Openclaw sandbox 配置，接上文，是 在宿主机运行，此文改为 sandbox 运行。

1. 检查沙箱环境配置
   dev01@openClaw:~/.openclaw$ openclaw sandbox explain

🦞 OpenClaw 2026.3.13 (61d171a) — Automation with claws: minimal fuss, maximal pinch.

Effective sandbox:
agentId: main
sessionKey: agent:main:main
mainSessionKey: agent:main:main
runtime: direct
mode: off scope: agent perSession: false
workspaceAccess: none workspaceRoot: /home/dev01/.openclaw/sandboxes

解释

runtime: direct → 所有 tool 直接在主机运行
mode: off → sandbox 没启用
workspaceAccess: none → sandbox 不允许访问 workspace
2. 在 openclaw.json 增加 sandbox 配置
“sandbox”: {
“mode”: “all”,
“scope”: “agent”,
“workspaceAccess”: “rw”,
“docker”: {
“image”: “openclaw-sandbox:bookworm-slim”,
“network”: “bridge”,
“readOnly”: false,
“volumes”: [
“/tmp:/tmp:rw”,
“/var/lib/apt/lists:/var/lib/apt/lists:rw”
]
}
}
解释如下
暂时无法在飞书文档外展示此内容
3. 重建sandbox
openclaw sandbox recreate --all

输出

-> No containers found matching the criteria.

验证

openclaw sandbox explain

输出如下：

Effective sandbox:
agentId: main
sessionKey: agent:main:main
mainSessionKey: agent:main:main
runtime: sandboxed
mode: all scope: agent perSession: false
workspaceAccess: rw workspaceRoot: /home/dev01/.openclaw/sandboxes
4. 安装docker环境

安装

sudo apt install docker.io

加入权限组

sudo usermod -aG docker $USER
sudo usermod -aG docker dev01 #本用户
newgrp docker

加入开机运行

sudo systemctl enable docker

验证

docker ps

网络

docker info | grep Network
-> Network: bridge host ipvlan macvlan null overlay
5. Build image

进入 docker-build 目录

cd ~/docker-build

覆盖写入修正后的 Dockerfile（复制上面的完整内容）

cat > Dockerfile <<EOF
FROM debian:bookworm-slim

安装系统打包的 Python 依赖 + 基础工具

RUN apt-get update &&
apt-get install -y --no-install-recommends
python3-requests
python3-bs4
python3-full
curl git &&
apt-get clean &&
rm -rf /var/lib/apt/lists/*

验证依赖（构建时检查）

RUN python3 -c “import requests; import bs4; print(‘依赖安装成功’)”
EOF

重新构建镜像（解决 parse error）

docker build -t openclaw-sandbox:bookworm-slim .
6. 检查容器

启动交互式容器

docker run --rm -it openclaw-sandbox:bookworm-slim python3 -c “import requests; from bs4 import BeautifulSoup; print(‘OK’)”