A walkthrough describes running Open Claw, an open-source autonomous AI agent controllable via chat apps like Discord, WhatsApp, Signal, or Telegram, so it can raise pull requests and perform tasks. The agent runs in a locked-down Linux container with dropped capabilities, no root or filesystem access, and only scoped tools like Git and GitHub CLI. To keep it running when away from a personal machine, the setup migrates the container into a Kubernetes cluster using a kind cluster, official Open Claw Kubernetes manifests customized for a secured image, a Kubernetes secret for tokens, a dedicated namespace, and a config map, with a full companion video linked separately.
Questions this post answers
How do I run an autonomous AI agent like Open Claw securely in a container?
Run it in a Linux container with all capabilities dropped and least privilege enforced, so it has no root access and no filesystem access beyond what it needs. Only expose specific tools it requires, such as Git and the GitHub CLI, and pass credentials as a scoped API token rather than broad access, limiting what the agent can actually do. daily.dev surfaces practical guidance for developers securing self-hosted AI agents like this.
How do I deploy an Open Claw AI agent to a Kubernetes cluster?
Create a kind cluster, then use the official Open Claw Kubernetes manifests as a base, customizing them to deploy your own locked-down container image. Create a dedicated namespace, add a Kubernetes secret containing the gateway token, model provider token, and channel token (for example Discord), and apply the manifests with kubectl so the config lives in a config map. Track step-by-step Kubernetes deployment workflows like this one on daily.dev while building your own agent setup.