A security-conscious, one-command Docker deployment for Claw Code
Multi-stage non-root Docker image · Docker Compose · .env configuration
| File | Description |
|---|---|
INSTALLATION_GUIDE.txt |
Full installation guide |
.env.template |
API key configuration template |
Containerfile.hybrid |
Multi-stage, non-root image build file |
docker-compose.override.yml |
Compose configuration and restrictions |
setup-claw.ps1 / setup-claw.sh |
Cross-platform setup scripts |
claw.ps1 / claw.sh |
Cross-platform launcher scripts |
skills/ |
Optional skill installers and bundled skills |
The setup script prepares the upstream source, configuration, image, and project directory. The launcher starts Claw Code in a Docker container with the configured mounts, environment, and permission settings.
This repository
│
├── setup-claw.sh ──→ Prepares source, configuration, and image
│
└── claw.sh ──→ Runs the configured Docker container
with the project directory mounted
This installation method is designed to reduce the privileges and unnecessary runtime contents of the container:
- Docker isolation from the host process environment
- Non-root execution
- Dropped Linux capabilities and
no-new-privileges - Explicit environment-file handling for provider credentials
- Multi-stage build without the compiler in the runtime image
These controls reduce exposure; they do not eliminate risk. The agent can act
on mounted files and can use whatever tools and permissions the configuration
makes available. Review changes, protect .env, avoid mounting secrets, and
use the least permissive mode that fits the task.
Note: The Windows version has no bugs which I am currently aware of, while the macOS / Linux version does have bugs which I am aware of, and which may impact your experience.
OpenRouter is the default example because it provides one endpoint for multiple models and may offer free routes. Availability and terms vary; direct provider APIs are also supported by the setup scripts.
Windows:
.\setup-claw.ps1 -ApiKey "your-api-key" -Provider openroutermacOS / Linux:
./setup-claw.sh --api-key "your-api-key" --provider openrouterThe script checks prerequisites, prepares configuration, builds the image, and creates the project directory. The first build requires additional time and resources because it compiles Rust dependencies.
Windows:
.\claw.ps1 "Hello, Claw Code!"macOS / Linux:
./claw.sh "Hello, Claw Code!"Then run the upstream health check command if supported by the installed version, and verify the result before doing write-enabled work.
Note: Do not use unrestricted permission modes unless you understand the consequences. Read-only or other restrictive modes are preferable while learning the system.
- Docker Desktop or compatible Docker Engine and Compose
- Git
- An API key for a supported provider, unless your configuration supplies a compatible local or otherwise unauthenticated endpoint
- Windows with WSL2, macOS, or a modern Linux distribution with Docker support
- At least 8 GB of RAM and 5 GB of free disk space are recommended for the initial build
The upstream project describes itself as an agent-managed museum exhibit. That phrase is a project self-description, not an independent reliability rating. The installation guide discusses the practical implications of an evolving upstream project, including the possibility of breaking changes and the need to test it before relying on it for important work. This Docker package can reduce some container risks and simplify setup; it cannot provide upstream maintenance, guarantee production readiness, or make model-generated changes safe without review.
claw-code-docker-hardened is an independent, community-contributed deployment layer for Claw Code. It adds Docker configuration, setup and launcher scripts, documentation, and optional skills. It is not Claw Code itself, and its creator is not affiliated with the Claw Code project, Anthropic, or Claude Code.
The short answer: Use this if you want Claw Code's open-source, model-flexible terminal workflow, but do not want to assemble and maintain the Docker setup yourself. This repository gives you a repeatable cross-platform entry point and a visible set of restrictive container defaults. It is a convenience-and-control project, not a claim that Claw Code is the best agent or that Docker makes an agent completely safe.
This project is for a fairly specific preference:
- You want a terminal-first coding agent rather than a web application or a vendor-locked client.
- You value an inspectable and modifiable stack: the harness is open source, and the image, Compose policy, launcher scripts, and setup flow are all in this repository.
- You want to try different supported providers or models, with OpenRouter as a convenient starting point, without rebuilding the deployment workflow for each one.
- You want Docker defaults assembled for you—non-root execution, dropped
capabilities,
no-new-privileges, a read-only root filesystem, and limited writable locations—while retaining the ability to audit and change them. - You prefer a repeatable setup on Windows, macOS, or Linux over manually wiring together an upstream checkout, environment variables, image build, mounts, and launch commands.
The benefit is the combination and the saved setup effort, not a unique security primitive. A devcontainer, Docker Sandbox, native installation, or another agent harness may be a better choice if it is more polished, faster, better supported, or better suited to your workflow.
Choose something else when you primarily want vendor-backed reliability and integration (for example, Claude Code or a Codex client), the fastest native startup (for example, Aider), MCP-centered extensibility (for example, Goose), or a broader platform with web and runtime features (for example, OpenHands). Those are not inferior options; they solve different problems.
Claw Code is an open-source AI coding-agent command-line project written in Rust. The upstream project presents itself as a clean-room reimplementation of ideas associated with Anthropic's Claude Code. That is an upstream description, not a claim that this deployment project created Claude Code or has any relationship with Anthropic. Users should review the upstream repository for its current authorship, license, version, source, and status.
Claw Code includes agent tools and workflows such as command execution, file operations, permission modes, sessions, and skills, subject to the capabilities provided by the selected model and the current upstream implementation. It is an evolving project, so features and interfaces may change. This package does not independently verify every upstream architectural or historical claim.
Attribution: Claw Code belongs to its upstream maintainers. Claude Code is a commercial Anthropic product. This project provides deployment and documentation work around Claw Code only.
The package is intended for users who want Claw Code's terminal-oriented workflow with a more repeatable Docker setup and more restrictive container defaults. It should be viewed as a deployment layer, not as a guarantee that an agent is completely safe or that the upstream project is production-ready.
Security-related additions
- Container boundary: Claw Code runs in Docker rather than directly on the host. The project directory is still mounted into the container, and Docker is not a complete security boundary.
- Reduced privileges: The supplied Compose configuration uses a non-root
clawuser, drops Linux capabilities, adds only the capabilities required by this configuration, enablesno-new-privileges, and makes the container's root filesystem read-only except for declared writable locations. - Smaller runtime image: The multi-stage build leaves the Rust build toolchain out of the runtime image. This reduces unnecessary runtime packages and attack surface.
- Explicit secret handling: Provider settings and the API key are supplied
through a gitignored
.envfile rather than copied into the image. The file remains a plaintext secret on the host and must be protected accordingly.
These are useful defaults, but they are not unique to this project. A user can apply many of the same Docker controls to an open-source or closed-source harness with a hand-written Dockerfile, Compose file, devcontainer, or a purpose-built sandbox. This project’s security value is that several of those controls are packaged and enabled together for this particular Claw Code workflow, rather than that Docker or non-root execution is novel.
Usability-related additions
- Guided setup:
setup-claw.ps1andsetup-claw.shcheck prerequisites, prepare configuration, build the image, and create or use the project directory. - Cross-platform launchers:
claw.ps1andclaw.shwrap Compose with common defaults and flag pass-through. - Persistence: Compose volumes and project mounts preserve configuration, sessions, and project data according to the local configuration.
- Provider convenience: OpenRouter is the default example because one endpoint can expose models from many providers. Direct provider APIs are also supported by the setup scripts.
- Optional skills: The package includes a bundled skills library and installers for additional skills. Its contents can change independently of Claw Code.
The setup scripts and defaults are the main user-experience proposition here: they aim to make a repeatable hardened Docker deployment easier. They are not exclusive features. Devcontainers, Docker Sandboxes, and other projects' installers can provide an equally convenient or more polished experience, and a native harness will usually start faster and involve fewer moving parts.
There is no single best command-line agent harness. The right choice depends on whether you value model choice, native installation, repository editing, tool extensibility, web-based workflows, sandboxing, or a particular vendor's support. The comparison below describes trade-offs rather than ranking projects. Features, licenses, pricing, and security behavior change, so consult current project documentation before relying on any claim.
The open-source/closed-source distinction is mainly about transparency, modifiability, and control, not necessarily about price, quality, or security. With an open-source harness, users can inspect and often modify the harness, self-host it, and add support for providers that the code and license permit. That makes using different hosted providers, local models, or a self-hosted endpoint more practical, although provider integration still depends on the harness and may require configuration. Open source does not mean that the models, inference, provider service, or license are free.
A closed-source harness such as Claude Code or Codex is maintained and shipped by its vendor. Vendor-controlled components may offer a more polished, better-integrated experience and support, while limiting independent inspection or modification and the provider/model configurations users can choose.
Both categories commonly use pay-as-you-go API or subscription pricing. This project does not make inference free: you still pay the selected provider (or run your own endpoint), and OpenRouter has its own prices, routing, limits, and terms. Its practical model advantage is convenience: OpenRouter is a built-in default that makes trying models from multiple providers relatively simple. That is not a unique capability; many open-source harnesses can use multiple providers, but their OpenRouter setup may be less flexible or not ready-made.
Running an agent in Docker is not unique to this project. Claude Code's published devcontainer approach, Docker's agent-oriented Sandboxes, and community devcontainer setups show that both closed-source and open-source harnesses can be run in containers. Those approaches may provide stronger isolation or a better-maintained experience than this Compose configuration, depending on their exact defaults. A devcontainer also often improves reproducibility, but it is not automatically a security boundary: bind mounts, Docker socket access, host networking, credentials, Linux capabilities, and other settings determine what the agent can actually reach.
This project is therefore not claiming unique security primitives or a proven
security advantage over Codex, Claude Code, Aider, Goose, or OpenHands. Its
more modest claim is that it packages a selected set of defensive defaults for
Claw Code: non-root execution, dropped capabilities, no-new-privileges, a
read-only root filesystem, limited writable locations, a multi-stage runtime
image, and explicit .env handling. The defaults are visible and editable in
this repository, which is useful for users who want to audit or change them.
They still require trusting Docker, the image build and dependencies, the
upstream harness, the model/provider, and the configuration. The agent can
modify the mounted project, potentially misuse tools, and be influenced by
prompt injection. Review generated changes, do not mount unnecessary secrets,
and use restrictive permission modes while learning.
Claude Code is a vendor-maintained, closed-source harness. Codex is also vendor-maintained, but the name covers multiple clients and products; consult the specific version's repository and license before classifying it. Their main advantages are vendor integration, polished workflows, and direct access to the capabilities and support offered by their respective providers. This project cannot honestly claim to match their polish, reliability, security engineering, documentation, or maintenance. They can also be run in containers or other sandboxes, so “uses Docker” is not a sufficient reason to choose this project over them.
The main reason (besides possibly pricing) to choose claw-code-docker-hardened instead is control: Claw Code, and this project, are open source, the deployment files are inspectable and modifiable, and the setup for this project is designed around provider flexibility, including a user-friendly OpenRouter default. You can choose a different supported provider or endpoint without adopting a vendor's entire harness ecosystem. If you primarily want the smoothest supported experience with a specific vendor's models, Codex or Claude Code may be the better choice.
Model prices, availability, subscription limits, and benchmark results change frequently. Recheck the linked sources before making a purchasing decision.
Open-source harnesses like Claw Code are pay-as-you-go harnesses: the user supplies an API key and chooses an available model. This makes Claw Code more flexible, since a user can choose any AI model, but does not make it automatically cheaper. A free Codex allowance or an already-paid Claude/ChatGPT subscription can be the least expensive option for a user whose usage fits within its limits.
For an agentic terminal, the most useful accounting unit is billable model tokens per month, not prompts or messages. A single turn can include the user request, repository files, previous conversation, tool output, and generated commands; that context may be sent repeatedly. If available, measure uncached input, cached input, and output tokens from the provider invoice or Claw logs.
| Usage | Total billable tokens/month | Typical work pattern |
|---|---|---|
| Light | Under 2M | Occasional or several-times-per-week questions, summaries, drafting, research, analysis, or small edits |
| Moderate | 2–10M | Regular weekly use, multiple active projects, substantial document analysis, repeated revisions, or frequent tool use |
| Heavy | 10–50M | Daily agent use, long documents or repositories, extended conversations, many tool calls, or recurring workplace/research workflows |
| Very heavy | 50M+ | Full-time agent use, large-context projects, parallel sessions, autonomous loops, or frequent retries |
A complementary task measure is approximately 1–10 completed tasks/month for light use, 10–40 for moderate use, and 40–150 for heavy use. “Task” means a completed unit of work, not one chat turn. Token total is the primary measurement because research, document production, and debugging consume very different amounts.
For a model with input price Pi, cached-input price Pc, and output price Po,
all expressed as dollars per million tokens:
monthly API cost = (input_tokens × Pi + cached_tokens × Pc + output_tokens × Po) / 1,000,000
If the alternative is a subscription costing S dollars per month, and R is
the user’s effective API cost per million tokens, the approximate break-even point is:
break-even tokens = (S / R) × 1,000,000
| Effective API cost | $20/month alternative | $100/month alternative | $200/month alternative |
|---|---|---|---|
| $0.10/M tokens | 200M | 1B | 2B |
| $0.50/M tokens | 40M | 200M | 400M |
| $1/M tokens | 20M | 100M | 200M |
| $3/M tokens | 6.7M | 33.3M | 66.7M |
| $10/M tokens | 2M | 10M | 20M |
This compares cash cost only. It assumes the user would buy the subscription primarily for the agent and does not value bundled features, priority, included usage, or the cost of hitting a usage limit.
Lowest cost per completed terminal task is generally more useful than lowest token price: it reflects success rate and tokens/retries. Lowest raw price is useful for simple extraction, rewriting, summarization, and short research steps, but a weak model can cost more after retries and human correction. A cheap model with poor completion can therefore be more expensive overall.
Use Artificial Analysis Terminal-Bench v2.1 for the former. It covers 89 curated terminal tasks across software engineering, administration, data processing, model training, and security. Use Artificial Analysis Models or OpenRouter Models for live provider prices. These pages are dynamic; the exact top-five lowest-cost-per-task and top-five lowest-raw-price models should be checked at decision time, not treated as permanent README facts. Record model ID, provider, pass rate, input/cached/output prices, and date checked. Calculate:
cost per successful task = (API cost + human correction cost) / successful tasks
Depending on a user's model choice, they could reasonably expect to save money at light to moderately-heavy usage with Open-source harnesses like Claw Code over Codex or Claude Code, especially for casual, academic, and sporadic workplace work. Significant quality can be retained for summarization, extraction, drafting, research assistance, and routine analysis, but the cheapest models should not be expected to match Codex or Claude Code on difficult autonomous coding or long-horizon terminal tasks. Claw’s definite advantage is choice and cost control, not guaranteed lower cost or higher quality.
| Consideration | Aider | Goose | OpenHands | Codex / Claude Code | Claw Code + this project |
|---|---|---|---|---|---|
| Source model | Open source | Open source | Open source | Closed source | Open-source harness plus this deployment layer |
| Primary style | Native terminal editor | Agent with CLI and tools | Broader agent platform | Vendor-maintained agent | Dockerized terminal agent |
| Provider flexibility | Broad, including local configurations | Multiple providers and extensions | Multiple runtime/provider options | Vendor-supported models and accounts | Multiple supported providers; OpenRouter default |
| Docker required by default | No | No | Configuration-dependent | No, but sandbox/container options exist | Yes |
| Isolation model | Host or user configuration | Host/configuration dependent | Runtime and sandbox options | Vendor permissions plus optional sandbox/container setup | Compose hardening |
| Main trade-off | Less packaging isolation | Different setup model | More components | Less inspectability and flexibility | Docker and upstream dependency |
Aider may be preferable for a simple, fast, native repository editing loop. Goose may be preferable for Model Context Protocol-centered tool connections and broader automation. OpenHands may be preferable for a broader web, software development kit, runtime, or multi-agent platform. These projects can also be containerized; their default installation and security model is simply different. None should be described as having no security features merely because this project supplies a hardened Compose file.
The practical niche of this package is a particular combination: a terminal-first Claw Code workflow, inspectable deployment files, a repeatable cross-platform setup, OpenRouter as a convenient starting point, and several restrictive Docker defaults enabled together. That combination may save users time and give them more control, but it is not unique, automatically safer, or necessarily better maintained than the alternatives. Choose it when that combination matters; choose another harness when its workflow, sandbox, provider integration, or maintenance is a better fit.
- Full installation guide:
INSTALLATION_GUIDE.txt - Claw Code repository: https://github.com/ultraworkers/claw-code
- Aider documentation: https://aider.chat/docs/
- Goose repository: https://github.com/aaif-goose/goose
- OpenHands repository: https://github.com/OpenHands/OpenHands
- OpenRouter: https://openrouter.ai
- Docker Sandboxes: https://docs.docker.com/ai/sandboxes/
- Claude Code development containers: https://code.claude.com/docs/en/devcontainer
- Devcontainer security example: https://codewithandrea.com/articles/run-ai-agents-inside-devcontainer/