{"id":334247,"date":"2026-03-07T19:19:24","date_gmt":"2026-03-07T19:19:24","guid":{"rendered":"https:\/\/www.newsbeep.com\/ie\/334247\/"},"modified":"2026-03-07T19:19:24","modified_gmt":"2026-03-07T19:19:24","slug":"nanoclaw-can-stuff-each-ai-agent-into-its-own-docker-container-to-deal-with-openclaws-security-mess","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ie\/334247\/","title":{"rendered":"NanoClaw can stuff each AI agent into its own Docker container to deal with OpenClaw’s security mess"},"content":{"rendered":"

On the one hand, I feel a bit conflicted pointing out the recognised security issues with OpenClaw<\/a>, even as serious AI thought leaders are naming their agents \u201cArnold\u201d and shouting orders at them. I feel duty-bound to take their enthusiasm seriously, while also stressing that this whole area remains problematic.<\/p>\n

Enter NanoClaw<\/a>. And it\u2019s more than just a very small claw<\/a>.<\/p>\n

Firstly, NanoClaw can isolate each agent in its own container. So the agentic loop starts with no knowledge of other agents, and only knows about the resources you tell it about.<\/p>\n

The other intriguing thing is that the app isn\u2019t a large configuration file talking to a monolith; it is just the code you need (and the appropriate Claude skills) \u2014 with Claude hacking itself as needed. Given that code is \u201ccheap\u201d now, and Claude editing is reliable, this does make sense. And it does keep the code size down.<\/p>\n

WhatsApp? No thanks.<\/p>\n

My first question was\u2026 how does a bot get access to WhatsApp? This is the preferred contact choice of most OpenClaw users (and NanoClaw). The problem here is that unless you have a business account, you surely don\u2019t own enough stake in the platform to host an arbitrary new user. On\u00a0closer inspection, it appears that the WhatsApp connection relies on a module called\u00a0Baileys<\/a> that scans WhatsApp Web\u2019s WebSocket-based data, which Meta strongly discourages. In fact, accounts using unauthorised methods to connect to WhatsApp are actively monitored and restricted.<\/p>\n

I\u2019m hardly going to encourage using such a method, but fortunately, we don\u2019t have to. I do pay for a Slack workspace, and while connecting to Slack is a little painful, it is at least fully accounted for.<\/p>\n

Installing<\/p>\n

I have Claude installed, of course, connected to a \u201cPro\u201d account. With the instructions<\/a>, I do the usual thing:<\/p>\n

\ngit clone https:\/\/github.com\/qwibitai\/nanoclaw.git<\/p>\n

\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t <\/p>\n

git clone https:\/\/github.com\/qwibitai\/nanoclaw.git<\/p>\n


\n\t\t\t\t\t <\/p>\n

Then I ran Claude within the new directory with \/setup:<\/p>\n

\"\"<\/p>\n

I have Docker Desktop installed, as this part requires:<\/p>\n

\"\"<\/p>\n

On a Mac, you will see the familiar Docker icon in the Menu Bar if you didn\u2019t start it yourself.<\/p>\n

Then we move to how you are connecting to Claude:<\/p>\n

\"\"<\/p>\n

Usually, I have to remember to turn the API key off because it\u2019s more expensive than a subscription. This is the first time I\u2019ve seen the two options mentioned side by side\u2014a good sign.<\/p>\n

Then we get to the contentious bit:<\/p>\n

\"\"<\/p>\n

As I\u2019ve indicated, I don\u2019t think WhatsApp is appropriate, so I\u2019ll be using Slack.<\/p>\n

Then we were given the great Slack sidequest:<\/p>\n

\"\"<\/p>\n

I now have to find two tokens, but not with my sword and trusty shield, but with the Slack API. I only recommend this campaign for an experienced adventurer. Onwards.<\/p>\n

Generating the tokens in Slack<\/p>\n

Fortunately, there are some good instructions on the Slack skill<\/a>, and Claude is patient. First, we need to generate the tokens and scopes.<\/p>\n

On Slack, I found the appropriate dialog:<\/p>\n

\"\"<\/p>\n

We need to turn on Socket Mode:<\/p>\n

\"\"<\/p>\n

Then we need to subscribe to a set of bot events:<\/p>\n

\"\"<\/p>\n

And add scopes for OAuth \u2013 these limit what the NanoClaw App can do in the account:<\/p>\n

\"\"<\/p>\n

And finally, you get to install your new app and fetch the final dungeon key token:<\/p>\n

\"\"<\/p>\n

I have slain the dragon \/ found the treasure \/ defeated the Rocketeer. Well, not quite.<\/p>\n

Claude crashed. But I quickly got back to where I was, and Claude appears to fix the errant Slack script, and accept my two tokens for its .env file:<\/p>\n

\"\"<\/p>\n

Then it was a case of introducing NanoClaw into my Slack channel.<\/p>\n

I suspected we were done with Slack itself, but we needed to give it access to my server folders. Remember, this is what we did with Claude Cowork<\/a> to give it real power:<\/p>\n

\"\"<\/p>\n

A nicer way to select the folders would be cool, but I added the folders I was happy for NanoClaw to see:<\/p>\n

\"\"<\/p>\n

And then I was able to communicate with NanoClaw on my Slack channel, after getting the correct Claude auth token:<\/p>\n

\"\"<\/p>\n

My initial attempt to confirm that NanoClaw could see my folders on my Mac failed:<\/p>\n

\"\"<\/p>\n

This is both good and bad. It proved that the agent is sitting in a container and not part of a single app. And of course, I asked Claude to fix itself. I had been tailing the log, so I could relay all the problems back to Claude, which eventually mapped the folders in a way that the NanoClaw agent could understand:<\/p>\n

\"\"<\/p>\n

Note how it refers to \u201cthe agent\u201d as a separate entity. So I had a back-and-forth between the NanoClaw agent and Claude. I\u2019m still very much the engineer here \u2013 but the separation of control is fine. The errors were the ones we all make, not understanding what Linux wants. No one understands what Linux wants.<\/p>\n

Eventually, it fixed its internal database and restarted what it needed to for the container. And with the new mapping, I could see my Documents folder:<\/p>\n

\"\"<\/p>\n

To check, I added a new file to check it really was mapped live to the directory. Eventually, it did reflect that the file was there.<\/p>\n

\u201cI like the fact that Claude thought of the agent sitting in the container as quite separate from itself, and overall this is certainly a much more sensible and secure setup if you really want to be a \u2018power user\u2019 who really just needs a secretary to yell at.\u201d<\/p>\n

Now this isn\u2019t running on a Mac Mini under my cupboard, but on my laptop. So I won\u2019t be asking for a research document based on a report in my inbox at 2 a.m. while out for a jog, but if I were into that sort of thing, NanoClaw can clearly provide this fairly safely.<\/p>\n

While I did need to play engineer to get everything working, in reality, I was telling Claude my problems, and Claude fixed them. For that, I got a direct connection from my mobile Slack app to my server. I like the fact that Claude thought of the agent sitting in the container as quite separate from itself, and overall, this is certainly a much more sensible and secure setup if you really want to be a \u201cpower user\u201d who really needs a secretary to yell at.<\/p>\n

\t<\/p>\n

\n\t\t\t\tYOUTUBE.COM\/THENEWSTACK\n\t\t\t<\/p>\n

\n\t\t\t\tTech moves fast, don’t miss an episode. Subscribe to our YouTube
\n\t\t\t\tchannel to stream all our podcasts, interviews, demos, and more.\n\t\t\t<\/p>\n

\t\t\t\tSUBSCRIBE<\/p>\n

\t<\/a><\/p>\n

Group
\n Created with Sketch.<\/p>\n

\t\t<\/p>\n

\t\t\t\t\t<\/p>\n

\n\t\t\t\t\t\t\tDavid has been a London-based professional software developer with Oracle Corp. and British Telecom, and a consultant helping teams work in a more agile fashion. He wrote a book on UI design and has been writing technical articles ever since….\t\t\t\t\t\t<\/p>\n

\t\t\t\t\t\tRead more from David Eastman\t\t\t\t\t\t<\/p>\n

\t\t<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"On the one hand, I feel a bit conflicted pointing out the recognised security issues with OpenClaw, even…\n","protected":false},"author":2,"featured_media":334248,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[61,60,80],"class_list":{"0":"post-334247","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-technology","8":"tag-ie","9":"tag-ireland","10":"tag-technology"},"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/334247","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=334247"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/334247\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/334248"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=334247"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=334247"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=334247"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}