That's the whole concept. One sentence. Done.
Your M3 Mac is a house. Docker creates apartments inside that house. Each apartment has its own kitchen, bathroom, and electricity — but they're all powered by YOUR house's electricity and water (your M3's CPU and RAM).
What's inside the apartment stays inside the apartment. The agents can decorate their apartment however they want — install Python, build tools, run servers, create databases. But they can't walk out the front door and rearrange YOUR furniture.
They have their own mini operating system (Linux), their own file system, their own internet access. It just happens to be running on your Mac's hardware.
Docker uses your computer's power, but only what it needs at that moment. When agents are idle (waiting for tasks), Docker uses almost nothing. When an agent is actively working, it might use some CPU and RAM — but your M3 Max has power to spare.
| Your Machine | RAM | Can Run Docker + Agents? | Experience |
|---|---|---|---|
| M3 Max (AZ's machine) | 48 GB | Easily | Won't even notice Docker is running |
| M1/M2 MacBook Pro | 16 GB | Yes | Might slow down if running many agents at once |
| M1 MacBook Air | 8 GB | Tight | Works, but close browsers while agents are active |
| Old Intel Mac | 8 GB | Struggle | Possible but slow. Run 2-3 agents max. |
| Windows PC (16GB+) | 16+ GB | Yes | Docker works great on Windows too |
Rule of thumb: If your computer can run Chrome with 10 tabs open, it can run Docker with a few agents.
Docker runs a full Linux operating system. Your agents can do anything a Linux computer can do — which is almost everything.
*GPU passthrough is possible but complex and not needed for our agents
| Agent | What They Build | Lives Where |
|---|---|---|
| SCOUT | YouTube analytics scraper | Docker (web scraping runs fine inside) |
| BUILDER | AZ Editor v2.0 (GUI tool) | Docker to build, Mac to install (needs GUI) |
| BOOST | Auto-post scheduler | Docker (sends API calls to social platforms) |
| RADAR | Google Trends monitor | Docker (scrapes trends data automatically) |
| CLIPPER | Transcript-to-shorts tool | Docker (text processing, no GPU needed) |
| BRIDGE | Auto-translator for 4 languages | Docker (text in, translated text out) |
90% of tools can run entirely inside Docker. Only tools that need Mac-specific features (GPU rendering, GUI apps) need to be installed on your Mac — and that goes through Claude Code review first.
Docker and your Mac are completely separate. But they need ONE way to pass things back and forth. That's the shared folder — like a mailbox between a house and an office.
~/openclaw-shared/tasks//shared/tasks/ (same folder, different path)/shared/results/research-report.md~/openclaw-shared/results/research-report.mdIf there's a door, someone can try to break through it. Here are the three real risks — and how we defend against each one.
What it is: A poisoned website hides invisible instructions inside its text. An agent (SCOUT) copies this text into a research file. Claude Code reads the file. The hidden instructions trick Claude into doing something bad — like revealing API keys or deleting files.
How likely: This is called "indirect prompt injection" and it's one of the biggest unsolved problems in AI right now. It's real. It happens. Big companies are still figuring out defenses.
What it is: BUILDER writes a Python script that looks like a useful tool. But buried deep in the code, there's a hidden line that steals your data, installs malware, or opens a backdoor.
How likely: Low if Claude Code reviews the code. Higher if you auto-run scripts without review. This is why human (or AI) code review matters.
What it is: An agent reads something sensitive inside Docker and hides it in a normal-looking file. For example, encoding passwords inside an image file's metadata, or inside invisible Unicode characters in a text file.
How likely: Very low for our setup. Our agents don't have access to sensitive data in the first place — secrets stay on the Mac side, never in Docker.
Every file that passes through the shared folder goes through multiple checkpoints. No single check is perfect — but together, they catch almost everything.
Files in the shared folder are dead paper until someone actively opens them. A malicious script sitting in a folder does nothing — like a letter bomb that never gets opened. Claude Code decides what to run and when.
Before any file from Docker touches your Mac system, Claude Code reads it line by line. Code gets reviewed for suspicious patterns. Text gets checked for injection attempts. Nothing passes without the gatekeeper.
Your .env file, API keys, passwords, SSH keys — they never go in the shared folder. Agents get sanitized variables (like "API key is set: true") instead of actual values. Even if hacked, there's nothing to steal.
Only safe file types pass through the door: .py, .md, .txt, .json, .csv. No executables (.exe), no binaries, no files that auto-run on open. If BUILDER tries to pass a .sh script, it gets flagged.
Oliver's job includes security monitoring. He checks every file agents put in the shared folder. Unusual patterns? Files that are too large? Unexpected file types? Oliver flags them before they reach Claude Code.
Every single file written to the shared folder is logged: WHO wrote it, WHEN, and WHY. If something goes wrong, you trace back through the log to find which agent did what. Like security cameras for the mailbox.
Docker can be deleted in one command. If anything looks suspicious — you type docker stop and the entire apartment disappears. All agents, all their files, everything. Your Mac is untouched. It's like having an ejection seat. The apartment burns, the house survives.
Then you rebuild from scratch. Docker images are like blueprints — you can recreate the apartment in minutes, clean and fresh.
Let me be real with you. Prompt injection is an unsolved problem across the entire AI industry. OpenAI, Anthropic, Google — nobody has a perfect defense yet. It's like the early days of email when spam filters didn't exist. We're building the filters right now, in real-time.
What we CAN do is make it extremely hard to exploit:
Each defense has holes (like Swiss cheese). But when you stack multiple layers, the holes don't line up. To get through ALL defenses, an attacker would need to:
Each layer alone is imperfect. Together? An attacker would need to win the lottery 5 times in a row.
Never put secrets in the shared folder. No API keys, no passwords, no tokens, no .env files. The shared folder is for tasks and results — nothing sensitive. If the door gets broken, there's nothing valuable on the other side.
This one rule prevents 90% of possible attacks.
docker stop = apartment gone. Mac untouched. Rebuild in minutes.Docker is a cage for your AI agents. They work inside it. They build inside it. They can't escape. The one opening (the shared folder) has a security guard (Claude Code) checking everything that passes through. And even if the cage breaks — your computer is fine. You just build a new cage.
That's it. That's Docker. You didn't need a computer science degree to understand it.
"I don't know what I'm doing. But I'm doing it anyway. Follow along."
11 AI employees. Living in a cage. Building tools 24/7. On a laptop in a parking lot.
@AZ_Rollin | March 2026