Clawk

Anyone who's let an AI coding agent loose on a real project knows the tradeoff. Either you approve every single command it wants to run, which turns your agent into a chatty intern you can't stop babysitting, or you flip on the skip-permissions flag and just hope it doesn't rm -rf something important or leak an API key. clawk, a new command-line tool for macOS on Apple silicon, picks a third path: it spins up a disposable Linux virtual machine for the agent to live in, mounts your repo into it, and lets Claude Code or Codex do absolutely anything inside that box while your actual laptop stays completely untouched.

The mechanics are almost boring in a good way. Type clawk in a project directory and, within seconds after the first build, you're dropped into a session where the agent has root, a full Linux userland, and zero permission prompts. It can install packages, spin up databases, run untrusted test suites at full speed — the stuff that makes lightweight process sandboxes choke. Network traffic is filtered by a userspace stack that even root inside the guest can't touch, so an attempt to phone home to some sketchy tracker just gets refused outright. Meanwhile your SSH keys never enter the VM at all; git push works because the ssh-agent is forwarded, not because your private key got copied somewhere it shouldn't be.

What makes this different from a Docker container or a devcontainer setup is the kernel boundary. Containers share your host kernel and see your filesystem behind a wall of deny rules, which is fine until one mistaken mount or kernel bug punches a hole through it. clawk's VM runs its own kernel entirely, so there's no host filesystem to hide in the first place — it was simply never mounted. That's also why it can safely run things like nested Docker or Kind clusters that a locked-down process sandbox tends to fight you on the whole time.

It's not a magic bubble, and the docs are refreshingly upfront about that. GitHub and the major package registries are pre-allowed by default, and since the forwarded ssh-agent can push code, anything the agent can read is something it could technically publish somewhere. So the security model isn't zero-trust, it's damage-containment: if the agent trashes the sandbox, you run clawk destroy and clawk again and you're back with a clean VM and the same conversation history, because that state lives on your actual machine, not inside the disposable disk.

clawk is still pre-1.0 and the maintainers admit things will break between releases. But the idea behind it — give the agent a whole machine to wreck instead of carving permission holes in yours — feels like the more honest answer to a problem every agentic coding tool is currently dancing around.