Skip to navigation
Network PolicyConfigure Policies

Change the Baseline Network Policy

View as Markdown

Change the baseline policy when every future sandbox needs the same durable endpoint access. NemoClaw reads the policy from the host when it creates the sandbox.

Prerequisites

  • Use a NemoClaw source checkout on the host.
  • Keep the OpenShell CLI on your PATH.

Make policy file changes on the host. The sandbox discards changes made only inside the sandbox when it is recreated.

Edit the Policy File

Open nemoclaw-blueprint/policies/openclaw-sandbox.yaml and add or modify endpoint entries.

Edit YAML manually when a maintained preset does not cover the required host, such as a reviewed public partner API. Each entry in the network_policies section defines an endpoint group. The schema in schemas/network-policy.schema.json defines the entry format. Onboarding fails when an entry does not match it. Each entry requires these fields:

name : The entry name as a string. Use the same value as the policy key.

endpoints : A list of endpoints that the sandbox can reach. Each endpoint sets exactly one of port or ports, and at least one destination: host, allowed_ips, or both. allowed_ips changes the server-side request forgery boundary that OpenShell enforces, so review each address before you add one. For an HTTP API, each endpoint also sets protocol: rest and either its own rules list or access. The examples below use enforcement: enforce with rules, which is the least-privilege form.

binaries : A list of { path: <absolute path> } mappings that name the executables allowed to use the endpoints. A bare path string is rejected.

Each endpoint accepts these fields:

rules : A list of allow mappings whose shape follows the endpoint’s protocol. For protocol: rest, each rule is allow: { method: <HTTP method>, path: <route> }. method accepts GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS, or *. path is a route pattern that starts with /, such as /v1/**. For other protocols, read schemas/network-policy.schema.json for the rule format.

allow_encoded_slash : An optional boolean that allows percent-encoded slashes such as %2F in request paths. Leave this field unset unless the service uses encoded slashes in its documented route format, such as ClawHub scoped package names.

The following entry allows GET requests to one partner API:

network_policies:
  partner_api:
    name: partner_api
    endpoints:
      - host: api.example.com
        port: 443
        protocol: rest
        enforcement: enforce
        rules:
          - allow: { method: GET, path: "/v1/**" }
    binaries:
      - { path: /usr/local/bin/openclaw }
      - { path: /usr/local/bin/node }

Add the entry under the existing network_policies key. List only the executables that open the connection. Use the executable path that openshell term reports for a blocked request.

To include a maintained preset in the baseline policy, merge its network_policies entries into the applicable baseline file. Use Apply Policy Presets when you need to add a preset to one running sandbox.

Add Blueprint Policy Additions

If you maintain a custom blueprint, add extra policy entries under components.policy.additions in nemoclaw-blueprint/blueprint.yaml. NemoClaw validates those entries with the same policy schema used by preset files. During sandbox creation, it fetches the live policy, merges the additions into network_policies, and applies the merged policy through OpenShell. The run metadata records the applied additions so you can audit the blueprint-level entries that were active.

Re-Run Onboarding

Apply the updated baseline by running onboarding again:

nemoclaw onboard

The wizard reads the modified policy file and applies it to the sandbox.

Verify the Policy

Check that the sandbox is running with the updated policy:

nemoclaw <name> status

Use nemoclaw <name> policy list to inspect the tracked preset state. Use openshell policy get <name> when you need to inspect the effective OpenShell policy.