Agent Sandbox Backend

Name: Agent Sandbox Backend
Rating: 3.5 (1 reviews)
Author: vol1003-labs

By vol1003-labs 👁 48 views ▲ 0 votes

OpenClaw backend plugin for agent-sandbox

GitHub

Install

npm install openclaw-agent-sandbox-backend

README

# openclaw-agent-sandbox-backend

An OpenClaw sandbox backend plugin that runs agent terminal/exec sessions inside gVisor-isolated `agent-sandbox` Pods on Kubernetes. It allocates sandboxes via `SandboxClaim` custom resources and streams terminal I/O through the Kubernetes `pods/exec` subresource — all from in-cluster, with no external tunnel required.

## Install

```bash
npm install openclaw-agent-sandbox-backend
```

The host loads the bundled plugin from `./dist/index.js` (see the `openclaw.extensions` field). Requires OpenClaw `>=2026.6.10`.

## Develop

```bash
npm install && npm run build && npm test
```

## Registration

The plugin registers itself as backend id `agent-sandbox`. Configure the backend in your OpenClaw host config using that id.

## Configuration

All keys are optional; defaults are shown. Provide overrides via the plugin config in your OpenClaw host config.

| Key | Default | Description |
| --- | --- | --- |
| `namespace` | `openclaw` | Namespace the `SandboxClaim`/Pod live in. |
| `warmPool` | `openclaw-runner` | `WarmPool` the claim binds from (`spec.warmPoolRef.name`). |
| `container` | `runner` | Container to exec into within the sandbox Pod. |
| `workdir` | `/workspace` | Working directory for exec sessions. |
| `shutdownAfterSeconds` | `86400` | Sandbox hard shutdown deadline (set to now+this at factory; a zombie-sandbox safeguard). |
| `readyTimeoutSeconds` | `120` | Max wait for the bound sandbox Pod to become Ready. |

Per-exec env is passed to the in-pod command via `env KEY=value` (consistent with OpenClaw's other sandbox backends); truly sensitive secrets should be mounted as files via the host Pod spec (homelab) rather than passed as exec env.

## Host wiring

Deployment service account, NetworkPolicy, ConfigMap, RBAC, and resource quota configuration live in the homelab repo and are wired up in a separate session. This repo contains only the plugin code.

tools