Manage SandboxesOperate Sandboxes

Run Sandboxes

View as Markdown

Use these workflows to keep existing sandboxes reachable and control the resources they consume.

Manage Dashboard Ports

If the forward stopped, or the installer reported that no active forward was found and the URL does not load, restart the forward manually with the port from the install summary.

$openshell forward start --background <dashboard-port> my-gpt-claw

On WSL, use 0.0.0.0:<dashboard-port> as the forward target so the Windows host can continue to reach the dashboard.

To list active forwards across all sandboxes, run the following command.

$openshell forward list

Run Multiple Sandboxes

Each sandbox needs its own dashboard port because openshell forward refuses to bind a port that another sandbox already uses.

When the default API port is already held by another sandbox, nemohermes onboard scans for the next free port and records it for the sandbox.

If you intentionally run separate OpenShell gateways on the same host, set a different NEMOCLAW_GATEWAY_PORT before each onboarding run. NemoClaw isolates the gateway name and local state by port so one port-specific gateway does not replace another.

Gateway and dashboard cleanup is scoped by sandbox name and port. A later onboarding run that uses a different NEMOCLAW_GATEWAY_PORT or --control-ui-port does not tear down the first sandbox’s gateway or dashboard forward.

$nemohermes onboard                                      # first sandbox uses 18789
$nemohermes onboard                                      # second sandbox uses the next free port, such as 18790

To choose a specific port, pass --control-ui-port:

$nemohermes onboard --control-ui-port 19000

You can also set CHAT_UI_URL or NEMOCLAW_DASHBOARD_PORT before onboarding:

$CHAT_UI_URL=http://127.0.0.1:19000 nemohermes onboard
$NEMOCLAW_DASHBOARD_PORT=19000 nemohermes onboard

For port conflicts and overrides, refer to Port already in use.

Stop and Start a Sandbox

Stop a sandbox’s container to free CPU, memory, and GPU resources without losing anything:

$nemohermes <sandbox-name> stop

Workspace files, credentials, network policies, and the registry entry are preserved; only the container stops running. The shared host gateway and tunnel services keep serving other sandboxes.

Start it again later:

$nemohermes <sandbox-name> start

NemoClaw restarts the container and repairs the in-sandbox gateway and host forwards. Refer to nemohermes <name> stop and nemohermes <name> start for details. Use nemohermes <name> destroy when you want to delete the sandbox instead.

Manage the Cloudflare Tunnel

When the host has cloudflared, nemohermes tunnel start starts a Cloudflare tunnel. The tunnel can expose the forwarded Hermes endpoint with a public URL. Set CLOUDFLARE_TUNNEL_TOKEN before running the command when you want to use a Cloudflare named tunnel instead of a generated quick-tunnel URL.

$nemohermes tunnel start

nemohermes tunnel stop stops the tunnel but leaves the supervisor-owned in-sandbox gateway and agent-owned host forwards running for the selected or default sandbox.