name: openclaw
description: Local-first personal AI assistant
snapcraft: openclaw-snap/snap/snapcraft.yaml at main · kenvandine/openclaw-snap · GitHub
upstream-relation: I only maintain the snap packaging. I am not involved with the upstream project.
supported-category: agent/assistant that runs arbitrary user-directed code and needs to reach files and programs that aren’t known at build time (same bucket as shells and coding assistants).
reasoning:
I package openclaw, a local-first AI agent that does work on the user’s machine for them. In practice it edits files wherever it’s pointed, runs shell commands, drives a browser, and calls whatever tools and language runtimes are already installed. It bundles its own Node.js and a Chromium build, but most of what it actually touches is chosen by the person using it, not by me.
That is why strict confinement doesn’t fit. I can’t predict which files it reads or which programs it runs, because that comes down to the user’s prompts and any skills they add later. There’s no interface, or combination of them, that means “let it open any path and run any binary the user could run themselves”. I ran it under strict and watched snappy-debug, and the denials never settled into a fixed list; they just kept coming for new paths and exec targets. home, system-files and personal-files can’t enumerate arbitrary absolute paths, and nothing grants arbitrary execve of host binaries, which an agent like this needs by design.
So it’s published as classic, the same way other AI agents and “run whatever the user asks” tools are handled.
On isolation: classic means the agent can do whatever the person running it can do. Because of that, the docs recommend installing and running it inside an LXD container rather than directly on the host. That keeps the broad access inside a boundary the user sets up themselves (throwaway filesystem, limited network, nothing reaching the rest of their data), while the agent can still use whatever tools and files it needs inside that container. Strict confinement would just break the agent and give weaker guarantees than containing it properly anyway.