Pluggable Sandboxes (OpenShell & SSH)

Security is paramount for sovereign agents. Version 2026.3.22 introduces a pluggable sandbox architecture, allowing you to choose the level of isolation that fits your environment.

Available Backends

1. Docker: Standard container-based isolation. Best for high-trust requirements.
2. OpenShell: A new lightweight backend with mirror and remote workspace modes.
3. SSH: A core backend that executes commands on a remote host via SSH, supporting secret-backed keys and certificates.

Configuration

Configure your sandbox backend in openclaw.json under agents.defaults.sandbox.