Docker locks OpenClaw inside a local sandbox

OpenClaw is an open-source AI coding agent, and Docker just showed how to run it safely by locking it inside Docker Sandboxes micro VMs. It lets the agent generate and edit code without letting it touch your personal files, run wild commands on your host, or ping unknown servers.

Even better, Docker hooked it directly into Docker Model Runner. You can run open-source models completely offline on your own hardware, dodging both cloud API bills and the fear of leaking sensitive keys.

What it actually does

Letting an autonomous coding agent loose on your laptop has always been a gamble. Give it too little access and it breaks; give it terminal access and you risk corrupted systems or leaked credentials. Docker Sandboxes isolates the agent inside a lightweight micro VM. OpenClaw can only read and write inside the specific workspace folder you mount to it.

Network traffic is guarded just as tightly. A built-in network proxy blocks requests to untrusted outside hosts. If you choose to run proprietary cloud models like Claude or OpenAI, you do not even paste your keys into OpenClaw. The host proxy automatically injects keys into outgoing requests, meaning the agent never actually sees the raw credentials inside the sandbox.

For offline work, Docker Desktop handles the model weights via Docker Model Runner on your host machine. OpenClaw runs in the micro VM, issues coding tasks, and chats with the local model without sending a single packet out to the public internet.

How to set it up

Getting started takes just a few terminal commands, provided you have Docker Desktop with Docker Model Runner turned on in settings. Docker provided a ready-made image with Node 22 and OpenClaw pre-installed.

First, pull an open-source model to your host machine using docker model pull, such as ai/gpt-oss:20B-UD-Q4_K_XL or Qwen 2.5 models. Any local model you pull can be discovered automatically.

Next, spin up the sandbox and configure its network proxy to permit access to localhost so it can see the host runner. Once inside the sandbox terminal, firing up the bundled start-openclaw script launches the terminal interface and auto-detects your downloaded models.

The clever engineering trick here is a tiny twenty-line Node.js bridge. OpenClaw runs on Node.js, which famously ignores standard HTTP proxy environment variables. To keep OpenClaw from failing to reach the host runner, the bridge listens locally on port 54321 and cleanly routes agent requests through the sandbox proxy to the host machine.

Why it matters

If you want an autonomous agent tackling real pull requests but hesitate to give an LLM unmonitored shell access, this is the sandbox setup you should test. It eliminates the manual headache of writing isolation layers and configuring firewall proxies just to test an agent.

We think Docker nailed the real friction point here. Open-source local models are now capable enough to write decent code, meaning the real bottleneck has shifted to security and runtime containment. Wrapping AI agents in lightweight micro VMs with credential protection might quickly become the baseline setup for developers coding locally.