent can’t phone home to unexpected endpoints.
  • Seamless credential forwarding — SSH agent, GPG agent, and Git HTTPS credentials forwarded from your host. No manual key copying.
  • Isolated agent environments — Each agent runs in its own Docker container with configurable security controls
  • Bind or snapshot workspaces — Mount your repo for live editing, or copy it for pure isolation
  • Harness bundles — Claude Code and Codex ship built in; per-project images layer your packages, language stacks, and custom build instructions on a pinned Debian substrate, and you can author your own harness bundles
  • Project-scoped namespacing — Multi-agent, multi-project isolation via Docker labels and naming conventions
  • Git worktree integration — Spin up agents on separate branches with automatic worktree management and hardened unattended-session lockdown. See Worktree Caveats.
  • Command aliases — One-word shortcuts that expand to full invocations (clawker go dev), shareable with your team via project config. See Command Aliases.
  • Monitoring stack — Optional OpenTelemetry Collector + OpenSearch + OpenSearch Dashboards + Prometheus for agent observability
  • Per-decision egress observability — eBPF event stream (allowed / denied / bypassed) flows to OpenSearch alongside Envoy and CoreDNS access logs, so bypass windows leave a full audit trail. See Egress Observability.

​
How It Works

Clawker sits between your CLI and Docker, adding a security and convenience layer:
Every container, volume, network, and image created by Clawker is tagged with dev.clawker.* labels. Clawker only sees and manages its own resources — it cannot touch anything outside its label scope.