Run OpenClaw safely in one command.
No Docker flags. No sandbox configuration. No security footguns.
SafeRun is not an agent framework. It is the execution layer beneath them.
It enforces a least-privilege runtime model for autonomous AI agents. Today, it makes OpenClaw safer and dramatically easier to run locally, even if you have never configured Docker before.
SafeRun removes the complexity and the risk of running powerful AI agents locally.
- One command. No Docker expertise. Install, configure, sandbox, and launch OpenClaw without touching container flags or runtime settings.
- Secure by default. Network disabled, --cap-drop ALL, read-only root filesystem, least privilege from the start.
- Secrets handled correctly. API keys are injected at runtime and never written to disk unless you explicitly choose the encrypted vault.
- Designed for autonomous AI agents. Not generic container tooling, a runtime model built specifically for untrusted, self-executing code.
- A consistent execution baseline. Every agent runs under the same enforced security policy, reducing configuration drift and human error.
Running OpenClaw via plain Docker leaves several gaps:
| Plain Docker | SafeRun | |
|---|---|---|
| Network access | Enabled by default | Disabled by default |
| Linux capabilities | Inherited | All dropped (--cap-drop ALL) |
| Root filesystem | Writable | Read-only |
| API key handling | Manual, often persisted | Session-only injection, optional vault |
| Security review | Up to you | Enforced by runtime |
SafeRun is not magic. But it applies a consistent, auditable security baseline so you don't have to.
SafeRun walks you through the minimal required steps and handles the rest automatically.
npm install -g @ttmlabs-io/saferun
saferun ai openclaw # install, configure, and launchWhat happens when you run saferun ai openclaw:
OpenClaw
ℹ Building from git source (deterministic)...
✓ OpenClaw installed (v2026.2.22)
...
✓ Setup complete!
ℹ Internet is ON for this session (required)
ℹ Which AI service do you use?
1) Anthropic (Claude)
2) OpenAI (ChatGPT)
...
ℹ Your API key is used for this session only.
✔ Sandbox configured
✔ Device paired
✔ OpenClaw ready → http://127.0.0.1:18789
✔ Browser opened automatically
Logs: saferun ai openclaw logs --follow
Stop: saferun ai openclaw stop
Clean: saferun ai openclaw down
Every OpenClaw instance runs inside a container with:
- Docker isolation — process, filesystem, and namespace separation from the host
--cap-drop ALL— all Linux capabilities removed- Read-only root filesystem — the container cannot modify its own image
- Network disabled by default — OpenClaw only gets outbound access when explicitly required (e.g. for API calls)
- API key handling — keys are injected as environment variables for the session only. They are not written to disk. Optionally, store them in the local encrypted vault (scrypt + AES-256-GCM).
- An agent escaping its declared filesystem scope
- Accidental network egress from a sandboxed process
- API keys persisting on disk after the session ends
- Privilege escalation via Linux capability abuse
- Docker daemon compromise — if the daemon is compromised, container isolation can be bypassed
- Kernel exploits — container security depends on the host kernel; a kernel-level vulnerability can break isolation
- A fully compromised host — SafeRun cannot protect against an attacker who already controls the machine
SafeRun reduces the attack surface of running autonomous AI agents locally. It is not a substitute for a secure host environment. SafeRun assumes a reasonably secure host and a trusted Docker installation.
- Docker Desktop or Docker Engine (v20+)
- Node.js 20+
- macOS, Linux, or Windows
saferun ai openclaw # launch OpenClaw (installs if needed)
saferun ai openclaw logs -f # stream live logs
saferun ai openclaw stop # pause the container
saferun ai openclaw down # stop and remove the containerFull command reference → docs/
- Hardened OpenClaw integration — ongoing improvements to sandboxing and UX
- Additional AI agent integrations — support for other agents beyond OpenClaw
- Improved UX for non-dev users — GUI launcher, guided setup
- Optional scalable runtime layer — secure multi-agent and team execution environments
Contributions welcome. See CONTRIBUTING.md for guidelines.
Issues and discussions: https://github.com/ttmlabs-io/SafeRun/issues
Apache-2.0 — See LICENSE.