Sandboxing in OpenClaw: Containment for Safer Tool Execution

OpenClaw is a self-hosted AI agent framework. The agent uses an LLM as its brain and can call tools to do work. The tools include shell commands, file operations, web requests, and database queries. The tools are powerful. The power is also the risk. An agent that can run rm -rf is a real risk. The risk is not theoretical. The risk is the kind of thing that keeps system administrators up at night. The mitigation is sandboxing. The sandbox limits what the agent can do. The sandbox is a defense in depth. The sandbox is not a substitute for human review. The sandbox is a complement. This is what sandboxing in OpenClaw actually does, how to set it up, and the trade-offs.

What sandboxing actually is in OpenClaw

The sandboxing layer in OpenClaw is a set of policies that constrain what the agent can do. The policies are defined in YAML (or Python, depending on the version). The policies are evaluated before each tool call. The policies can allow, deny, or require approval. The default policy is “ask for approval for any tool call.” The strict policy is “deny any tool call that touches the filesystem or the network.” The custom policy is “allow reads but require approval for writes, deny shell access.” The choice depends on the use case. The use case for a personal assistant is permissive. The use case for a public-facing bot is strict. The use case for an internal tool is in between. The trade-off is safety vs capability. A strict sandbox prevents the agent from doing useful work. A permissive sandbox allows the agent to do dangerous work. Use to find the middle ground for your use case.

What the filesystem sandbox actually does

The filesystem sandbox limits which files and directories the agent can read and write. The limits are defined as a list of paths. The list can be “allow” (the agent can access these) or “deny” (the agent cannot access these). The default is “deny everything except the working directory.” The strict policy is “deny everything except a specific list of read-only paths.” The permissive policy is “allow everything in the working directory, deny everything else.” a personal assistant is “allow the working directory, deny everything else.” a public-facing bot is “deny everything, require explicit approval for any access.” The trade-off is that the agent cannot help you with files outside the working directory. The mitigation is to add the specific paths you need to the allow list. The mitigation is straightforward. The mitigation is the right call for the use case.

What the network sandbox actually does

The network sandbox limits which hosts the agent can reach. The limits are defined as a list of hostnames or IP ranges. The list can be “allow” (the agent can reach these) or “deny” (the agent cannot reach these). The default is “deny everything except localhost and a small allow list of common APIs.” The strict policy is “deny everything except the specific APIs the agent needs.” The permissive policy is “allow everything.” a personal assistant is “allow a small list of common APIs, deny everything else.” a public-facing bot is “deny everything, require explicit approval for any access.” The trade-off is that the agent cannot reach the APIs you need. The mitigation is to add the specific hosts to the allow list. The mitigation is straightforward. The mitigation is the right call for the use case.

What the resource limits actually do

The resource limits cap how much the agent can use. The limits include: maximum execution time per tool call (default 30 seconds, configurable), maximum memory per tool call (default 512MB, configurable), maximum disk space per tool call (default 100MB, configurable), maximum network bandwidth per tool call (default 10MB/s, configurable), and maximum number of tool calls per agent session (default 100, configurable). The limits prevent the agent from running away. The limits prevent the agent from using all the system resources. The limits prevent the agent from doing denial-of-service attacks on the host. Use to set the limits based on the use case. The use case for a personal assistant is permissive. The use case for a public-facing bot is strict. The trade-off is that the limits can be too tight (the agent fails to do useful work) or too loose (the agent can do dangerous work). Use to start strict and loosen as needed.

What the approval flow actually looks like

The approval flow is the human-in-the-loop layer. When the agent wants to do a tool call that requires approval (because the policy says so), the agent pauses and asks the human. The human approves or denies. The agent proceeds or stops. The approval flow is per-action. The approval flow can be configured to require approval for specific tools (like shell or file writes) and not for others (like reads). The approval flow is the right call for any use case where mistakes are costly. The trade-off is the cognitive overhead of approving. The mitigation is to set the policies to allow the common case and require approval for the rare case. The mitigation is straightforward. The mitigation is the right call for the use case.

What the audit log actually does

The audit log records every tool call, every approval decision, every denial, and every result. The log is stored in a file (default location is ~/.openclaw/audit.log). The log can be sent to a centralized log service (like Splunk, Datadog, or a self-hosted option). The log is the right call for “I want to know what the agent did.” The use cases I have used the log for: debugging “why did the agent do that?”, security auditing “what did the agent access?”, and compliance “show me the agent’s activity for the last 90 days.” The trade-off is the storage cost. The mitigation is to rotate the log file daily. The mitigation is straightforward. The mitigation is the right call for the use case.

What the production deployment actually looks like

The production deployment uses a multi-layer sandbox. The first layer is the host (a Docker container with limited capabilities). The second layer is the OpenClaw sandbox (the policies described above). The third layer is the agent’s own constraints (the system prompt tells the agent what to do and what not to do). The combination is defense in depth. The combination is the right call for any production deployment. The combination is not over-engineered. The combination is the minimum viable safety posture. The recommendation is to use all three layers. The recommendation is to test the layers regularly. The recommendation is to monitor the audit log. The recommendation is to have a process for updating the policies as the use case evolves.

What I would do differently

If I were starting over, I would do two things differently. The first is to start with a stricter sandbox than I needed. The strict sandbox is easier to loosen than the loose sandbox is to tighten. The starting point should be conservative. The starting point should be tightened as needed. The second is to invest in better audit log analysis. The audit log is only useful if someone reads it. The recommendation is to set up alerts for specific patterns (like “agent tried to access /etc/shadow” or “agent tried to make a network connection to a non-allow-listed host”). The alerts are the right call for the audit log. The alerts are the kind of thing that catches the bug before the bug becomes a problem. The setup is 30 minutes. The benefit is permanent.

What this means for the agent space

Sandboxing is the difference between an agent that is useful in production and an agent that is a toy. The sandboxing is not optional. The sandboxing is the kind of thing that is required for any production deployment. The recommendation is to use the sandboxing. The recommendation is to set up the policies. The recommendation is to use the approval flow. The recommendation is to monitor the audit log. The recommendation is to have a process for updating the policies. The sandboxing is the right answer. The sandboxing is not the only answer. The sandboxing is the foundation. Use the foundation plus the human review. The combination is what makes the agent safe. The combination is what makes the agent production-ready. The combination is the right answer.

Here is the rollout order I would recommend for any team adopting sandboxed AI agents:

• Week 1: deploy the agent in a dedicated Docker container with the strictest possible sandbox
• Week 2: enable the approval flow for all tool calls that have side effects (writes, network, shell)
• Week 3: set up the audit log shipping to a centralized log service for monitoring
• Week 4: tune the policies to allow the common case and require approval for the rare case
• Month 2: review the audit log weekly, look for patterns, refine the policies based on what you see