OpenClaw Machines enables organizations to run isolated OpenClaw agents in secure AI sandboxes on self-owned infrastructure. With a control plane that orchestrates hosts and Firecracker microVM technology, it ensures hardware isolation and safety for untrusted code. Leverage Cloudflare's data plane for secure access without exposing any ports.
OpenClaw Machines is an open-source platform designed to run OpenClaw within secure AI sandboxes on user-owned infrastructure. This innovative solution allows for the management of multiple isolated OpenClaw agents efficiently, leveraging a control plane that orchestrates hosts while each agent operates in a Firecracker microVM, ensuring hardware isolation that secures untrusted and agent-generated code. Furthermore, a Cloudflare data plane acts as a secure access point, assigning each machine its own subdomain with edge authentication and routing through a tunnel that stays entirely within the VM, minimizing exposure to the host.
Key Features:
- Control Plane: A Go API managing accounts, machines, and hosts, backed by Postgres for reliable storage and configurations, along with capabilities for placement, lifecycle management, and backups.
- Host Agent: This component (
ocm-agent) manages Firecracker microVMs on Linux boxes, handling networking and root filesystem preparation.
- LLM Proxy: Facilitates tracking and managing model keys across providers, ensuring flexibility and efficiency in model utilization.
- OpenClaw Runtime: Comprises essential in-VM components such as authentication proxy, web-chat gateway, live terminal, and streamlined artifact handling for runtime upgrades.
- Workspace Integrations: Natively connects tools from GitHub, Google Workspace, and others to the OpenClaw agents through a unified interface.
- Build Pipelines: Comprehensive builds for every component, enabling straightforward integration and provisioning.
Advantages:
- Security: Achieve real isolation with one microVM per agent, enforcing stringent authentication protocols both at the edge and confined within VM environments.
- Cost-Effective: Operate as many hardware-isolated agents as your server allows, minimizing costs to a single flat rate for server rental, in contrast to per-agent payment models.
- Sovereignty: Maintain control over hardware, data, and access keys, utilizing the configuration that suits individual or organizational needs.
- Open Source: Features an Apache-2.0 licensed core and its CLI tool (
ocm), inviting contributions and fostering community collaboration.
- Enterprise Ready: Supports multi-user accounts and admin-level management, with security and capacity policies that scale across various users and teams.
- Ecosystem Integration: Efficiently automate browser tasks with dedicated VMs, ensuring observability through OpenTelemetry, while supporting built-in snapshots for data safety.
Comparison with Other Options:
- Local Hardware: Runs on your own devices with limited isolation.
- VPS: More accessible but not isolated, resulting in shared resources.
- Managed Service: Easiest to set up but incurs higher costs with limited control.
OpenClaw Machines presents a balanced alternative that combines cost efficiency, robust isolation, and full control over the infrastructure, enabling users to scale freely while ensuring security.
Project Resources:
- Getting Started Guide - A comprehensive three-stage guide to deploy and manage OpenClaw effectively.
- Documentation - Detailed usage instructions for day-to-day operations, including chat, terminal management, and model integration.
- Community Support - Engage with users, explore discussions, and seek assistance in a collaborative environment.
