Knowledge Share
Technical articles, tutorials, and insights
One Open Source Project a Day (No.87): Tank-OS - A Red Hat Engineer Baked an AI Agent Into a Bootable Linux Image Over a Weekend
A deep dive into Tank-OS, an open-source project from Red Hat Principal Engineer Sally O'Malley that packages OpenClaw AI Agent with Fedora into a single OCI bootable container image. Built on bootc + rootless Podman Quadlet, it delivers immutable OS, transactional updates, and cryptographic credential isolation for enterprise AI Agent fleet deployments. ~500 lines of Shell + Dockerfile. MIT licensed. Covered by TechCrunch.
One Open Source Project a Day (No.67): OpenClaw-Admin - The Visual Control Center for AI Agent Gateways
A deep dive into OpenClaw-Admin, a modern Vue 3 + TypeScript web admin console for the OpenClaw AI Agent Gateway. Supports multi-channel integration (QQ/Lark/DingTalk/WeCom), remote terminal, system monitoring, virtual office, and 17 functional modules. MIT licensed.
Insights from GDPS 2026: Enterprise Agents, AI Native, and One-Person Companies
Observations from the Global Developer Pioneer Summit (GDPS) on OpenClaw, Harness engineering, Skill as enterprise assets, and the AI Native development paradigm — plus practical directions for enterprise Agent platforms.
OpenClaw in Action: How to Search and Install SKILLS to Make Your Agent Actually Work
Is your OpenClaw stuck in 'chat-only' mode? This guide breaks down the complexity of SKILL configuration, teaching you how to find and install Agent capabilities via Clawhub and Vercel Semantic Search.
OpenClaw Deep Dive (8): The Skill System — Teaching LLMs to Follow Workflows On Demand
Starting from "how does the AI know which command to use for weather," we derive the SKILL.md format design, multi-source priority discovery, eligibility filtering, the progressive disclosure pattern, and the user-invocable /command path with deterministic tool dispatch.
OpenClaw Deep Dive (5): Model and Provider System
Starting from "using Claude and Kimi simultaneously," we derive OpenClaw's model addressing mechanism, provider auto-discovery, model aliases, fallback chains, auth profile rotation, and how third-party providers integrate via the Plugin SDK.
OpenClaw Deep Dive (6): Node Host, Canvas, and Sub-Agents
Starting from "how an AI assistant breaks out of a single-process boundary," we derive the design of the Node Host (remote execution sandbox), Canvas (mobile interactive UI), A2UI (native bridge), and Sub-Agents (parallel task decomposition).
OpenClaw Deep Dive (7): Security Model and Sandbox
Starting from "how to safely deploy an AI assistant on a shared server," we systematically map Gateway authentication layers, the tool policy pipeline, Docker sandbox isolation, the secret provider system, external content injection defense, and the security audit framework covering dozens of check points.
OpenClaw Deep Dive (4): Plugin SDK and Extension Development
Starting from "how to integrate a new messaging platform," we derive the full design of the Plugin SDK — stable contract, channel extension protocol, lifecycle hooks, service registration, and four-tier security discovery.
OpenClaw Source Deep Dive (3): Agent Execution Engine — How Does the AI Think and Act?
Starting from a message triggering the AI, we dissect OpenClaw's Agent execution engine layer by layer — the Lane serial queue, five phases of a single run, three-layer filtering in the streaming subscriber, four-layer tool policy, and the outer retry loop that handles rate limits and context overflow.
OpenClaw Source Deep Dive (1): Gateway — Why Does a Personal AI Assistant Need a Central Hub?
Starting from real user scenarios, we derive every key design decision in OpenClaw's Gateway — why it exists, why WebSocket was chosen, why three-layer auth was designed, and why a flat handler map was used. Every decision is motivated by a concrete problem, not pulled from thin air.
OpenClaw Source Deep Dive (2): Channels & Routing — How Does a Message Find Its Agent?
Starting from a concrete routing problem, we derive OpenClaw's Channel plugin interface, SessionKey format, seven-tier routing priority, four dmScope isolation modes, and the identityLinks cross-platform identity merging mechanism. Every design is motivated by a specific problem.