clawk creates disposable Linux VMs for coding agents, mounting your repo and keeping host secrets separate. It uses macOS Virtualization.framework or Firecracker, with per-sandbox networks and allow-lists. Latest releases include v0.2.0 with a full changelog.
Collecting history — the radar snapshots this repo daily. The trend line appears after 3 days of data (2 so far).
What it is
clawk is described as a tool to give coding agents a disposable Linux VM, with the agent code mounted from the host and no keys entering the VM. It aims to keep the host environment isolated while allowing the agent to run inside a guest OS.
How it works
- The CLI launches per-sandbox daemons that own the VM, using macOS Virtualization.framework or Firecracker on Linux.
- The guest runs in a sandbox with a mounted repo and an agent (Claude Code, Codex, or shell) on a PTY.
- Networking is filtered by a per-sandbox allow-list; outbound connections are controlled, and the guest cannot reconfigure the host network policy.
- The rootfs is sourced from a OCI image; per-sandbox disks are copy-on-write clones.
- There is no sshd; a single vsock-based agent is the control path into the guest.
Getting started
Install: brew install clawkwork/tap/clawk.
From source: git clone https://github.com/clawkwork/clawk && cd clawk followed by make install.
Uninstall: clawk destroy your sandboxes, rm -rf ~/.clawk, then brew uninstall clawk.
Quickstart example:
cd ~/code/my-project
clawk # boot a sandbox for this dir + attach claude
clawk run shell # drop into a shell in the same sandbox
clawk run codex # or another agent: codex, opencode, shell
clawk down # stop the VM (repo + agent state persist)
clawk attach # come back later — boots if stopped, reattaches claude
clawk destroy # remove the VM (conversation history is kept)
Common options:
clawk run claude -- --resume # pass args through to the agent
clawk forward add my-project 3000 # expose a guest dev server on localhost:3000
clawk network allow my-project api.example.com
Getting started (continued)
The README notes that the VM boundary and allow-list provide containment, enabling the agent to operate at full speed without per-action prompts, while still limiting what can be accessed to what is mounted or allow-listed.
Releases
Latest three releases include:
- v0.2.0 v0.2.0 (2026-07-13): Full Changelog: https://github.com/clawkwork/clawk/compare/v0.1.0...v0.2.0
- v0.1.0 v0.1.0 (2026-07-07): Full Changelog: https://github.com/clawkwork/clawk/compare/guest-kernel-6.18.15-snd...v0.1.0
- guest-kernel-6.18.15-snd Guest kernel 6.18.15 (sound-enabled) (2026-07-06): clawk guest kernel 6.18.15, identical to Kata's
p ined config plus virtio-snd (see images/guest-kernel). Point a sandbox at an asset with
vm ( kernel <url> ).
Traction
- Stars: 697
- Forks: 20
- Open issues: 3
Configuration
No external config file required by default; a clawk.mod file provides per-project customization in a go.mod-style syntax. Examples cover vm(cpu,memory,image), network, forwards, env, on create hooks, and agent instructions.
Behind the repo
Not provided in the excerpt.
Caveats
- Requires macOS 14+ on Apple silicon (Linux support via firecracker is experimental).
- The README notes pre-1.0 speed and potential breaking changes between releases.
- The repository is licensed under Apache-2.0.