NanoClaw review: the container-first OpenClaw alternative

NanoClaw started as an answer to a specific complaint about OpenClaw: too much code, and an agent that runs commands on your host by default. Its answer is a small TypeScript project where one host process routes messages and every agent lives in its own Linux container, seeing only the folders you mount. It launched on January 31, 2026, is MIT licensed, and had 31,096 GitHub stars when we checked on November 8. The trade is that it leans on Claude and Claude Code for almost everything.

Who it suits

NanoClaw fits developers who want an OpenClaw-style agent in WhatsApp, Telegram, Slack, Discord or iMessage, care about isolation more than ecosystem size, and are happy to have Claude Code edit their fork. If you want to configure things by editing a settings file, or you don’t use Claude Code, it will feel backwards.

Setup: plan for an hour

The quickstart is honest about effort: “Plan for 30–60 minutes.” You need a Mac or Linux machine with at least 4 GB of memory (Windows through WSL2) and Git. Then:

git clone https://github.com/nanocoai/nanoclaw.git
cd nanoclaw
bash nanoclaw.sh

The script installs what’s missing (Node, pnpm and Docker), and then walks through a fixed sequence:

1. Sandbox image. Build it locally (the default, contacts nothing) or fetch a prebuilt hardened image from its partner Echo, which needs a free NanoClaw account.
2. Credentials. It installs OneCLI, a vault for your model sign-in, and you connect Claude, Codex or an API key. The guide assumes a Claude Pro or Max subscription.
3. Folder access. You choose which extra folders an agent may see. On a fresh install, that list is empty.
4. Background service and a test message.
5. Optionally, a chat channel. Telegram goes through @BotFather and a pairing code, Slack can create the app for you, and WhatsApp links as a device by QR or pairing code.

That’s more steps than OpenClaw’s installer, but every one of them is a security decision made up front instead of left for later.

Isolation: containers and a credential vault by default

Shell access never touches your host: each agent runs in its own container and sees only what you mount. The less obvious part is credentials. Agents don’t hold raw API keys; outbound calls go through a credential gateway with per-agent policies and rate limits. A prompt-injected agent can misuse access it has, but it can’t read out and leak a key it never sees. NemoClaw takes a similar approach, holding credentials outside its sandbox.

Docker is the boundary, so Docker is a hard requirement, and the machine must stay on and connected for the agent to answer.

Telemetry

NanoClaw has no user accounts of its own (the optional one is only for the hardened image) and trains no models. It does send anonymous setup diagnostics by default; set NANOCLAW_NO_DIAGNOSTICS=1 to stop them. If you fetch the hardened image, that account records your email and when you fetched it.

Customizing: no config files, by design

This is the decision that defines NanoClaw. There’s nothing to configure; to change behavior you ask Claude Code to change the code in your own fork, and new channels (Teams, Matrix, Google Chat, Signal, WeChat, email and others) arrive as /add-<channel> skills that Claude Code applies. Other model providers work the same way: OpenCode, Codex and Ollama are added per agent through skills.

The upside is a codebase small enough to read, and a setup that’s exactly what you asked for. The downsides are real for a self-hoster:

• The more your fork changes, the more pulling upstream updates becomes a merge rather than an upgrade.
• Debugging and changes go through Claude Code, which itself needs a model subscription or key.
• Two installs of NanoClaw may behave quite differently, so community answers apply less directly.

Models and cost

Claude is the default, through Anthropic’s Claude Agent SDK, so the realistic running cost is a Claude subscription or API usage. Local open-weight models through Ollama are possible via the skill, which takes the model bill to zero at the cost of capability. Scheduled tasks help here: they can run a script gate first and skip waking the agent when there’s nothing to do, which saves tokens on frequent checks.

How it compares

• OpenClaw: 29 chat channels, 142 official plugins and a normal config file, but tools run on the host until you turn on its sandbox. See NanoClaw vs OpenClaw.
• ZeroClaw: also sandboxed by default, as one Rust binary with no Docker needed and no telemetry by default.
• NemoClaw: wraps OpenClaw or Hermes in a sandbox with network approvals, but is alpha and heavier.
• Rakazo: container per bot computer too, aimed at several always-on bots with a web and mobile app.

More options are on OpenClaw alternatives.

Verdict

NanoClaw has one of the strongest isolation stories among the lightweight agents: containers per agent, an empty folder allowlist, and keys the agent never holds. The price is lock-in to Claude Code as your config tool and a fork you have to maintain. If you’re already living in Claude Code, that price is low; otherwise, pick an agent you can configure without one.