Containerized agents with 1claw init --docker

1claw init --docker provisions a complete agent runtime inside a Docker container in one command. The important property is what the container does not get: it never receives the agent API key or any LLM provider key. The host daemon injects credentials over a Unix-socket mount, which is the same trust boundary as local daemon mode.

1. 1

   Cloud mode is the default. It provisions an agent with Shroud and the Intents API enabled, a vault, and read policies on secrets/* and providers/*, then wires the chat UI to an LLM through Shroud.

   bash Copy

   1claw init --docker

2. 2

   Run fully offline instead. No cloud account, no LLM: only the /help, /secrets, /info, and /proxy slash commands.

   bash Copy

   1claw init --docker --local

3. 3

   Compose extensions from the bundled module catalog.

   bash Copy

   1claw init --docker --list-modules
   1claw init --docker --module=langchain,onchain

4. 4

   Manage the containers you have created.

   bash Copy

   1claw containers list
   1claw containers logs <name>
   1claw containers stop <name>

5. 5

   Eject to a plain Dockerfile and docker-compose when you want to own the build.

   bash Copy

   1claw eject

The chat UI reaches an LLM through Shroud, and Shroud resolves the provider key from one of three sources in order: the container never holds it:

• 1Claw LLM token billing (default, no key at all): Shroud routes via the Stripe AI Gateway.
• The 1Claw cloud vault: pass --llm-api-key and it is stored at providers/<provider>/api-key for Shroud to fetch.
• A local CLI vault, for BYOK: the daemon injects it as the X-Shroud-Api-Key header.

What this gives you, and what it does not. The container is a strong boundary for credentials and a weak one for behaviour.

• The container never holds the agent key or a provider key. Credentials are injected by the host daemon over a socket mount, so the image can be shared without carrying secrets.
• It does not sandbox what the agent decides to do. A containerised agent with vault access and network egress has the same trifecta profile as any other; isolation of the process is not isolation of its authority.
• Ejecting transfers ownership. Once you have a Dockerfile of your own, the credential-injection wiring is yours to maintain, and it is the part most easily broken by a well-meaning refactor.
• Modules widen the surface. Each composed module brings its own dependencies into the image, which is the supply chain concern in a different wrapper.