Skip to main content

​
Clawker

The rise of Agentic AI has been meteoric, but in the rush to ship model harnesses, the industry is skipping the risks and responsibilities that come with them. They’re avoiding dependency pain by shipping bare-metal software, when the harness itself needs a harness. Clawker solves this by running Claude Code agents in isolated devcontainers with security controls, credential forwarding, and multi-agent orchestration built in.

Quick Start

Get up and running with Clawker in minutes

Installation

All installation methods: Homebrew, curl, source build

Configuration

Configure projects with .clawker.yaml

CLI Reference

Complete command reference for all CLI commands

​
What Is an Agent?

In Clawker, an agent is a named container instance running Claude Code. Each agent gets its own isolated environment with its own filesystem, network, and credentials. You can run multiple agents per project (e.g., --agent dev, --agent review) and they operate independently. 
clawker run -it --agent dev @     # Start a "dev" agent
clawker run -it --agent review @  # Start a "review" agent in parallel

​
What Clawker Does

  • Default-on firewall — Blocks outbound traffic except allowlisted domains (Anthropic APIs, package registries). Your agent can’t phone home to unexpected endpoints.
  • Seamless credential forwarding — SSH agent, GPG agent, and Git HTTPS credentials forwarded from your host. No manual key copying.
  • Isolated agent environments — Each Claude Code agent runs in its own Docker container with configurable security controls
  • Bind or snapshot workspaces — Mount your repo for live editing, or copy it for pure isolation
  • Embedded Dockerfile template — Parameterized images with common dev tools preinstalled, supporting Alpine or Debian bases
  • Project-scoped namespacing — Multi-agent, multi-project isolation via Docker labels and naming conventions
  • Git worktree integration — Spin up agents on separate branches with automatic worktree management
  • Autonomous loop mode — Run Claude Code in iterative loops with stagnation detection and circuit breakers
  • Monitoring stack — Optional Prometheus + Loki + Grafana for real-time agent observability

​
How It Works

Clawker sits between your CLI and Docker, adding a security and convenience layer: 
You (CLI) -> Clawker -> pkg/whail (label-isolated Docker engine) -> Docker SDK -> Docker
Every container, volume, network, and image created by Clawker is tagged with dev.clawker.* labels. Clawker only sees and manages its own resources — it cannot touch anything outside its label scope.