clampdown CLI
Claude Code, Codex, OpenCode and pi run in a hardened container: project files only, allowlisted network, keys held by a proxy.
- 130 ★ on the repository
- Last commit
Broad access
Why this level
- A proxy container stores real API keys for Anthropic, OpenAI and other providers.
- The sidecar runs with extended privileges and controls networking and containers on the machine.
Install
- Works in
Manual install
git clone https://github.com/89luca89/clampdown
cd clampdown
make all
make installThe README Install block: the commands build images and put the binary in `~/.local/bin/clampdown`.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- A proxy container stores real API keys for Anthropic, OpenAI and other providers.
- The sidecar runs with extended privileges and controls networking and containers on the machine.
This is third-party code. Review the repository files before installing.
What it does
clampdown runs a coding agent inside a container sandbox and treats the agent process itself as untrusted. File access is limited to the project working directory, outbound network is closed by default and opened only for the APIs the agent needs, and every tool container the agent spawns gets the same restrictions. The agent never sees real API keys. A separate proxy container with no shell and no writable filesystem holds them, and the agent receives a dummy `sk-proxy` key and the proxy address. Landlock, seccomp and iptables rules apply from outside the agent process, so they hold even if the agent ignores its instructions. Four agents are supported: `clampdown claude`, `clampdown codex`, `clampdown opencode` and `clampdown pi`. Every session writes a structured audit log.
Who it is for. Developers on Linux or macOS who do not want an agent to reach their home directory, SSH keys and private networks while it runs arbitrary commands.
Good fit when
- An agent reads a third-party repository and prompt injection cannot be ruled out.
- Anthropic or OpenAI keys must stay out of the agent process environment.
- An agent has to build and test a project in containers without reaching private networks.
- A log of API requests and events is needed after a session for incident review.
- The same isolation approach is wanted for Claude Code, Codex and OpenCode.
Not a fit when
- A macOS machine with Docker Desktop: its filesystem breaks Landlock and the tool does not support that setup.
- A Linux kernel older than 6.2 that cannot be upgraded.
- A quick edit that should skip image builds and containers: a session starts heavier than a plain agent launch.
Example request
Launch Claude Code in a clampdown sandbox for this project and show which domains it contacted during the session.Limitations
Installation is from source: `make all` builds six images and the launcher binary, and the build needs Go 1.23. The Linux kernel must be 6.2 or newer because Landlock V3 is mandatory, and 6.12 is recommended for the full set of protections. The launcher refuses to start with unsafe sysctls such as `kernel.kptr_restrict` or `vm.unprivileged_userfaultfd`. Rootless podman or Docker is required. On macOS use podman machine or colima, not Docker Desktop. A ChatGPT subscription for Codex is copied from `~/.codex/auth.json`, and Bedrock and Vertex in pi do not go through the proxy. The sidecar runs privileged, so protection rests on its correctness.
How to disable. Stop a session with `clampdown stop -s <session id>`, remove its containers with `clampdown delete -s <session id>` and clear the project cache with `clampdown prune`. The binary is at `~/.local/bin/clampdown`.
FAQ
How do I install clampdown?
Clone the repository and run `make all`, then `make install`. The binary appears at `~/.local/bin/clampdown`. The README lists no prebuilt packages.
How does the agent reach the API without a key?
The agent sends requests to a local proxy with the `sk-proxy` placeholder, and the proxy injects the real key and forwards the request to the provider. A direct API call with the placeholder returns 401.
How do I leave a session and return?
Press `ctrl+]` and the session keeps running in the background. Return with `clampdown attach -s <session id>`, and `clampdown list` shows the sessions.
Which network does the agent see?
Only allowlisted domains the agent itself needs. Tool containers have public internet access, but private subnets are closed to them. Both policies are configurable with `--agent-policy` and `--pod-policy`.
Does clampdown work on a Mac?
Yes, through podman machine or colima: containers run in a Linux VM with the full set of protections. Docker Desktop is not supported.
Discussion
No questions or reviews yet.
Related
CLI toolsThe safehouse command runs Claude Code, Codex and other agents in a macOS sandbox: files are closed by default and you open folders with flags
Container-free sandbox for AI agents on Linux and macOS: files, network and syscalls stay closed until you open them explicitly
A local dashboard for Claude Code, Codex CLI and OpenCode: what the agent loads, its token cost and an MCP server security scan
cli sandbox for ai agents without containers or daemons: runs Claude Code, Codex, or OpenCode with restricted access to files, network, and credentials
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A pack of about fifty Claude Code subagents for authorized pentesting: planning, recon, exploit research and chaining, post-exploitation, detection and reportin
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| clampdown (this card) | no | 130 | |
| nono | no | 4,872 | restricts an agent without containers or daemons; clampdown builds containers with a key proxy and checks nested launches |
| Agent Safehouse | no | 2,136 | uses the macOS sandbox; clampdown relies on Landlock, seccomp and iptables on Linux and reaches Mac through a VM |
README in short
The threat model section assumes an agent can be hijacked through prompt injection or a jailbreak, so protection must work outside its process. It then describes four container types (sidecar, proxy, agent, tools), Landlock and seccomp settings, network policies, configuration through `config.json` and `.clampdownrc` and the audit log format.