Manage SandboxesOperate Sandboxes

Run Sandboxes

View as Markdown

Use these workflows to keep existing sandboxes reachable and control the resources they consume.

Manage Dashboard Ports

If the forward stopped, or the installer reported that no active forward was found and the URL does not load, restart the forward manually with the port from the install summary.

$openshell forward start --background <dashboard-port> my-gpt-claw

On WSL, use 0.0.0.0:<dashboard-port> as the forward target so the Windows host can continue to reach the dashboard.

To list active forwards across all sandboxes, run the following command.

$openshell forward list

Run Multiple Sandboxes

Each sandbox needs its own dashboard port because openshell forward refuses to bind a port that another sandbox already uses.

When the default port is already held by another sandbox, nemoclaw onboard scans ports 18789 through 18799 and uses the next free port.

If you intentionally run separate OpenShell gateways on the same host, set a different NEMOCLAW_GATEWAY_PORT before each onboarding run. NemoClaw isolates the gateway name and local state by port so one port-specific gateway does not replace another.

Gateway and dashboard cleanup is scoped by sandbox name and port. A later onboarding run that uses a different NEMOCLAW_GATEWAY_PORT or --control-ui-port does not tear down the first sandbox’s gateway or dashboard forward.

$nemoclaw onboard                                      # first sandbox uses 18789
$nemoclaw onboard                                      # second sandbox uses the next free port, such as 18790

To choose a specific port, pass --control-ui-port:

$nemoclaw onboard --control-ui-port 19000

You can also set CHAT_UI_URL or NEMOCLAW_DASHBOARD_PORT before onboarding:

$CHAT_UI_URL=http://127.0.0.1:19000 nemoclaw onboard
$NEMOCLAW_DASHBOARD_PORT=19000 nemoclaw onboard

For port conflicts and overrides, refer to Port already in use.

Stop and Start a Sandbox

Stop a sandbox’s container to free CPU, memory, and GPU resources without losing anything:

$nemoclaw <sandbox-name> stop

Workspace files, credentials, network policies, and the registry entry are preserved; only the container stops running. The shared host gateway and tunnel services keep serving other sandboxes.

Start it again later:

$nemoclaw <sandbox-name> start

NemoClaw restarts the container and repairs the in-sandbox gateway and host forwards. Refer to nemoclaw <name> stop and nemoclaw <name> start for details. Use nemoclaw <name> destroy when you want to delete the sandbox instead.

Manage the Cloudflare Tunnel

When the host has cloudflared, nemoclaw tunnel start starts a Cloudflare tunnel. The tunnel can expose the dashboard with a public URL. Set CLOUDFLARE_TUNNEL_TOKEN before running the command when you want to use a Cloudflare named tunnel instead of a generated quick-tunnel URL.

$nemoclaw tunnel start

nemoclaw tunnel stop stops the tunnel and asks NemoClaw to stop the in-sandbox gateway for the selected or default sandbox. The older nemoclaw start still works as a deprecated alias.