openclaw-sandboxing

What problem does it solve?

This Skill addresses the security risks associated with running arbitrary code or tools by providing robust sandboxing capabilities, ensuring that tool execution is isolated from the host system and other sensitive environments.

Core Features & Use Cases

• Containerized Execution: Run tools within isolated Docker containers to minimize the blast radius of potential errors or malicious actions.
• Configurable Isolation: Customize sandbox modes (off, non-main, all), scope (session, agent, shared), and workspace access (none, ro, rw).
• Network Control: Define network access for sandboxes, from completely isolated (none) to bridged (bridge) for package installations.
• Browser Sandboxing: Configure isolated browser environments for web-based tasks.
• Use Case: When executing a script that downloads and runs external code, configure the sandbox to use mode: "all", scope: "session", and docker.network: "none" to ensure maximum security and prevent any unintended network access or host system interference.

Quick Start

Configure the sandbox to use all sessions, agent scope, and read-write workspace access with a bridge network for development.