> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nemoclaw/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nemoclaw/_mcp/server.

# Run Sandboxes

> Run multiple sandboxes and stop or start containers, with dashboard and tunnel guidance where supported.

Use these workflows to keep existing sandboxes reachable and control the resources they consume.

## Manage Dashboard Ports

If the forward stopped, or the installer reported that no active forward was found and the URL does not load, restart the forward manually with the port from the install summary.

```bash
openshell forward start --background <dashboard-port> my-gpt-claw
```

On WSL, use `0.0.0.0:<dashboard-port>` as the forward target so the Windows host can continue to reach the dashboard.

To list active forwards across all sandboxes, run the following command.

```bash
openshell forward list
```

## Run Multiple Sandboxes

Each sandbox needs its own dashboard port because `openshell forward` refuses to bind a port that another sandbox already uses.

When the default API port is already held by another sandbox, `nemohermes onboard` scans for the next free port and records it for the sandbox.

If you intentionally run separate OpenShell gateways on the same host, set a different `NEMOCLAW_GATEWAY_PORT` before each onboarding run.
NemoClaw isolates the gateway name and local state by port so one port-specific gateway does not replace another.

Gateway and dashboard cleanup is scoped by sandbox name and port.
A later onboarding run that uses a different `NEMOCLAW_GATEWAY_PORT` or `--control-ui-port` does not tear down the first sandbox's gateway or dashboard forward.

```bash
nemohermes onboard                                      # first sandbox uses 18789
nemohermes onboard                                      # second sandbox uses the next free port, such as 18790
```

To choose a specific port, pass `--control-ui-port`:

```bash
nemohermes onboard --control-ui-port 19000
```

You can also set `CHAT_UI_URL` or `NEMOCLAW_DASHBOARD_PORT` before onboarding:

```bash
CHAT_UI_URL=http://127.0.0.1:19000 nemohermes onboard
NEMOCLAW_DASHBOARD_PORT=19000 nemohermes onboard
```

For port conflicts and overrides, refer to [Port already in use](../../reference/troubleshooting#port-already-in-use).

## Stop and Start a Sandbox

Stop a sandbox's container to free CPU, memory, and GPU resources without losing anything:

```bash
nemohermes <sandbox-name> stop
```

Workspace files, credentials, network policies, and the registry entry are preserved; only the container stops running.
The shared host gateway and tunnel services keep serving other sandboxes.

Start it again later:

```bash
nemohermes <sandbox-name> start
```

NemoClaw restarts the container and repairs the in-sandbox gateway and host forwards.
Refer to [`nemohermes <name> stop`](../../reference/commands#nemohermes-name-stop) and [`nemohermes <name> start`](../../reference/commands#nemohermes-name-start) for details.
Use [`nemohermes <name> destroy`](../../reference/commands#nemohermes-name-destroy) when you want to delete the sandbox instead.

## Manage the Cloudflare Tunnel

When the host has `cloudflared`, `nemohermes tunnel start` starts a Cloudflare tunnel.
The tunnel can expose the forwarded Hermes endpoint with a public URL.
Set `CLOUDFLARE_TUNNEL_TOKEN` before running the command when you want to use a Cloudflare named tunnel instead of a generated quick-tunnel URL.

```bash
nemohermes tunnel start
```

`nemohermes tunnel stop` stops the tunnel but leaves the supervisor-owned in-sandbox gateway and agent-owned host forwards running for the selected or default sandbox.

## Related Topics

* [View Sandbox Status](view-sandbox-status) before changing a sandbox.
* [Recover and Rebuild Sandboxes](recover-and-rebuild-sandboxes) when start does not restore a healthy runtime.
* [Troubleshooting](../../reference/troubleshooting) for port, gateway, and dashboard failures.