managing-nemoclaw-sandboxes

name	managing-nemoclaw-sandboxes
description	Manages NemoClaw sandbox lifecycle — launch, connect, monitor, and control sandboxed OpenClaw agents running inside OpenShell containers. Use when working with sandboxes, agent environments, NemoClaw instances, or when the user mentions launching, connecting, monitoring, or stopping agents.

Managing NemoClaw Sandboxes

NemoClaw runs OpenClaw inside OpenShell sandboxed containers. All sandbox management happens from the host — the user's machine where Claude Code runs.

Quick Reference

List sandboxes

nemoclaw list

Shows all sandboxes with model, provider, and policy info. The default sandbox is marked with *.

Check sandbox health

nemoclaw <name> status

Reports sandbox health and NIM status for a specific sandbox.

For overall service status (sandbox list + auxiliary services):

nemoclaw status

Connect to a sandbox

nemoclaw <name> connect

Opens an interactive shell inside the running container. Once connected, you can run OpenClaw commands directly (agent, skills, plugins).

Stream logs

nemoclaw <name> logs
nemoclaw <name> logs --follow

Streams logs from the sandbox. --follow works like tail -f.

For lower-level log access with more filtering options:

openshell logs <name>
openshell logs <name> --tail
openshell logs <name> -n 50
openshell logs <name> --since 5m --source sandbox --level debug

Monitor via TUI

nemoclaw term

Opens the OpenShell terminal dashboard. Use this for monitoring sandbox activity and approving network egress requests.

Destroy a sandbox

nemoclaw <name> destroy
nemoclaw <name> destroy --yes

Stops NIM and deletes the sandbox. Use --yes to skip the confirmation prompt.

Policy Presets

NemoClaw provides built-in policy presets that can be added to sandboxes:

nemoclaw <name> policy-add
nemoclaw <name> policy-list

policy-list shows available presets with ● marking applied ones.

OpenShell Sandbox Operations

For lower-level sandbox management, use OpenShell CLI directly:

openshell sandbox create --name <name> --keep --no-auto-providers
openshell sandbox connect <name>
openshell sandbox get <name>
openshell sandbox list
openshell sandbox delete <name>

The --keep flag preserves the sandbox after the agent exits. --no-auto-providers prevents automatic credential injection.

Auxiliary Services

nemoclaw start       # Start auxiliary services (Telegram, tunnel)
nemoclaw stop        # Stop all services

Troubleshooting

nemoclaw debug              # Collect diagnostics
nemoclaw debug --quick      # Quick diagnostic check
nemoclaw debug --output FILE  # Save diagnostics tarball

Sandbox-Side Operations

After connecting with nemoclaw <name> connect, these commands are available inside the container:

openclaw agent --agent main --local -m "message" --session-id <id>
openclaw tui

Known Issues

Sandbox name collision: If the sandbox is named nemoclaw (the default), commands like nemoclaw nemoclaw status will fail because the CLI interprets the second nemoclaw as a command, not a sandbox name. Workarounds:

• Use nemoclaw status (top-level) for overall service and sandbox status
• Use openshell sandbox get nemoclaw for detailed sandbox info
• Avoid naming sandboxes nemoclaw — use a distinct name like my-assistant

Detailed References

Host-side CLI commands: See host-commands.md Sandbox-side CLI commands: See sandbox-commands.md