NanoClaw host + nested per-session agent containers inside a Docker Sandbox micro-VM.
5.4K
NanoClaw host + nested per-session agent containers inside a Docker Sandbox micro-VM.
auth.docker.io:443
index.docker.io:443
production.cloudflare.docker.com:443
registry-1.docker.io:443
api.onecli.sh:443
onecli.sh:443
www.onecli.sh:443
api.anthropic.com:443
claude.ai:443
claude.com:443
console.anthropic.com:443
downloads.claude.ai:443
platform.claude.com:443
api.github.com:443
codeload.github.com:443
ghcr.io:443
github.com:443
objects.githubusercontent.com:443
raw.githubusercontent.com:443
release-assets.githubusercontent.com:443
bun.sh:443
checkpoint.prisma.io:443
deb.debian.org:443
registry.npmjs.org:443
security.debian.org:443
api.slack.com:443
api.telegram.org:443
discord.com:443
gateway.discord.gg:443
slack.com:443
t.me:443
web.whatsapp.com:443
sbx run docker.io/sbx/nanoclaw-kit:latestRun the following command to install sbx on your machine.
brew install docker/tap/sbxwinget install Docker.sbxNanoClaw is a local AI assistant runtime that can run Claude Code behind OneCLI-managed credentials and connect to chat channels such as Telegram, Slack, Discord, and WhatsApp.
This kit starts NanoClaw inside a Docker Sandbox micro-VM from a prebuilt host image. The image contains a clean upstream NanoClaw checkout with dependencies already installed, so first run focuses on pulling the nested service images, starting OneCLI/Postgres, and walking through NanoClaw setup.
sbx run --name nanoclaw --kit "docker.io/sbx/nanoclaw-kit:latest" nanoclaw
Or from a git URL targeting this repository:
sbx run --name nanoclaw --kit "git+https://github.com/docker/sbx-kits-contrib.git#dir=nanoclaw" nanoclaw
Or with a local clone of this repository:
sbx run --name nanoclaw --kit ./nanoclaw nanoclaw
The --name nanoclaw flag gives the sandbox a stable name for follow-up
commands such as sbx exec, sbx policy ls, and sbx rm.
The sandbox host image starts NanoClaw and uses the sandbox's inner Docker daemon for the services NanoClaw needs:
On first run, the kit asks before downloading Docker images because the initial pull can take a few minutes. After setup completes, keep the session open to keep NanoClaw available.
NanoClaw setup runs automatically on first boot. The kit defaults to Claude as the agent provider and uses OneCLI for credential management, matching a normal NanoClaw deployment. Raw API keys should not be placed in the sandbox.
If you connect a chat channel during setup, NanoClaw sends the first message through that channel when setup completes.
To customize NanoClaw after setup, keep the original sandbox session open and open Claude Code in a second terminal:
sbx exec -it -w /home/agent/nanoclaw nanoclaw claude
From there, use NanoClaw skills such as /add-telegram, /add-slack,
/add-discord, /add-whatsapp, or /customize.
The kit allows the domains NanoClaw needs for Docker image pulls, OneCLI,
Claude, GitHub, package downloads, and common chat channels. If a request fails
with 502 Bad Gateway, it may be blocked by the sandbox network policy.
Inspect the active policy from the host:
sbx policy ls nanoclaw --type network
The OneCLI dashboard and gateway are published by the sandbox. Use the port
mapping printed by sbx run to open the dashboard in a browser.