Skip to navigation
SecuritySecurity Controls

Understand Filesystem Controls

View as MarkdownOpen in Claude

NemoClaw uses OpenShell filesystem policy to restrict access outside the writable agent state tree.

OpenShell covers additional filesystem enforcement details, including hard_requirement compatibility mode for Landlock and policy path validation rules. Refer to the Filesystem Controls section of the OpenShell Security Best Practices.

Read-Only System Paths

The container mounts system directories read-only to prevent the agent from modifying binaries, libraries, or configuration files.

AspectDetail
Default/usr, /lib, /proc, /dev/urandom, /app, /etc, /var/log, and /var/lib/dpkg are read-only.
What you can changeAdd or remove paths in the filesystem_policy.read_only section of the policy file.
Risk if relaxedMaking /usr or /lib writable lets the agent replace system binaries (such as curl or node) with trojanized versions. Making /etc writable lets the agent modify DNS resolution, TLS trust stores, or user accounts.
RecommendationNever make system paths writable. If the agent needs a writable location for generated files, use a subdirectory of /sandbox.

Agent Config Directory

The /sandbox/.deepagents directory contains Deep Agents Code runtime state and initially generated configuration. NemoClaw generates the initial config.toml, and native preference saves can update it. Rebuild and named recreation restore the saved native home, including those preferences. Current images keep managed route and upstream provider metadata in protected, root-owned files outside the native home. To change the provider or model without restoring existing preferences, follow Validate a Different Deep Agents Selection.

The managed Deep Agents image deliberately omits raw provider and service credentials from generated configuration. OpenShell-owned credential stores and host-only secrets remain outside the native home/workspace transfer. The native .deepagents/.mcp.json must contain only supported URLs and OpenShell resolver placeholders for managed entries.

The agent-native .deepagents/.mcp.json contains OpenShell placeholders. NemoClaw reads it directly and carries managed entries through bounded lifecycle handoffs rather than reconstructing it from host-side registry state.

The Deep Agents config and state tree remains mutable after provisioning. NemoClaw does not prevent the sandbox identity from changing paths that its Unix permissions allow.

AspectDetail
DefaultThe Deep Agents config tree contains initially generated config.toml with native preferences, agent-native MCP configuration, and mutable memory and skill state.
What you can changeUse host-side NemoClaw commands for durable model, provider, managed MCP, and policy changes; inspect or edit memory and skills through dcode or direct file access when appropriate.
Risk of direct editsDirect MCP edits remain authoritative but cannot widen OpenShell policy. Storing credentials in .deepagents/.env or literal values in .mcp.json moves them outside the managed credential boundary and is rejected by managed lifecycle operations.
RecommendationUse OpenShell providers and NemoClaw MCP commands for credentials. Back up Deep Agents state before destructive operations.

Writable Paths

The agent has read-write access to /sandbox, /tmp, /dev/null, and /dev/pts.

AspectDetail
Default/sandbox (agent workspace), /tmp (temporary files), /dev/null, and /dev/pts (the devpts pseudo-terminal directory, required so PTY-based tools such as tmux, script, and interactive shells can allocate a terminal).
What you can changeAdd additional writable paths in filesystem_policy.read_write.
Risk if relaxedEach additional writable path expands the agent’s ability to persist data and potentially modify system behavior. Adding /var lets the agent write to log directories. Adding /home gives access to other user directories.
RecommendationKeep writable paths to /sandbox and /tmp. If the agent needs a persistent working directory, create a subdirectory under /sandbox.

Landlock LSM Enforcement

Landlock is a Linux Security Module that enforces filesystem access rules at the kernel level.

AspectDetail
Defaultcompatibility: strict. Deep Agents sandbox startup fails closed when OpenShell cannot enforce the managed filesystem policy.
What you can changeThis is a NemoClaw Deep Agents invariant, not a user-facing knob.
Risk if relaxedSilent Landlock degradation would leave the terminal coding harness with weaker filesystem isolation while still reporting a successful sandbox.
RecommendationRun Deep Agents on a kernel and runtime that support Landlock enforcement. Rebuild or move hosts if startup reports an enforcement failure.