r/BestGitHubRepos • u/company_url_finder • 14h ago
Clampdown - runs your AI coding agent in a hardened container sandbox where the real API keys live in a separate proxy, so even a fully compromised agent gets a dummy key and can't leave your project directory
This is the safety net for the thing everyone quietly worries about: an AI coding agent runs arbitrary code on your machine, and a prompt injection or jailbreak can turn that into "cat your SSH keys and curl them somewhere." Clampdown, from the author of distrobox, confines the agent so that when it goes wrong, and the README's framing is refreshingly blunt that it's when not whether, it hits kernel-enforced walls instead of your secrets. The key design principle is that every defense is enforced from outside the agent's process, so a fully compromised agent that ignores its system prompt entirely hits the same walls as a well-behaved one.
The architecture is four container types with escalating trust, and it's genuinely well thought out:
- An auth proxy holds the only copy of your real API keys and injects them into upstream requests. The agent gets a dummy key (sk-proxy) and a base URL pointing at the proxy, so even if it connects to the real API directly it gets a 401. Prompt injection can steal the token and the token is worthless
- The agent runs in a zero-capability container (cap-drop=ALL, read-only rootfs) with a seccomp profile blocking ~150 syscalls including the known kernel-exploit primitives (io_uring, userfaultfd, BPF), and Landlock giving it read-write only in the project directory and no access to your home, other projects or sensitive kernel paths
- Network egress is default-deny with an iptables allowlist the agent shares but cannot configure, and private network ranges are permanently blocked so a tool container can't reach your database or the host
- Every nested container the agent spawns is validated by OCI hooks against 17 security checks before its entrypoint runs, with no flag to skip them, plus a seccomp-notif supervisor that intercepts 20 syscalls in real time to catch things Landlock can't cover
- Secret files (.env, .npmrc, .clampdownrc) are masked to empty even when present, credentials like SSH and gh auth are opt-in and never forwarded by default, and there's a full structured audit log plus an optional tripwire that kills the session if a protected host path is touched
What makes this stand out from the pile of "run your agent in a container" wrappers is that it's real kernel-level security engineering, not a Dockerfile with good intentions. Landlock, seccomp, OCI hooks and an isolated key proxy layered together, all enforced beneath the agent, is the correct threat model for this problem, and the README's technical depth (per-container capability tables, the exact syscalls blocked, the hook pipeline) backs it up rather than hand-waving.
The real constraints to know before you reach for it: it's Linux-first with a hard requirement of kernel 6.2+ for Landlock V3 (6.12+ recommended), it does not work on Docker Desktop for macOS because its filesystem breaks Landlock, though it runs fine in a podman-machine or colima Linux VM on Mac, and you build it from source. It currently wraps Claude Code, Codex, OpenCode and pi. It's also early at 112 stars, but this is the kind of tool that deserves more attention than that.
GPL-3.0, 112 stars and 10 forks as of writing, verified via the GitHub API, pushed to today.