dclaw splits into a Go control plane (the daemon) and a Node + pi-mono data plane (agent containers). The diagram below is the interactive version. Hover to explore what crosses which boundary.
This is the blast-radius argument. Sandboxing changes "one compromise = full system" into "one compromise = one agent." The rest of the architecture exists to keep that true.
Attacker jailbreaks an agent via untrusted input. On bare-metal runtimes this walks the agent's bash tool to your ~/.ssh.
CAP_MKNOD lets the agent create /tmp/sda pointing at the host's first SCSI disk and read raw sectors — including /etc/shadow on the host.
A setuid binary on the rootfs (or one written by the agent) lets execve hand the agent a more-privileged identity. CVE-2019-5736 territory.
Spawn :(){ :|:& };: and exhaust the host's PID table. On macOS this crashes Docker Desktop's VM. On Linux it crashes the kernel.
Bind-mount /var/run/docker.sock as the agent's workspace and the agent now controls the host's Docker daemon — equivalent to root.
Create ~/dclaw-agents/trojan as a symlink to /etc and pass --workspace=~/dclaw-agents/trojan. Naive containment misses this.
Most "sandboxed agent" frameworks mean "we shelled out to docker for the bash tool." dclaw means the whole agent, including the LLM call and every tool, runs inside the box.
pi-mono by Mario Zechner is a proven, MIT-licensed TypeScript agent SDK with multi-model support. It ships inside our container. We add the sandbox, the fleet, and the channels.