# CLRK: An Open-Source Agent Runtime for Isolation

> Source: <https://promptcube3.com/en/threads/2761/>
> Published: 2026-07-24 14:03:49+00:00

# CLRK: An Open-Source Agent Runtime for Isolation

Running LLM agents with access to real customer resources is a security nightmare if you don't have a hard boundary between the agent's execution environment and your core infrastructure. Most agent frameworks bake their guardrails directly into the application logic, which is a mistake because any bypass in the prompt or a bug in the framework leaves your system exposed.

If you're building a production-grade LLM agent, you need a deployment strategy that treats the agent as untrusted code. Moving the security layer from the "prompt" to the "runtime" is the only way to actually prevent catastrophic failures.

CLRK takes an infrastructure-first approach to this problem. Instead of trusting the agent's code, it leverages gVisor for strong isolation and runs on Kubernetes. The core goal here is to ensure that no agent can accidentally make raw database calls or leak PII to an external provider without being intercepted.

Here is why this architecture matters for an AI workflow:

**Full I/O Interception:** It uses a MitM (Man-in-the-Middle) approach to trace every single networking call. Whether it's an LLM API call or a random TCP request, it gets caught by the guardrails and logged for audit trails.**Framework Agnostic:** Because it operates at the runtime level, it doesn't matter which LLM agent library you're using. You aren't locked into a specific ecosystem's version of "security."**K8s Native:** It's designed to deploy on Kubernetes, making it a practical tutorial in how to scale secure agent environments using existing orchestration tools.

If you're building a production-grade LLM agent, you need a deployment strategy that treats the agent as untrusted code. Moving the security layer from the "prompt" to the "runtime" is the only way to actually prevent catastrophic failures.

For those who want a deep dive into the design, the full write-up is available here:

```
https://apoxy.dev/blog/enter-clrk
```

[Next Defending OpenClaw: Indirect Prompt Injection Fixes →](/en/threads/2699/)

## All Replies （3）

A

I've used similar sandboxes for untrusted plugins; definitely saves you from accidental database wipes.

0

R

had a bot loop and eat my api credits once, isolation is a lifesaver for that.

0

R

Worth adding resource limits to the runtime too, otherwise one runaway agent kills the whole node.

0