Clawsolator is designed to combine proven upstream technology into a deliberate, owner-controlled setup sequence: inspect, install, connect, isolate, and verify.
No agent should need host root access just to finish onboarding. Where privileged host changes are needed, the operator—not the model—must decide.
Proposed product presentation shown here: actual supported actions depend on the installed OpenClaw and host versions.
Detect OpenClaw version, existing Gateway, active services, identity boundaries, hardware and supported Podman capabilities.
Preview changes, protect existing state, avoid duplicate tunnels or overwriting foreign resources.
Configure Cloudflare Access for protected browser access; use Tailscale for private paths where applicable. Verify TLS and authentication separately.
Provision or select session-scoped rootless Podman environments, bound workspaces and narrow tool privileges.
Read back actual settings, container identity, isolation and network path; store diagnoses and provide recovery.
An interactive illustration of the XMAN policy path. This browser demo does not run Podman or connect to the actual daemon.
request.received identity verified waiting for evaluation_
Automatic CPU/RAM policy is not the same thing as granting root. The planned privileged executor would remain a separate, small, explicitly authorized host service.
Request preparation, commit, daemon policy, live resource adjustment, Podman readback and durable outcome reporting.
DEMONSTRATED IN A LIMITED LIVE TESTImmutable script staging, independent human authentication, one-use signed authorization, host-bound execution and crash reconciliation.
ARCHITECTURE / NOT YET SHIPPEDAdditional scoped monitors could identify runaway work, enforce pause/containment controls, and reconcile interrupted operations.
ROADMAP / NOT VERIFIEDThe security system must become more disciplined as autonomy increases.
Identify the host, users, network reachability, data sensitivity and which actions agents are actually permitted to perform.
Use reviewed Cloudflare Access or Tailscale patterns, confirm TLS and pairing, and keep the gateway off the unrestricted public internet.
Verify rootless runtime constraints, deny a disallowed operation, review a sensitive request and confirm an allowed resource change by readback.
The agent proposes a scoped request. XMAN compares it with an approved policy and resource budget. Routine compliant actions can proceed; exceptional requests require operator review or are rejected. The manager then verifies the resulting runtime state and records an audit trail.
Rootless Podman gives containers user-scoped execution rather than ordinary host-root power. Resource restrictions, network boundaries, writable mounts and credentials still require careful configuration. Rootless alone is not a complete security system.
They can provide protected access and private network paths for supported deployments. They do not replace agent sandboxing, least-privilege tool permissions, approval workflows or auditing.