In This Article
Introduction
NanoClaw is a security-first variant of OpenClaw that runs all agent actions in isolated Apple Containers. Even if the agent is compromised by prompt injection or a malicious skill, it cannot touch the host filesystem. For security-conscious users — especially on macOS — NanoClaw offers stronger isolation than standard OpenClaw or Docker. The trade-off: some Skills that assume broad filesystem access may not work.
Architecture
NanoClaw uses Apple's sandboxing APIs to create a container per agent session. The agent runs with minimal entitlements: network (for LLM API, messaging), temporary filesystem. No access to user Documents, Keychain, or other sensitive paths. Skills that require file access get a scoped, ephemeral volume — they can read and write within that volume, but not outside it. When the session ends, the volume is destroyed. The host is never exposed.
Apple Containers
Apple Containers (App Sandbox) provide kernel-level isolation. Unlike Docker, which can have escape vulnerabilities (as seen in the CVE-2026-24763 Docker bypass), Apple's sandbox is designed for single-app containment. It's been battle-tested for years in iOS and macOS. NanoClaw uses this for agent execution. The agent runs in a sandbox; the sandbox is the boundary. Trade-off: some Skills that need broad filesystem access — e.g., scanning your entire Documents folder — may not work without modification.
Trade-offs
NanoClaw sacrifices: full filesystem access, some Skills that assume host access, and possibly performance (sandbox overhead). You gain: strong isolation, reduced blast radius from compromise. Choose when security outweighs capability. For sensitive deployments — legal, healthcare, finance — NanoClaw's isolation can be worth the limitations.
When to Choose NanoClaw
Choose NanoClaw when: (1) you're on macOS and want maximum isolation, (2) you're running agents with access to sensitive data, (3) you're concerned about prompt injection or malicious Skills, (4) you can accept that some Skills may not work. Choose standard OpenClaw or Docker when: (1) you need full filesystem access, (2) you're on Linux or Windows, (3) you're running trusted Skills only. See OpenClaw vs Nanobot for the broader lightweight landscape.
Getting Started
NanoClaw is a community fork. Install from the NanoClaw repo (not the main OpenClaw repo). Follow the NanoClaw setup guide — it differs from standard OpenClaw because of the container configuration. You'll need to grant specific entitlements for network access and any file paths the agent needs. Start with a minimal config; add entitlements as you discover what Skills require. If a Skill fails with "permission denied," it likely needs broader access — evaluate whether to grant it or skip that Skill. See ZeroClaw for an alternative minimal, secure option (Rust, no Skills).
Wrapping Up
NanoClaw is for macOS users who want maximum isolation. See OpenClaw security and Docker for alternatives.