Every agent runs inside its own Docker container — brain, tools, filesystem, network. Caps dropped, rootfs read-only, uid 1000, PIDs capped at 256. A Go control plane routes; pi-mono containers think. One compromise stays one compromise.
dclaw is opinionated. These are calls made once so you don't make them per-deployment. They do not come back as flags. The denylist is absolute on every OS — even --workspace-trust can't bypass it.
Every agent — brain and tools — runs inside a Docker container. There is no sandbox.mode: "off". One prompt injection = one destroyed container.
CapDrop ALL · no-new-privileges · ReadonlyRootfs · tmpfs overlays for /tmp+/run · non-root uid 1000 · PidsLimit 256 · seccomp default. mknod, ptrace, setuid, fork-bomb — all return EPERM.
workspace-root allow-root + system denylist (/etc, /var, docker.sock, Docker Desktop socket). Symlink-resolved before mount. --workspace-trust is the only escape, and it's logged.
Agent loop is @mariozechner/pi-coding-agent — 34.6k stars, MIT, multi-model. We do not rewrite the agentic loop. We wrap it.
Every agent-create decision (pass / forbidden / trust) lands in audit.log with rotation: 10 MB × 5 files. O_APPEND + O_SYNC + 0600. Reconstruct who-trusted-what after the fact.
dclaw init creates the allow-root, dclaw doctor preflights seven checks, dclaw daemon start brings up the control plane. State-dir honors XDG on Linux, ~/.dclaw on macOS.
Paths hardening (beta.1) bounded WHERE the bind-mount points. Sandbox hardening (beta.2) bounds WHAT the containerized agent can do once inside. There is no escape hatch for any of these.
Every Linux capability dropped. mknod fails with EPERM. CAP_NET_RAW, CAP_MKNOD, CAP_SYS_CHROOT — gone.
Setuid/setgid bits cannot grant new privileges via execve. Defense vs CVE-2019-5736 and similar runc escapes.
Rootfs is read-only. /tmp and /run are tmpfs overlays with noexec,nosuid,nodev. /workspace is the only persistent write surface.
Daemon enforces non-root user regardless of image USER directive. A regressed image still can't run as root.
Fork bomb caps at 256 processes. pi-mono steady-state is ~5. The 257th fork returns EAGAIN.
Docker's daemon-loaded default profile applied. unshare(CLONE_NEWUSER), keyctl, ptrace — denied for unprivileged.
Three Docker socket paths absolutely denied as workspaces. Linux /var/run, systemd /run, Docker Desktop macOS. --workspace-trust can't bypass.
Most agent frameworks run on your host. The agent's bash tool IS your bash. The agent's network IS your network. That is a fine demo and a poor production story.
We're in beta.2 today. Each phase ships with working binaries and a public changelog. Container posture is the second-to-last gate before GA.
dclaw version, --help, structured JSON error envelopes. EX_UNAVAILABLE for daemon-bound commands.
Go daemon, JSON-RPC wire protocol, fleet lifecycle. workspace-root validator, --workspace-trust, NDJSON audit log.
Container posture: cap drop, no-new-privileges, ReadonlyRootfs, tmpfs, non-root uid, PidsLimit, docker.sock denylist.
Web dashboard, egress allowlist wiring, distroless agent image. Channel plugins follow.