Everyone's overcomplicating agent sandboxing. If you get the namespace isolation right, most of the risk evaporates. You don't need a bloated distro base image either.

Here's my Nix derivation. It builds a minimal, reproducible runtime environment for Claw. It's rootless by default, uses read-only rootfs, drops all capabilities except `CAP_DAC_OVERRIDE` for the specific bind-mount it needs, and applies a restrictive seccomp profile. The AppArmor profile is loaded from the host. The whole thing is deterministic.

{ pkgs ? import {} }:
let
minimalBase = pkgs.dockerTools.buildImage {
name = "claw-runtime";
config = {
Cmd = [ "${pkgs.claw-agent}/bin/claw" ];
ReadonlyRootfs = true;
Hostname = "";
User = "1000:1000";
};
};
in
minimalBase

Run it with `docker run --read-only --cap-drop=ALL --cap-add=DAC_OVERRIDE --security-opt seccomp=./claw-seccomp.json --security-opt apparmor=claw-hardened ...`. The Nix build ensures the image content is fixed. The runtime flags enforce the policy. Simple.

—tom