Clawk Isolates Autonomous AI Agents Inside Ephemeral Hypervisor-Based Linux VMs
Clawk provides local, disposable Linux virtual machines to run AI coding agents securely without compromising the host machine. By using native hypervisors and strict network allow-lists, the tool isolates untrusted code execution while maintaining access to local repositories and SSH keys.
Hypervisor-Level Isolation vs. Process Sandboxing
Clawk rejects process-level sandboxing in favor of hardware-virtualized isolation boundaries. Instead of wrapping agent processes in host-level policy rules, Clawk boots a dedicated guest Linux kernel. The host filesystem is not hidden via path-denial rules; it is entirely unmounted and unreachable from the guest, with the sole exception of the targeted project directory mounted into the VM.
On macOS 14+ (Apple silicon), Clawk integrates Apple's Virtualization.framework directly into its compiled Go binary, eliminating external dependencies like QEMU or a running Docker daemon. For Linux hosts, Clawk provides experimental support via Firecracker. The guest environment operates with root privileges, enabling agents to execute system package installations, modify configuration files, and bind to privileged ports without risking host system integrity. On supported hardware with a KVM-enabled guest kernel, this virtualization model permits nested containerization workloads, such as running Docker or Kubernetes (Kind) directly inside the sandbox.
Network Security and Secret Management
The network security model assumes that any file accessible to the agent could potentially be exfiltrated. To mitigate this threat, Clawk enforces an outbound network allow-list. All connection attempts to non-whitelisted destinations are refused at the network boundary. Well-known endpoints like `github.com` are pre-allowed, and administrators can explicitly whitelist specific domains on a per-project basis.
To handle remote code operations securely, Clawk forwards the host's `ssh-agent` connection into the VM instead of copying raw private keys. This configuration allows git operations to authenticate successfully from within the guest while keeping primary credentials, such as `~/.ssh/id_rsa`, completely isolated on the host filesystem.
Ephemeral Lifecycle and State Management
Clawk decouples the volatile execution environment from the persistent project files. The VM’s root filesystem is built from an OCI image and is treated as entirely disposable. If an agent compromises the guest OS or corrupts system libraries, the operator can discard the environment and instantiate a clean state instantly.
The application codebase and agent conversation logs reside on the host filesystem and persist across virtual machine lifecycles. Clawk also supports concurrent execution of multiple sandboxes. This architecture enables developers to assign distinct VMs to different projects or separate Git worktrees when addressing tickets that span multiple repositories. To prevent host resource exhaustion, idle VMs automatically release allocated memory and suspend their state to disk.
System Architecture and Integration
The tool is written in Go and requires Go 1.26+ for source builds. On macOS, installation is supported via a Homebrew tap. The system operates without background daemons or host configuration modifications; there are no launchd plist files or persistent background services. The per-sandbox helper daemons run as standard user space processes on the host and terminate automatically alongside their corresponding virtual machines.