Article URL: https://github.com/mathaix/OpenClawMachines Comments URL: https://news.ycombinator.com/item?id=48896179 Points: 9 # Comments: 6

OpenClaw Machines is an open-source platform for running OpenClaw in secure AI sandboxes on your own infrastructure. A control plane orchestrates your hosts, and each agent runs in its own Firecracker microVM on them — hardware-isolated, safe for untrusted and agent-generated code. A Cloudflare data plane is the front door: every machine gets its own subdomain behind edge auth, reached through a tunnel that terminates inside the VM — no host port is exposed for user-to-VM traffic. The current control plane still needs private or firewall-restricted access to each agent's authenticated control API on 9090. See it running at openclawmachines.com. Click the screenshot to watch the 43-second demo on YouTube. This is a linked image, not an embedded player. The demo covers host onboarding, agent spin-up, the running Firecracker VM terminal, workspace MCP integrations, and an agent tool call end to end. OpenClaw Machines is the fourth option: rent one bare-metal server (OVHcloud, Hetzner, …), point OpenClaw Machines at it, and spin up as many hardware-isolated OpenClaw instances as the box will hold. One agent or fifty — the cost stays one flat server. In short: the managed route is easiest but priced per agent; local and VPS are cheap to start but don't isolate or scale well. OpenClaw Machines trades a little more setup for the best economics and isolation once you're running more than a couple of agents — one server, many hardware-isolated agents, all yours. OpenClaw Machines turns your own Linux servers into a pool of secure, on-demand sandboxes. Each sandbox is a real Firecracker microVM (its own kernel, hardware-isolated via KVM) that runs one AI agent. The platform is the control plane that creates those VMs, keeps track of them, routes traffic to them, and tears them down — so you can run many untrusted agents safely on infrastructure you own. Think: a mini-cloud for AI agents, that you self-host. The full design — data plane, routing, tunnels, lifecycle, config, and the build/release flow — is in docs/architecture.md, and the five-layer stack (React UI → Cloudflare edge → Go control plane → host agents → Firecracker sandboxes) is in docs/tech-stack.md. OpenClaw Machines runs Firecracker microVMs, which require KVM. You need a KVM-enabled Linux host: bare metal, or a cloud VM with nested virtualization enabled. It does not run on macOS, Windows/WSL, or a standard cloud VM without nested virtualization.