Give your coding agent a throwaway Linux VM (clawk setup)

This is the setup for clawk, the tool from the reel. Everything below is from the project's own README, checked on 2 September 2026.

What it actually does: it boots a disposable Linux virtual machine for each project and runs your coding agent inside it. Claude Code, Codex, pi and opencode all work. Your repo is mounted in. Nothing else on your machine is.

The one idea that makes it different

Container-based sandboxes hide your filesystem behind deny rules. They share your kernel, so a mistake in the policy exposes the host.

clawk runs a separate kernel. In the README's own words: "the host filesystem isn't hidden behind deny rules; it was never mounted."

There is no policy to get wrong, because there is nothing there to deny.

Install

Requires macOS 14+ on Apple silicon. Linux works via firecracker and is explicitly experimental.

brew install clawkwork/tap/clawk

No Docker, no qemu, no sudo. The hypervisor is Apple's own Virtualization.framework, linked into the binary.

The everyday commands

cd ~/code/my-project
clawk                 # boot a sandbox for this dir and attach claude
clawk run shell       # a shell in the same sandbox
clawk run codex       # or codex, pi, opencode
clawk down            # stop the VM, repo and agent state persist
clawk attach          # come back later
clawk destroy         # remove the VM, conversation history is kept

The part that sounds reckless and is not

Inside the sandbox, agents launch with their guardrails off on purpose. Claude gets --dangerously-skip-permissions, codex gets --dangerously-bypass-approvals-and-sandbox, opencode gets --auto.

On your own machine those flags would be a bad idea. Here they are the whole point: the VM boundary and the network allow list do the containing, so the agent works without stopping to ask about every action.

If you want the prompts anyway, add --safe to any attach.

Networking

Outbound traffic is denied by default. Each sandbox gets its own allow list, and it is enforced where even root inside the guest cannot change it.

clawk network allow my-project api.stripe.com
clawk network denials my-project    # what the agent tried that got blocked
clawk forward add my-project 3000   # guest dev server on your localhost:3000

npm, PyPI, crates.io, GitHub and Anthropic are pre-allowed. The filter is DNS aware, so allowing a hostname keeps working when its IPs rotate.

What survives what

Thing	clawk down	clawk destroy
Your repo, commits and branches	kept	kept
Agent conversations and memory	kept	kept
The VM disk, apt installs, caches	rebuilt fresh	gone, that is the point

The rule is one line: the VM is disposable, everything you would miss lives on the host.

What to expect, honestly

It does not stop an agent doing damage with what you gave it. The README says it plainly: an agent can commit bad code, or push to any repo your forwarded ssh-agent can reach. Review what comes out of a sandbox like you would review a stranger's pull request.

Secrets you push in are visible, and GitHub is allow-listed out of the box. Forwarded environment variables and the agent's token are the agent's to read, and to send anywhere that is allow-listed. Read that next to the pre-allowed list above. "Denied by default" is the rule for hosts you have not thought about, not a promise that nothing leaves. Share the minimum.

It is macOS on Apple silicon. No Intel Macs, no Windows. Linux is experimental.

It does not defend against a hypervisor escape. It relies on Virtualization.framework and KVM isolation and adds nothing beyond them.

The source

The project: https://github.com/clawkwork/clawk

1,003 stars, Apache 2.0, last pushed 13 August 2026. Every claim on this page is from that README, read on 2 September 2026. If it has changed since, trust the repo over this page.

What did your agent try to do?

Run one for a week, then check clawk network denials. Tell me in The Rabbit Hole what it tried to reach that you did not expect.

It is the room where I keep the parts that don't fit on a page like this: the full run of numbers, what broke the first time, and the ones that looked good and then didn't work at all.

Two catches, up front, because that's the rule here. It's private, so you have to be inside to read anything. And it's new, so you'd be early rather than joining something busy.

Free: skool.com/the-rabbit-hole-3206/about