Turn on the free, opt-in Echo hardened runtime for your NanoClaw agents.
The hardened runtime is free and opt-in. Your existing local-build setup keeps working exactly as it does today. Choosing the hardened runtime is additive, not a replacement.
Every NanoClaw agent runs inside an isolated sandbox container. You can build that image locally from a public base — a 3–10 minute build that you own keeping patched. For supported Claude installs, the fresh-install wizard recommends fetching the hardened image instead.The Echo hardened runtime replaces the local build with a pre-built, patched image. Through the NanoClaw and Echo partnership, Echo rebuilds the sandbox software from minimal components and keeps it patched on its own CVE cadence; NanoClaw delivers it from a gated registry, pinned by digest, so the bytes you run are exactly the bytes that were scanned. NanoClaw is the first open-source agent framework to offer its community a hardened agent environment.The image bakes the sandbox’s essential components:
Runtime and tools — Node 22, Bun, pnpm, git, curl, unzip, and tini
Browser — Chromium, with the fonts and libraries it needs
Agent layer — the agent runner’s dependencies and the bundled agent CLIs, including Claude Code
The pre-built image currently ships for the Claude provider. If you pick a different provider during setup, the installer builds the sandbox locally instead, and a group that later switches providers will prompt before leaving the pre-built image.
Smaller attack surface. Stripping the environment down to essential components takes the known-vulnerability count from thousands to near zero.
Patched for you. Echo rebuilds the image on its own CVE cadence, so patch currency in layers you did not write — OS packages, Chromium, glibc — is no longer your job.
No local build. Fetching swaps the 3–10 minute local build for a single download of roughly 800 MB — typically a few minutes, longer on distant or slow links (it’s served from a single US region). Both paths stay available.
Zero cost. The hardened runtime is free — authenticating with NanoClaw is all it takes. There is no paid tier.
Fully optional. Building locally stays supported, unauthenticated, and untracked.
The hardened runtime greatly reduces exposure to known vulnerabilities. It is not a guarantee against all risk, and no environment is fully immune from attack. Run it as one layer of a broader security posture — it does not replace egress lockdown, mount allowlists, or resource limits, which contain what an agent can do at runtime.
A machine that meets the standard NanoClaw installation requirements.
A NanoClaw sign-in. You authenticate (or sign up) during setup; there is no separate paid plan to purchase.
Agents on the Claude provider (see the note above).
Fetching the image requires authenticating with NanoClaw: your email address and the fact that you fetched an image are recorded. Building locally sends nothing.
The wizard asks “Where should your assistant’s sandbox image come from?”. Pick “Fetch the hardened image, built by Echo” — the pre-selected, recommended choice — instead of “Build it here”.
The wizard's sandbox image choice — the pre-built, patched image is the recommended default.
3
Sign in to NanoClaw
The terminal prints a link and a short code, and your browser opens on its own — if it doesn’t, open the link on any device. The terminal tells you how long the code is good for, and it stops waiting when the code expires, at 15 minutes at the latest.
The terminal sign-in card: the link to open and the code the page will show back to you.
The page asks you to sign in, or sign up:
Sign in with email or a linked account.
Then it shows the code back to you — confirm it matches your terminal:
The browser confirms the code from your terminal.
Done — the terminal picks it up from here.
If authentication doesn’t finish, setup says so and builds the sandbox locally instead — nothing breaks, and you can opt in later.
4
Finish the install
Let the installer finish. It pulls the image by its pinned digest and checks the architecture and agent-runner lock label before tagging it as this install’s sandbox image. Wrong architecture fails. A missing lock label fails unless you explicitly allow an unlabeled image; a mismatched label currently warns and continues, as described below.
The pull accepts a lockfile that does not match your checkout. Every published hardened image still carries the v2.2.0 agent-runner lockfile, so refusing the tag would block every new hardened install. The pull prints Warning: agent-runner lock drift — tagging this image anyway. and continues. Upstream marks this temporary. If an agent then dies on a missing module, build locally with ./container/build.sh build.
That path is fully supported and is not going anywhere. The local build is not deprecated, needs no account, and sends nothing to anyone. If you would rather build and manage the sandbox image yourself, keep doing exactly that. The hardened runtime is simply an additional option.
After setup, confirm what your agents are actually running:
pnpm exec tsx setup/index.ts --step registry
The status report shows:
Image source — how this install gets its image: pull a pinned image or build here
On this machine — what is actually present locally
Pinned — the image reference this install tracks
Signed in as — the account, if any
Perks: the entitlements on the account, listed only when it has any
Docker helper: which registry hosts Docker asks NanoClaw for credentials on, or not installed
Provenance also rides in the image itself: the dev.nanoclaw.image-source label reads hardened for the pulled image, local for a local build, and derived for a per-group image extended on top of the pulled one.
A repin is not merged on trust. A CI workflow re-checks the new digest on every pull request that moves the pin, before the change can reach you.Four checks block the merge:
The reference must be digest-pinned. A mutable tag fails.
The image must be a multi-architecture index covering linux/amd64 and linux/arm64.
The dev.nanoclaw.agent-runner-lock-sha256 label must equal the checkout’s own agent-runner lockfile hash.
The dev.nanoclaw.image-source label must read hardened.
A manifest whose size moves by more than threefold in either direction raises a warning rather than blocking.One more check gates automation only: a keyless Sigstore signature is verified against the digest with cosign verify. An image with no signature does not fail the pull request. It only means auto-merge stays off and a human merges the repin.
No attestation or SBOM is checked, because the publisher attaches none. The workflow verifies the image’s shape and, when present, its signature.
Signing in stores a credential for the registry. Your install can re-check that credential against the account service.An account service it cannot reach keeps the stored sign-in and carries on, so an offline machine still pulls its image. The message names the reason:
Couldn't reach the account service (<reason>); keeping the stored sign-in.
Unreachable is broader than offline. Any response that is not 200, 401, or 403 lands there, including a gateway error. A caller that would rather refuse than proceed unchecked passes --require-verified, which exits 2 instead of 0. Nothing on the image path passes it today.
Signing in for Slack no longer decides your image source for you. That flow signs in through the same script, then puts the image question back: a deliberate local-build choice is restored, and an install that was never asked goes back to unasked. A plain bash setup/registry-login.sh still selects the hardened image.
Yes. The hardened runtime is free and opt-in — authentication is all it takes. There is no paid tier to unlock it.
Do I have to use it?
No. The local build stays fully supported. The hardened runtime is an additional option, not a requirement, and existing installs are not changed unless you opt in.
Does this make my agents impossible to attack?
No. The hardened runtime reduces exposure to known vulnerabilities by stripping the environment down to essential components. It does not remove all risk, and no environment is fully immune from attack. Runtime containment — egress lockdown, mount allowlists, resource limits — still does the heavy lifting.
What software is included?
The essential components of the sandbox:
Runtime and tools — Node 22, Bun, pnpm, git, curl, unzip, and tini
Browser — Chromium, with the fonts and libraries it needs
Agent layer — the agent runner’s dependencies and the bundled agent CLIs, including Claude Code
Who keeps it patched?
Echo rebuilds and patches the image on its own CVE cadence — Echo’s own agents research newly disclosed vulnerabilities, build fixes, run compatibility testing, and open pull requests for human review before anything ships. NanoClaw pins the result by digest and serves it from a gated registry.
Does it work with providers other than Claude?
Not yet. The pre-built image bundles the Claude tooling; installs on other providers build the sandbox locally, and switching a group to another provider prompts before leaving the pre-built image.
Can I still add packages to a group?
Yes. install_packages keeps working — it builds a small per-group image on top of the pulled one. That group’s image then reports derived instead of hardened, since the vendor’s scan covered the base, not your additions.
What gets recorded when I use it?
Your verified email address and the fact and time that you fetched an image. If — and only if — you consent to security and project updates during sign-up, that consent is recorded too — the NanoClaw privacy policy covers what happens to your address. Building locally is unauthenticated and sends nothing.
I already run NanoClaw. How do I switch?
Run bash setup/registry-login.sh from your checkout, sign in, then ./container/build.sh pull. Your install is never switched automatically.
