NanoClaw Puts AI Agents in a Virtual Cage With Docker Partnership

The security problem with AI agents is getting a new solution: put them in a box. Literally.

NanoClaw, the open-source agent platform built as a lighter and more secure alternative to OpenClaw, announced Thursday a partnership with Docker to run agents inside Docker Sandboxes — micro VMs that provide stronger isolation than standard containers.

"Each agent runs in its own container, and all containers run inside a micro VM," explained Gavriel Cohen, co-founder of NanoClaw, in a blog post. "If a hallucination or a misbehaving agent can cause a security issue, the security model is broken. Security has to be enforced outside the agentic surface."

The timing matters. AI agents have moved from chatbots that answer questions to systems that can execute code, modify files, and access sensitive data on users' behalf. The shift introduces real risk: agents running with elevated permissions can accidentally — or intentionally — wipe file systems or exfiltrate data.

Docker introduced Sandboxes last November to address these concerns. According to Mark Cavage, COO of Docker, the solution provides "true isolation with its own dedicated kernel and its own dedicated hardware space" — unlike containers, which share a host kernel.

"With Docker Sandboxes, that boundary is two layers deep," Cohen said. "If a container escape is attempted — exploiting a zero-day, for example — it would still be contained."

The partnership targets the "YOLO" problem. That's the setting in Cursor AI IDE (now renamed "auto-run") that lets agents perform automated actions without seeking permission. Developers want it because constant approval prompts are annoying. But as Cavage noted, "the problem is it can wipe out your file system and do very, very bad things."

The solution: put YOLO in a box.

"If you can put YOLO in a box, then developers go from babysitting the agent to letting it run for minutes or hours," Cavage said. "That's the huge productivity unlock."

NanoClaw differentiates itself from OpenClaw through simplicity: roughly 4,000 lines of code versus over 400,000. The smaller attack surface, combined with Docker's isolation, aims to make agent security manageable for enterprises.