Network Policies
NemoClaw runs with a deny-by-default network policy. The sandbox can only reach endpoints that are explicitly allowed. OpenShell intercepts any request to an unlisted destination and prompts the operator to approve or deny it in real time through the TUI.
Baseline Policy
The baseline policy is defined in nemoclaw-blueprint/policies/openclaw-sandbox.yaml.
Filesystem
/dev/pts is the pseudo-terminal (devpts) directory.
It is writable so PTY-based tools (tmux, script, and interactive shells) can allocate a terminal.
Without it, those tools fail with fork failed: Permission denied.
The sandbox process runs as a dedicated sandbox user and group.
Landlock LSM enforcement applies on a best-effort basis.
Network Policies
The following endpoint groups are allowed by default:
All endpoints use TLS termination and are enforced at port 443.
GitHub access (github.com, api.github.com) is not included in the baseline policy.
Apply the github preset during onboarding if your agent needs GitHub access.
Refer to Customize the Network Policy.
The baseline policy does not include messaging endpoints for Telegram, Discord, Slack, WeChat, or WhatsApp. Enable the channel during onboarding or apply the matching messaging preset so the sandbox can reach that platform. WeChat and WhatsApp are experimental. Review Choose Messaging Channels before enabling them.
Policy Tiers
During onboarding, the wizard prompts for a policy tier that determines the default set of presets applied on top of the baseline policy.
The baseline policy is always applied regardless of the selected tier.
An operator can persistently exclude a specific baseline entry with policy exclude when they accept reduced, unsupported functionality.
This is the supported registry-backed way to replay a live exact-key removal during rebuild; raw openshell policy set edits are not replayed, while edits made to the source baseline itself are applied when the sandbox is recreated.
After selecting a tier, a combined preset and access-mode screen lets you include or exclude individual presets and toggle each between read (GET only) and read-write (GET + POST/PUT/PATCH) access.
Tier-default presets are pre-selected; additional presets can be added from the built-in preset list available to the sandbox’s active agent.
NemoClaw filters tier defaults and built-in preset choices by the active agent’s supported integrations.
OpenClaw can select brave or tavily, while Hermes can select tavily only.
NemoClaw automatically suggests the preset that matches the selected provider and removes stale web search presets during resume reconciliation when you switch providers or disable web search.
Explicit custom preset lists and manual interactive selections remain operator-controlled.
OpenClaw onboarding also adds the openclaw-pricing preset on top of tier defaults so session-cost records can populate from LiteLLM and OpenRouter without manual configuration.
When the OpenClaw OTEL diagnostics feature is enabled with a local endpoint, NemoClaw adds the openclaw-diagnostics-otel-local preset on the same basis.
The applied set therefore reflects the chosen tier plus any agent-required presets, so policy list may show one or more presets that do not appear in the tier table above.
The policy list provenance tags are inferred from the current tier YAML and the active agent at display time and are not persisted per preset.
A preset whose name matches an entry in the sandbox’s current tier definition is labelled [from <tier> tier] even when an operator added it manually with policy add after onboarding; agent-specific preset names are only labelled [from <agent> agent] when the active agent matches.
Claude Code direct egress is not included in any policy tier.
If you install and run the Claude Code CLI inside the sandbox with its own credentials, apply the claude-code preset explicitly.
Normal NemoClaw Anthropic inference still routes through the OpenShell gateway.
Tier definitions are stored in nemoclaw-blueprint/policies/tiers.yaml.
In non-interactive mode, set the tier with NEMOCLAW_POLICY_TIER:
Unset, blank, or whitespace-only NEMOCLAW_POLICY_TIER values use the balanced default.
In non-interactive onboarding, a non-blank value that does not match a known tier exits before preflight, gateway, or inference side effects and lists the valid options.
Interactive onboarding ignores an invalid environment value and shows the normal tier prompt.
Inference
The baseline policy allows only the local inference route.
External inference providers are reached through the OpenShell gateway, not by direct sandbox egress.
Operator Approval Flow
When the agent attempts to reach an endpoint not listed in the policy, OpenShell intercepts the request and presents it in the TUI for operator review. The flow has these steps:
- The agent makes a network request to an unlisted host.
- OpenShell blocks the connection and logs the attempt.
- The TUI command
openshell termdisplays the blocked request with host, port, and requesting binary. - The operator approves or denies the request.
- If approved, the endpoint is added to the running policy for the session.
To monitor requests as the agent runs, open the TUI:
For step-by-step navigation and approval controls, refer to Approve or Deny Agent Network Requests.
Modifying the Policy
Static Changes
Edit nemoclaw-blueprint/policies/openclaw-sandbox.yaml and re-run the onboard wizard:
Dynamic Changes
Apply policy updates to a running sandbox without restarting:
To replace the live policy with a complete base policy file, export the current base policy and use openshell policy set.
Requires OpenShell 0.0.72+ for the round-trippable policy get --base and policy set --wait syntax.
NemoClaw strips the OpenShell metadata header and exits non-zero if it cannot validate the base policy.
Do not add --raw when you plan to edit and reapply the file.
Edit or review current-policy.yaml, then apply it:
Excluding a baseline entry
The baseline policy applies to every sandbox, but an operator can persistently exclude a specific baseline entry when they accept reduced, unsupported functionality in exchange for tighter egress.
Preview the exact scope, then exclude an exact baseline key:
The command prints every endpoint, method/path rule, and binary the exclusion removes.
It also names the supported features that may stop working before it requires explicit acknowledgement (--force in non-interactive use).
NemoClaw refuses to exclude an entry that does not have a reviewed feature-impact disclosure, so a new baseline entry cannot bypass this review.
The versioned exclusion record is bound to the reviewed entry content and active agent, recorded in the sandbox registry, and replayed on rebuild.
If the sandbox’s active agent changes, NemoClaw requires you to clear or review the exclusion again instead of applying an approval from another agent baseline.
NemoClaw journals the cross-system update before changing the live OpenShell policy and verifies the exact live result before publishing the durable intent.
If the process or persistence layer fails between those steps, policy list, policy explain, and status report repair required.
Sandbox creation or recreation, rebuild, and cross-sandbox snapshot cloning stop before destructive work, and rerunning the same policy exclude or policy restore command reconciles only an exact source or target state.
An unreadable live policy, or one that matches neither the pre-mutation source nor the intended target, remains fail-closed for manual inspection instead of being guessed or overwritten.
An interrupted restore finalizes only when the durable exclusion still exactly matches the staged exclusion and the current release baseline still exactly matches the journaled target; if either changes or becomes unreadable, the journal remains pending for inspection and re-review.
If a later release changes that entry, create and rebuild fail closed until re-review; if the release removes it, they fail closed until the stale record is cleared.
The critical managed_inference entry cannot be excluded because it carries the required route to managed inference.
NemoClaw enforces this both when the command runs and whenever durable exclusion state is replayed.
An excluded baseline key remains reserved while the exclusion is active. NemoClaw refuses onboarding, rebuild, built-in and custom presets, messaging channel policies, and generated MCP policies that would define the same key and silently restore its egress. It also refuses to exclude a key that an applied preset already owns. Restore the baseline entry before applying a preset that intentionally owns the key, or rename a custom entry whose key represents different access.
To recover from baseline drift, first check whether the release changed the entry’s content or removed it entirely (nemoclaw <sandbox-name> policy explain or doctor reports which).
If the entry still exists with different content, clear the stale record, review the current scope, and explicitly approve it again only if you still accept the impact:
If the release removed the entry entirely, policy exclude <key> fails with “Unknown baseline entry” because there is nothing left to exclude.
Clear the stale record instead:
List active exclusions with policy list.
policy explain, status, doctor, and snapshot and rebuild summaries also disclose active exclusions and their reduced-support impact.
Status and doctor compare each approval with the active agent baseline and verify that the excluded key is absent from the live OpenShell policy.
An unreadable live policy is unverified, while a live policy that contains the key is a mismatch that requires repair before you rely on the exclusion.
Restore an entry against the current baseline and clear its exclusion:
Excluding a baseline entry leaves agent features that depend on it unsupported for that sandbox.