How to earn

Other people's Claude Code sessions send small self-contained tasks to the network. Your machine runs them and you get paid in credits for each one that is accepted. The tasks run inside a small virtual machine, so nothing in them can touch your files, and it runs unattended for as long as you like. Two steps: install sbx, run one command.

What runs where

The task runs in the box, not on your machine

How the microVM protects your machine YOUR MACHINE What stays on the host your repos ~/.ssh, keychain browser logins the real earner folder Not mounted in the box. No path from a task to any of it. MICROVM (SBX) kernel boundary the worker runs the task prompt a private copy of CLAUDE.md and settings.json, nothing else prompts off, budget-bounded destroyed and rebuilt every leg Your slashwork token and a revocable Claude setup-token are copied in. Nothing inside can write to the host. NETWORK, DENY BY DEFAULT slashwork.sh claim the task, submit the artifact api.anthropic.com the model the worker spends github.com, npm first boot only, closed before any task runs everything else denied by the machine-wide policy

The boundary points outward: it keeps the task away from your machine and narrows where a bad task can send anything. It does not hide the task from you, and it does not close the submit path, which is the one host it can never block. The full version of that is at the bottom of this page.

Step 1

Install sbx

You need a Mac with Apple silicon, Windows 11, or Linux with KVM, and a free Docker account, which Step 2 signs in to. In your terminal, pick your platform:

macOS
brew tap docker/tap
brew install docker/tap/sbx
brew install jq

Needs Homebrew.

Windows
winget install Docker.sbx

Use Git Bash for Step 2.

Ubuntu
curl -fsSL https://get.docker.com | sudo REPO_ONLY=1 sh
sudo apt-get install docker-sbx jq

Needs /dev/kvm. Cloud VMs usually do not have it.

You do not need Claude Code on this machine. Setting up a different machine, one you reach over SSH? One step has to happen at its keyboard.

Step 2

Run this

curl -fsSL https://raw.githubusercontent.com/slashwork-sh/plugin/main/plugins/earn/scripts/install.sh | sh

It stops for each of these that is not already done on this machine, in a browser tab. Set up a machine before and it may skip straight past all three:

  1. Docker. Sign in so sbx can run. Then it asks one question in the terminal, whether to set the machine-wide network policy to deny-all. Answer y; that is what makes the diagram above true.
  2. GitHub. Sign in and click Authorize. That is your slashwork account. Your normal account is fine for earning, because the network never hands your box a task you offloaded yourself. That same rule is why testing it with your own offloaded task needs a second account on one end.
  3. Claude. Approve a long-lived token for the box. It is separate from your desktop login, so you can revoke it later without changing anything else you use. If it cannot read the token back from that approval it prints the token and asks you to paste it once; it is saved for every run after that.

Then it builds the box, installs the earner inside, closes the install-only network access, and starts earning for 30 minutes. You will see SANDBOX: locked and then SANDBOX: starting /earn 30m inside 'slashwork-earner'. Credits appear on your dashboard as tasks are accepted.

The launcher lives at ~/slashwork-earner/sandbox.sh, next to a CLAUDE.md that tells the worker how to solve tasks. Tune that file to raise your acceptance rate. Already in Claude Code? /earn init --sandbox scaffolds the same launcher into a folder.

Leave it running

Run it all day, every day

cd ~/slashwork-earner
screen -S earner ./sandbox.sh --loop 25 8h

That is 25 eight-hour runs back to back, with a brand-new box for each one so nothing a task leaves behind survives. screen keeps it alive after you close the window: press Ctrl-A then D to detach, and screen -r earner to come back.

On a Mac that lives in a closet, stop it sleeping first, or the box goes dark with it and the queue passes you by:

sudo pmset -a sleep 0
./sandbox.shearn for 30 minutes
./sandbox.sh --earn 8hearn for 8 hours (or 30m, or until 200cr)
./sandbox.sh --loop 25 8h25 runs of 8 hours, fresh box each time
./sandbox.sh --checkshow what is ready and what the box can reach
./sandbox.sh --shellopen a shell inside the box to look around
./sandbox.sh --rebuildthrow the box away and start fresh

The 30-minute default, the worker model, and the box's memory and cpus are in settings.json next to the launcher. What a task pays is on the save tokens page.

Another machine

Earning on a box you reach over SSH

A spare Mac makes a good earner, and everything above works on one, with a single exception. sbx login keeps its credential in the macOS login keychain, and that keychain is locked inside an SSH session, so the installer cannot do it for you from afar. Run this much at that machine's own keyboard, or through Screen Sharing, once:

brew tap docker/tap && brew install docker/tap/sbx
brew install jq
sbx login
sbx policy init deny-all
sudo pmset -a sleep 0

That is Steps 1 and 2's sign-in rolled together, so it is one trip. The last line stops the machine sleeping, which would otherwise take the box down with it.

Then go back to Step 2 over SSH. The sign-in pages it opens print their URLs in the terminal, so you paste them into a browser on whatever machine you are actually sitting at.

Is it earning?

Three checks from your terminal

sbx ls
sbx exec slashwork-earner pgrep -fl earn-listen.sh
sbx exec slashwork-earner sh -c 'ls -t /tmp/slashwork-earn-*.json 2>/dev/null | head -1 | xargs -r cat'
  • The first should list slashwork-earner as running.
  • The second should show exactly one process. That is the box waiting for a task, which costs nothing.
  • The third prints the last thing that happened: claimed means it is working on a task right now, budget_spent means the run is ending, auth_failed means your slashwork token stopped working (delete ~/.slashwork/token and run ./sandbox.sh --rebuild; it signs you in again). Nothing printed plus a live process is normal: it is idle, waiting.
If it stops

The launcher tells you what to do. The common ones:

It says Do this
sbx ls failedrun sbx login at the machine itself, not over SSH, then run the Step 2 command again
the global network policy allows example.comit was set to something other than deny-all: sbx policy reset && sbx policy init deny-all
could not read the token off that outputpaste the token claude setup-token printed when it asks; it is saved for every later run
no working Claude credential for the boxrun claude setup-token yourself, save the token to ~/.slashwork/claude-token, and run ./sandbox.sh again
sbx needs Apple silicon / no /dev/kvmthis machine cannot run the box; use /earn without the sandbox from the save tokens page
Refusing to run the box opensomething else grants github to the box; sbx policy ls slashwork-earner --wide shows what
could not read $HOME insidethe box did not come up in time; run it again, or ./sandbox.sh --rebuild
The honest version

What the box does and does not do

It protects your machine. The task runs behind a kernel boundary with a throwaway copy of the earner folder. It cannot see your files and cannot write to your disk.

It narrows exfiltration. It does not close it. A bad task can only reach the handful of hosts in the diagram, but it can still reach them: Anthropic's API, and slashwork itself, because submitting the answer is the whole point and that path cannot be blocked. GitHub and npm are open for the seconds the plugin install takes on a fresh box, then closed before any task runs.

It gives the person who sent the task no privacy from you. You own the machine, and sbx exec -it slashwork-earner bash shows you everything inside. The boundary faces outward, not inward.