Have you seen https://news.ycombinator.com/item?id=48892015 and yoloai? https://github.com/kstenerud/yoloai
Seems like both projects are following very similar approaches.
Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop
11–20 of 177 posts
Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop
#12Errbody gangsta until the agent figures out it's in a container and finds an exploit that lets it break out of container jail...
[deleted]
Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop
#13This is like the 30th AI sandbox project on Show HN. Why this one over the rest?
Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop
#14Errbody gangsta until the agent figures out it's in a container and finds an exploit that lets it break out of container jail...
I developed a VM project just like this one. Asked Fable to stress test it and try to break out of containment, and to my surprise it didn't manage to. Fable didn't get downgraded to Opus either, for some reason. Would have thrown Mythos at it if I had access to it.
Isn't Fable just Mythos + guardrails? Sounds like you did throw Mythos at it.
Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop
#15I still don't understand the point of all these VMs and containers for agents. Just create a separate user on your machine without sudo privileges, switch to it in your terminal and run all the agents you want without it being able to reach your files. What am I missing?
Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop
#16yoloAI does something similar:
- Sandbox on Linux using Docker, Podman, containerd, gVisor, Kata, Firecracker
- Sandbox on Mac using Docker (Docker Desktop or Orbstack), Podman, Apple containers, Seatbelt, Tart (Tart lets you run simulators).
- Network restriction
- Secrets control (file mounts or credentials broker)
- NO ambient data (ENV is replaced with a minimal and local-to-sandbox one, no host-side filesystem access beyond what you explicitly allow)
- Workdir protection: Your work dir is never modified until you apply the changes, either standalone or as a git commit. You can also diff before applying. Git runs SANDBOX side in case the repo has filters.
- Uses copy-on-write if your filesystem supports it (most modern ones do)
- Has built-in support for claude, codex, gemini, aider, and opencode, but you can also launch it in "shell" mode and run whatever you want.
- Supports VS code tunnels, so you can remotely access in VS code if you don't want to use the terminal.
- Full lifecycle support: Launch, attach, stop, restart, wait, one-shot, clone, destroy
- MCP passthrough
- Layered API (golang) if you want to sandbox other things
- Self-contained binary. No external requirements other than the backends you want to use. Defaults to a ~/.yoloai dir for config/data, but you can point it anywhere.
- FOSS
Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop
#17> clawk forward add my-project 3000 > clawk network allow my-project api.example.com Can you describe the implementation details? How did you implement the firewall without root? I vibecoded virtdev, a virtual machine orchestration project just like this one: https://github.com/matheusmoreira/virtdev It was designed to not require root, and the nftables firewall ended up becoming the only exception. I'm very curious…
Thanks! There's no packet firewall at all, no iptables/nftables. On macOS the VM's NIC is a Virtualization.framework file-handle device. The daemon runs gvproxy, which terminates the guest's connections and re-dials them as host sockets, so I filter with an allow-list right before the dial.
One caveat, since you asked about root specifically: that's the macOS path, and it only works thanks to the fd NIC. Firecracker on Linux only speaks a TAP, which needs root, so there I do shell out to sudo, but just for the device. The filtering is still the same userspace allow-list.
Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop
#18why not just use something like smol VMs? So many VM's and I am confused on which one to use for what. I think we now need a VM orchestrator!
Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop
#19I still don't understand the point of all these VMs and containers for agents. Just create a separate user on your machine without sudo privileges, switch to it in your terminal and run all the agents you want without it being able to reach your files. What am I missing?
In a corporate environment they may not have that option
Re: Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop
#20I still don't understand the point of all these VMs and containers for agents. Just create a separate user on your machine without sudo privileges, switch to it in your terminal and run all the agents you want without it being able to reach your files. What am I missing?
VMs and containers are fairly isolated and reproducible. A separate user on your machine still depends on the programs installed locally.