[{"_1":2,"_169":-5,"_170":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_144":145},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_84":-5,"_85":86,"_135":-5,"_136":11,"_137":17,"_138":11,"_139":-5,"_140":11,"_141":-5,"_142":143},"canonicalUrl","https://hub.docker.com/r/mwaeckerlin/openclaw/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","mwaeckerlin","reponame","openclaw","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_38":39,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":51,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":70,"_75":11,"_76":77,"_81":29,"_82":83},"categories",[],"content_types",[40],"image","date_registered","2026-04-14T15:40:30.622472Z","description","Secure OpenClaw — Gateway + SSH Sandbox","is_private","last_updated","2026-08-22T07:37:58.841476Z","last_modified","2026-08-22T07:38:16.056258Z","media_types",[52],"application/vnd.docker.container.image.v1+json","name","pull_count",14992,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Simple Secure OpenClaw in SSH Sandbox\n\n\nCombine OpenClaw with Security and Easiness! Run out of the box a secure docker based sandboxed OpenClaw, locally or in a cloud.\n\n**It has never been so easy to run a *secure* sandboxed pre-configured OpenClaw!**:\n1. get an [OpenAI token](https://platform.openai.com/api-keys) (or use [LiteLLM](https://docs.litellm.ai/docs/))\n1. write some [configuration variables in `.env`](#development-setup)\n2. run `npm start`\n3. open: [`http://localhost:18789/`](http://localhost:18789/)\n\n**Target audience:** Security aware **developer** with some basic docker know how. Everybody else: **Keep your hands away from OpenClaw!**\n\nAll features are listed in [FEATURES.md](FEATURES.md), all tests in [TESTS.md](TESTS.md). The sandbox builds on [mwaeckerlin/sandbox-base](https://github.com/mwaeckerlin/sandbox-base); docker-in-docker runs the rootless [mwaeckerlin/dockindock](https://github.com/mwaeckerlin/dockindock), which needs no host configuration.\n\n![](doc/overview.svg)\n\n

PlantUML source

\n```plantuml\n@startuml overview\ncloud Docker {\n component [Openclaw:Gateway] {\n (secrets) . [Gateway]\n }\n component [Openclaw:Sandbox] {\n [Ubuntu]\n }\n}\n:User: --> [Gateway] : control\n:Agent: --> [Ubuntu] : execute\\ncommands\n[Gateway] -> [Ubuntu] : ssh\n@enduml\n```\n\n

\n\n## Security Model\n\nThe primary security mechanism is **strict isolation**: The AI runs in a dedicated sandbox container that contains only its tools and workspace — no host secrets, no production data, no unrelated resources.\n\n### Seggregation in Container\n\n- **Isolation in Seggregated Container** — The gateway controlls access and secrets. The agent has no direct access to the gateway (no tokens, no secrets). The agent cannot access files or variables or secrets defined on the gateway. *Never expose any secret to the sandbox!*\n- **Access through MCP** — Where the SSH sandboxed agent cannot get access from the gateway, we add an MCP server that holds the token in a seggregated container.\n- **Container hardening** — `no-new-privileges`, `pids_limit: 256` against escalation and fork bombs\n\n### Network Isolation\n\n- **Network isolation** — Containers communicate on seggregated internal networks. Every two containers have their own network.\n- **Network Encryption** (production) — When going to production, *encrypt the networks* (e.g. encrypted overlay in docker swarm: for all networks set `networks..driver_opts.encrypted: \"true\"`, or add a service mesh)\n- **No port over-exposure** — Only port 18789 (UI/API) is published, bound to `127.0.0.1` by default (override with `OPENCLAW_GATEWAY_BIND_ADDRESS`) for *local testing only*; internal ports stay internal. If you attach chat tool, such as [Telegram](https://telegram.org/), you can even close that port. You can then reach your OpenClaw through Telegram. *Do not expose 18789 to the Internet without further protection.* You may add e.g. [Traefik](https://doc.traefik.io/traefik/) service and an [Authentik proxy-provider outpost](https://docs.goauthentik.io/add-secure-apps/outposts) in front of OpenClaw when you want to access it through the internet.\n\n**Note:** If networks are neither seggregated nor encrypted, the agent can *sniff for secrets* on the shared or unencrypted network. So network isolation is crucial, and encryption is highly recommended at least in production.\n\n### Secrets\n\n- **Secrets** (production) — Use docker secrets instead of environment variables in docker swarm (or use a vault such as Hashicorps to deploy in e.g. Kubernetes). Secrets can be mounted on `/var/secrets/secret-name` and are then exported to the OpenClaw environment variables as `SECRET_NAME`.\n\n### Additional Tools and Seggregations\n\n- **Docker-in-Docker isolation** — If yo uwant to allow the agent to run docker commands, you may attach a dedicated Docker container (`docker:dind`) where the agent can run docker in an isolated installation, seggregated from your docker installation. Be aware that the agent can gain root, but only in tis isolated container. Just restart the container to restore in case of a break out. No data is in danger.\n- **OpenClaw-MCP-Gateway** — The project [mwaeckerlin/openclaw-mcp-gateway](https://github.com/mwaeckerlin/openclaw-mcp-gateway) runs an MCP server to give the sandbox limited access to the gateway to execute some safe `openclaw` CLI commands. It helps for self analysis and allows to setup cron jobs. Only the MCP server holds the gateway token, the sandbox has no access to the token.\n- **MCP-Github** — The project [mwaeckerlin/mcp-github](https://github.com/mwaeckerlin/mcp-github) gives the sandbox access to the GitHub API. Only the MCP server holds the GitHub token, the sandbox has no access to the token.\n\n### Hardened OpenClaw Setup\n\n- **Workspace restriction** (`tools.fs.workspaceOnly: true`) — File tools limited to the sandbox workspace. \n **Note:** The `workspaceOnly` setting restricts OpenClaw's **file tools** to the workspace. However, `exec`/shell commands can still read container system files (e.g. `/etc/passwd`, `/proc`). This is acceptable because the sandbox is an isolated container — there are no host secrets inside it.\n- **Loop detection** (`loopDetection`) — Circuit breaker against tool/agent loops. That's more to prevent token over spending.\n\n### `strictHostKeyChecking: false`\n\nAcceptable in a controlled internal Docker network where DNS is managed by Docker. For production hardening, consider pinning host keys.\n\n### Documented Security Trade-offs\n\nThese defaults trade security for local out-of-the-box usability. All are overridable via environment variables; review them before any non-local deployment:\n\n- **Control UI relaxations** — `allowInsecureAuth`, `dangerouslyAllowHostHeaderOriginFallback` and `dangerouslyDisableDeviceAuth` default to `true` (`OPENCLAW_CONTROL_UI_ALLOW_INSECURE_AUTH`, `OPENCLAW_CONTROL_UI_ALLOW_HOST_HEADER_ORIGIN_FALLBACK`, `OPENCLAW_CONTROL_UI_DISABLE_DEVICE_AUTH`). This lets the token-auth UI work over plain HTTP on loopback without device pairing. Behind a public reverse proxy, set all three to `false` and configure `OPENCLAW_ALLOWED_ORIGINS_JSON`.\n- **ACPX `permissionMode: approve-all`** — the gateway-side GitHub/Gitea MCP servers auto-approve all tool calls; the effective permission boundary is the scope of the token you provide (`OPENCLAW_GITHUB_TOKEN`/`OPENCLAW_GITEA_TOKEN`). Use minimal-scope tokens.\n- **Chat channel policies** — all channels default to `dmPolicy: pairing` (unknown peers must be approved before the agent reacts); Telegram groups require an explicit mention by default. Loosening this (e.g. `OPENCLAW_TELEGRAM_DM_POLICY=open`) means anyone who finds your bot can drive the agent.\n- **DinD without TLS** (`DOCKER_TLS_CERTDIR: \"\"`) — the isolated Docker daemon listens unauthenticated, but only on the segregated `sandbox-dind` network where the sandbox is root-equivalent by design (see the DinD security warning below).\n\n## Full Architecture\n\n![](doc/architecture.svg)\n\n

PlantUML source

\n\n```plantuml\n\n@startuml architecture\nactor User as user\n\ncloud docker {\n\n node \"mwaeckerlin/openclaw:gateway\" as gw {\n [Gateway] as ctrl\n storage \"openclaw-config\" as cfg\n ctrl - cfg\n }\n\n node \"mwaeckerlin/openclaw-mcp-gateway\" {\n [MCP OpenClaw Server] as mcp\n }\n\n node \"mwaeckerlin/openclaw:sandbox\" as sb {\n [Sandbox] as sshd\n storage \"openclaw-workspace\" as ws\n sshd -right- ws\n }\n\n node \"openclaw-dind\" as dind {\n [Docker] as dd\n storage \"openclaw-docker\" as dv\n dd -left- dv\n }\n\n node \"mwaeckerlin/mcp-github\" {\n [Github-Gateway] as gh\n }\n\n component \"allow-write-access\" as aw\n}\n\nuser --> ctrl : \"HTTP\"\nctrl --> sshd : \"SSH\"\nsshd --up--> mcp : openclaw\\ncommands\nmcp --up--> ctrl : forward\\ncommands\nsshd -left-> dd : docker\naw .up.> cfg : chown\nsshd --> gh\ngh ----> [GitHib]\n@enduml\n```\n\n

\n\n## Local Development Setup\n\nFor local testing with `docker compose` and `.env` file.\n\n### 1. Generate SSH Keypair and .env\n\nSimplest use is with an [OpenAI token](https://platform.openai.com/api-keys) that you store in `OPENAI_API_KEY`. All other secrets can just be randomly generated:\n\n```bash\n(umask 077\n ssh-keygen -t ed25519 -f openclaw-key -N \"\" -C \"openclaw-sandbox\"\n cat > .env <_JSON`\n\nExample:\n\n```bash\nOPENCLAW_GATEWAY_JSON='{\"mode\":\"local\",\"bind\":\"lan\",\"port\":18789,\"auth\":{\"mode\":\"token\",\"token\":\"${OPENCLAW_GATEWAY_TOKEN}\"},\"trustedProxies\":[\"10.0.0.0/8\",\"172.16.0.0/12\",\"192.168.0.0/16\"]}'\n```\n\nSupported section variables (from official OpenClaw schema roots):\n\n`OPENCLAW_META_JSON`, `OPENCLAW_ENV_JSON`, `OPENCLAW_WIZARD_JSON`, `OPENCLAW_DIAGNOSTICS_JSON`, `OPENCLAW_LOGGING_JSON`, `OPENCLAW_CLI_JSON`, `OPENCLAW_UPDATE_JSON`, `OPENCLAW_BROWSER_JSON`, `OPENCLAW_UI_JSON`, `OPENCLAW_SECRETS_JSON`, `OPENCLAW_AUTH_JSON`, `OPENCLAW_ACP_JSON`, `OPENCLAW_MODELS_JSON`, `OPENCLAW_NODE_HOST_JSON`, `OPENCLAW_AGENTS_JSON`, `OPENCLAW_TOOLS_JSON`, `OPENCLAW_BINDINGS_JSON`, `OPENCLAW_BROADCAST_JSON`, `OPENCLAW_AUDIO_JSON`, `OPENCLAW_MEDIA_JSON`, `OPENCLAW_MESSAGES_JSON`, `OPENCLAW_COMMANDS_JSON`, `OPENCLAW_APPROVALS_JSON`, `OPENCLAW_SESSION_JSON`, `OPENCLAW_CRON_JSON`, `OPENCLAW_HOOKS_JSON`, `OPENCLAW_WEB_JSON`, `OPENCLAW_CHANNELS_JSON`, `OPENCLAW_DISCOVERY_JSON`, `OPENCLAW_CANVAS_HOST_JSON`, `OPENCLAW_TALK_JSON`, `OPENCLAW_GATEWAY_JSON`, `OPENCLAW_MEMORY_JSON`, `OPENCLAW_MCP_JSON`, `OPENCLAW_SKILLS_JSON`, `OPENCLAW_PLUGINS_JSON`.\n\nIf `OPENCLAW_

_JSON` is set, it replaces that full section from the template.\nIf not set, the template defaults and feature toggles apply.\n\nPlugin configurations are supported in two modes:\n\n- complete plugin section replacement via `OPENCLAW_PLUGINS_JSON`\n- additive plugin entry mapping via `OPENCLAW_PLUGIN_ENTRIES_JSON`\n\n### Individual Overrides (Per-Parameter)\n\nIn addition to section-level JSON overrides, common single settings can be overridden directly via environment variables.\n\nMost useful groups:\n\n- Models and providers: `OPENCLAW_MODELS_MODE`, `OPENCLAW_OPENAI_BASE_URL`, `OPENCLAW_OPENAI_MODELS_JSON`, `OPENCLAW_LITELLM_*`, `OPENCLAW_AGENT_MODELS_JSON`\n- Agent runtime: `OPENCLAW_AGENT_SANDBOX_MODE`, `OPENCLAW_AGENT_WORKSPACE_ACCESS`, `OPENCLAW_SUBAGENT_*`\n- Tools and media: `OPENCLAW_TOOLS_FS_WORKSPACE_ONLY`, `OPENCLAW_LOOP_DETECTION_*`, `OPENCLAW_MEDIA_AUDIO_*`, `OPENCLAW_TTS_*`\n- Messaging and hooks: `OPENCLAW_MESSAGES_QUEUE_*`, `OPENCLAW_COMMANDS_*`, `OPENCLAW_HOOKS_*`\n- Channels: `OPENCLAW_TELEGRAM_*`, `OPENCLAW_DISCORD_*`, `OPENCLAW_SLACK_*`, `OPENCLAW_WHATSAPP_*`, `OPENCLAW_GOOGLECHAT_*`, `OPENCLAW_MATTERMOST_*`, `OPENCLAW_SIGNAL_*`, `OPENCLAW_IRC_*`\n- Gateway and UI: `OPENCLAW_GATEWAY_*`, `OPENCLAW_CONTROL_UI_*`, `OPENCLAW_ALLOWED_ORIGINS_JSON`, `OPENCLAW_TAILSCALE_*`, `OPENCLAW_TRUSTED_PROXIES_JSON`\n- Plugins and MCP/ACPX: `OPENCLAW_PLUGIN_*`, `OPENCLAW_ACPX_*`, `OPENCLAW_GITHUB_TOKEN`, `OPENCLAW_GITEA_*`, `PLUGINS`\n\nFor token/secret-based channels, there is intentionally no separate `*_ENABLED` toggle: the token/secret is the feature enabler.\n\nSpecial case:\n\n- `OPENCLAW_ALLOWED_ORIGINS_JSON` sets `gateway.controlUi.allowedOrigins`.\n- There is no built-in default for `allowedOrigins`; if not set, the field is not written.\n\nModel handling:\n\n- Agent model mappings can be set via `OPENCLAW_AGENT_MODELS_JSON`.\n- Provider model catalogs are managed per provider (`models.providers.*.models`), including LiteLLM discovery via `LITELLM_URL` + `LITELLM_MASTER_KEY`.\n\nFor a full technical variable reference, use the gateway service environment block in `docker-compose.yml` and the template defaults in `files/openclaw.json.j2`.\n\n\n## Docker-in-Docker (Optional)\n\nThe `openclaw-dind` service provides an isolated Docker daemon for the sandbox. It is **optional** — simply remove the `openclaw-dind` service and the `DOCKER_HOST` environment variable from the sandbox to disable it.\n\n**Who needs this?** Developers and DevOps engineers who want OpenClaw to autonomously build, run, and test containerized applications. For general use (writing, research, scripting), DinD is not needed.\n\n**Security warning:** The AI has full root access inside the DinD daemon. It can mount the DinD container's root filesystem, destroy all images/containers, or exhaust disk space on the `openclaw-docker` volume. DinD is isolated from the host Docker, but within its own daemon the AI has unrestricted access. Only enable this if you accept that risk.\n\n### DinD in Docker Swarm\n\nDocker Swarm does not support `privileged: true` in stack deploy files. Docker-in-Docker is therefore not supported in this Swarm setup.\n\n### Production Checklist\n\n- [ ] All secrets via `docker secret`, not environment variables\n- [ ] Encrypted overlay network (`--opt encrypted`)\n- [ ] Port 18789 behind TLS reverse proxy (nginx, Traefik, Kong)\n- [ ] Port 18790 not exposed (internal bridge only)\n- [ ] Firewall restricts access to gateway port\n- [ ] Consider `read_only: true` + `tmpfs` mounts if OpenClaw supports it\n","has_starred","hub_user","immutable_tags_settings",{"_71":11,"_72":73},"enabled","rules",[74],".*","is_automated","permissions",{"_78":17,"_79":11,"_80":11},"read","write","admin","user","storage_size",105391960402,"orgData","recentTags",[87,125],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":96,"_97":98,"_46":114,"_115":90,"_116":29,"_117":52,"_53":118,"_119":120,"_121":105,"_122":114,"_123":62,"_124":17},"content_type","creator",310548,"digest","sha256:91dc0053805a97f3960ebaca9517aa69ea206e8adb2114dc774133a4545d12af","full_size",325532480,"id",1130850704,"images",[99],{"_100":101,"_91":92,"_102":103,"_104":105,"_106":107,"_108":109,"_110":103,"_111":-5,"_112":94,"_59":62,"_113":-5},"architecture","amd64","features","","last_pulled","2026-09-25T08:43:39.092675745Z","last_pushed","2026-08-22T07:37:57.749415531Z","os","linux","os_features","os_version","size","variant","2026-08-22T07:37:58.122524Z","last_updater","last_updater_username","media_type","gateway","repository",30780210,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_88":40,"_89":90,"_91":126,"_93":127,"_95":128,"_97":129,"_46":133,"_115":90,"_116":29,"_117":52,"_53":134,"_119":120,"_121":131,"_122":133,"_123":62,"_124":17},"sha256:81131463f3e3d71a0381b1b8bd4f23073405e4cf3f5f6e275e5bbd28589afed0",1704081875,1130858188,[130],{"_100":101,"_91":126,"_102":103,"_104":131,"_106":132,"_108":109,"_110":103,"_111":-5,"_112":127,"_59":62,"_113":-5},"2026-09-25T10:09:49.733714561Z","2026-07-29T10:10:56.762632983Z","2026-07-29T10:10:57.047635Z","sandbox","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":146,"_153":154,"_142":167,"_168":11},{"_36":147,"_38":148,"_41":42,"_43":44,"_45":11,"_46":47,"_48":49,"_50":149,"_53":31,"_28":29,"_54":55,"_56":40,"_57":58,"_59":60,"_61":62,"_63":-5,"_64":58,"_65":66,"_67":11,"_68":29,"_69":150,"_75":11,"_76":152,"_81":29,"_82":83},[],[40],[52],{"_71":11,"_72":151},[74],{"_78":17,"_79":11,"_80":11},"tags",{"_155":156,"_157":-5,"_158":-5,"_159":160},"count",2,"next","previous","results",[161,164],{"_88":40,"_89":90,"_91":92,"_93":94,"_95":96,"_97":162,"_46":114,"_115":90,"_116":29,"_117":52,"_53":118,"_119":120,"_121":105,"_122":114,"_123":62,"_124":17},[163],{"_100":101,"_91":92,"_102":103,"_104":105,"_106":107,"_108":109,"_110":103,"_111":-5,"_112":94,"_59":62,"_113":-5},{"_88":40,"_89":90,"_91":126,"_93":127,"_95":128,"_97":165,"_46":133,"_115":90,"_116":29,"_117":52,"_53":134,"_119":120,"_121":131,"_122":133,"_123":62,"_124":17},[166],{"_100":101,"_91":126,"_102":103,"_104":131,"_106":132,"_108":109,"_110":103,"_111":-5,"_112":127,"_59":62,"_113":-5},[],"canDeleteTags","actionData","errors"]

mwaeckerlin/openclaw

Tags for mwaeckerlin/openclaw