Red Hat principal software engineer Sally O'Malley released Tank OS on Tuesday, an open source tool that wraps OpenClaw agents inside a rootless Podman container running on Fedora Linux. The project is aimed at power users running OpenClaw locally and at IT teams that will eventually manage fleets of corporate OpenClaw agents. O'Malley is one of the maintainers of OpenClaw itself, working alongside creator Peter Steinberger to decide which features and bugs get prioritized.
OpenClaw, the open source project that installs an AI agent on a local computer, has spawned a growing ecosystem of wrappers, alternatives, and security tools. NanoClaw is building a comparable container-based isolation layer using Docker. Tank OS differentiates itself by leaning on Podman, an open source container runtime built at Red Hat that runs without root privileges on the host machine.
"This was a fun project that I put together on the weekend that I knew would be a really good fit for AI and where we're going," O'Malley told TechCrunch, saying she wanted to deliver it "to the masses." She joined OpenClaw because she sees the project as a way to "enable everyone to run AI in a safe way, that's open."
Key facts
- 01Red Hat principal engineer Sally O'Malley released Tank OS on Tuesday as an open source way to deploy OpenClaw agents safely.
- 02Tank OS runs OpenClaw inside a rootless Podman container on Fedora Linux, packaged as a bootable image.
- 03O'Malley is one of the OpenClaw maintainers working with creator Peter Steinberger, who was hired by OpenAI but still leads the independent project.
- 04Users can run multiple Tank OS instances on one machine with no shared passwords, API keys, or access between agents.
- 05Competing container approach NanoClaw is building a similar isolation layer using Docker.
The mechanics are straightforward for anyone comfortable with Linux. Tank OS loads OpenClaw into a Podman container on Fedora and turns that container into a bootable image, so the agent launches when the computer starts. The package includes the state layer that lets the agent remember context, encrypted storage for API keys, and the other plumbing an autonomous agent needs to run without a human babysitting it.
“Tank OS loads OpenClaw into a rootless Podman container on Fedora Linux as a bootable image, so each agent runs without privileges on the host machine.”— Jaeden Schafer
The isolation story is the point. Because Podman is rootless, the container inherits no privileges from the host, so a misbehaving OpenClaw instance cannot reach into the rest of the machine. Users can run several Tank OS instances side by side, each with its own credentials, and no instance can read another's secrets or files.
That matters because OpenClaw, like every browser-and-filesystem agent, has a track record of going off the rails. O'Malley pointed to a Meta AI security researcher whose Claw began deleting her work email, and another case where an agent dumped a user's entire WhatsApp DM history in plain text. A small malware industry has already sprung up to target OpenClaw users directly.
"It's an incredibly powerful application," O'Malley said, but it can be "dangerous if not configured properly." She added that OpenClaw is "not a tool that you can use easily unless you do have some sort of technical experience," and Tank OS does not change that — installers still need to be comfortable maintaining software on their own machines.
The enterprise angle is where Red Hat's interests show through. Tank OS lets IT pros update OpenClaw agents using the same container workflows they already run for other software, which matters once a company is pushing the agent to thousands of laptops. "My role within OpenClaw is really my interest in it," O'Malley said. "How it's going to look scaled out when there are millions of these autonomous agents talking to one another."
There are caveats. Tank OS does not solve the underlying agent-safety problem; it only contains the blast radius when an agent does something destructive. Steinberger, who was hired by OpenAI but continues to lead the independent OpenClaw project, has his own roadmap for hardening the core agent, and many of the high-profile failures so far happened because the agent was given more permissions than it needed, not because the host was poorly isolated.
Still, Tank OS is the kind of work the agent boom needs more of. The interesting questions in 2026 are no longer whether a model can use a computer — they are how to deploy ten thousand of those agents inside a regulated company without giving each one a key to the kingdom. A Red Hat maintainer shipping a rootless, bootable container image is a more honest answer to that question than most of the agent-orchestration pitches currently raising rounds.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
