Show HN: Clawk Gives Coding Agents a Disposable Linux VM Instead of Your Laptop

GitHub / Hacker News·high signal

Clawk (422 GitHub stars, pre-1.0 Go) mounts your repo into a throwaway Apple-silicon Linux VM, restricts outbound traffic via an allow-list, and forwards your SSH agent — so agents like Claude can install packages and run code without touching your files, keychain, or host. It emphasizes hypervisor-level isolation over process sandboxing, landing 210 points and 154 comments. It's part of a fast-forming pattern of VM-level blast-radius containment for autonomous coding agents.