Show HN: Clawk – Give coding agents a disposable Linux VM, not your laptop

Re:Show HN: Clawk – Give coding agents a disposable Linux VM... by vqtska on Monday July 13, 2026 @11:04AM (#48893839)

What kind of things are you even doing that the agent would try to perform a kernel exploit on you? I thought sandboxing is just to protect from the agent accidentally clearing your home directory.

Side note, just 6 days ago a Linux VM escape exploit was disclosed.

[ Parent | on HN ]

Re:Show HN: Clawk – Give coding agents a disposable Linux VM... by matheusmoreira on Monday July 13, 2026 @11:12AM (#48893956)

I'm not worried about the agent at all. The VM is there to prevent it from clobbering files on my real system.

I'm worried about supply chain attacks on npm, pip, cargo and everything else. Don't want to get compromised if I install some stupid package.

My virtdev project has essentially split my computer into two systems: my "real" trusted system with software coming directly from my Linux distribition's repositories, and the VMs for everything else.

> just 6 days ago a Linux VM escape exploit was disclosed

Well, shit. Details?

[ Parent | on HN ]

Re:Show HN: Clawk – Give coding agents a disposable Linux VM... by SoftTalker on Monday July 13, 2026 @11:51AM (#48894559)

> npm, pip, cargo and everything else

All that stuff should also go into the agent user's home directory.

[ Parent | on HN ]

Re:Show HN: Clawk – Give coding agents a disposable Linux VM... by rvz on Monday July 13, 2026 @11:41AM (#48894399)

CVE-2026-53359 - https://github.com/V4bel/Januscape/blob/main/assets/write-up...

CVE-2026-43499 - https://nebusec.ai/research/ionstack-part-2/

[ Parent | on HN ]

Re:Show HN: Clawk – Give coding agents a disposable Linux VM... by matheusmoreira on Monday July 13, 2026 @12:23PM (#48894973)

Patched in Linux 7.1.3, which happens to be the exact kernel version I'm running. Update your kernels, folks.

[ Parent | on HN ]