NanoClaw: An 8-Minute, Container-Isolated AI Assistant Safer Than OpenClaw

Key points

• The OpenClaw security concern — OpenClaw runs 52+ modules, 8 config files, and 45+ dependencies inside one shared-memory Node process. Security is enforced only at the application layer (allowlists, pairing codes), so a single buggy module can expose files, calendars, and messages. This motivated the creation of NanoClaw.
• What NanoClaw is — A lightweight, containerized, AI-native personal AI assistant whose entire codebase can be read in roughly 8 minutes. It replaces application-level permission checks with OS-level container isolation, eliminates configuration files, and ships with WhatsApp I/O, per-group CLAUDE.md memory, a self-chat main channel, scheduled tasks, web access, and Agent Swarms.
• Design philosophy
• *Security through isolation*: agents execute inside Linux containers and can only see mounted directories, so a compromise cannot reach the host.
• *Single-user software*: not a framework, but a working tool each user forks and customizes with Claude Code.
• *Customization by code change, not config*: behavior is modified by editing source or describing changes to Claude.
• *AI-native UX*: no install wizard, dashboard, or debugger — Claude Code handles setup, monitoring, and debugging through conversation.
• OpenClaw vs. NanoClaw at a glance

| Dimension | OpenClaw | NanoClaw | |---|---|---| | Code size | 52+ modules, tens of thousands of lines | Single process, small set of files | | Configuration | 8 config files | None | | Security model | Application-layer checks | OS-level container isolation | | Dependencies | 45+ | Minimal | | Time to understand | Days | ~8 minutes |

• Architecture — A single Node.js process with files such as src/index.ts (orchestrator), src/channels/whatsapp.ts, src/ipc.ts, src/router.ts, src/group-queue.ts, src/container-runner.ts, src/task-scheduler.ts, and src/db.ts. The flow is: WhatsApp (baileys) → SQLite → polling loop → container (Claude Agent SDK) → response. IPC uses the filesystem, and each group has its own concurrency-limited queue.
• Agent Swarms — NanoClaw is described as the first personal AI assistant to support Agent Swarms, allowing multiple specialized agents to collaborate on complex tasks while running in separate containers with isolated contexts.
• Skills instead of features — Contributors add .claude/skills/<name>/SKILL.md files that teach Claude Code how to modify NanoClaw, rather than PR-ing generic features. Examples include /add-telegram, /add-slack, /add-discord, /setup-windows, and /add-clear. Users run the skill on their own fork and get clean, tailored code.
• Getting started — git clone https://github.com/qwibitai/nanoclaw.git, cd nanoclaw, claude, then run /setup. Default trigger word is @Andy; users chat with the assistant, manage scheduled jobs in the self-chat main channel, and request changes directly from Claude Code (or run /customize).
• FAQ highlights — WhatsApp is the default channel because the author uses it (the project is meant to be forked and adapted). Safety comes from container isolation and a small, auditable codebase. There are no config files because each user is expected to shape the code to their needs. Debugging is done by asking Claude Code.
• The bigger thesis — In an era when AI can write code, software should be small enough for humans to fully read, with AI handling customization and extension. Safety comes from isolation, customization from code edits, features from skills, and debugging from conversation.