Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [Bug]: Docker sandbox bind mounts completely broken on Ubuntu 24.04 [5 comments, 4 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#49309•Fetched 2026-04-08 00:56:42
View on GitHub
Comments
5
Participants
4
Timeline
14
Reactions
0
Author
selipsoselipso
Participants
ArtyomkunArtyomkund87skgd87skgRyceRyceselipsoselipso
Timeline (top)
commented ×5cross-referenced ×2labeled ×2mentioned ×2

Version: OpenClaw 2026.3.11 (29dc654)

I've tried creating a custom docker image several times for OpenClaw to handle agents running inside a docker container, but no dice. I don't see anything sandbox, despite there being documentation supporting the options. I have tried running openclaw sandbox explain, openclaw sandbox recreate --all, and every single config option in the documentation. Yet, all I get is the following message no matter what I do:

No containers found matching the criteria.

Possibly related: #24151

I appreciate the effort that has gone into security hardening recently but it is a huge red flag if docker sandboxing doesn't work properly in Linux.

Error Message

No error logs or anything helpful is output. Just a silent failure:

Root Cause

So I had some help debugging this after banging my head against it for so long, and it seems like the root cause is that the new sandbox security policy blocks all folders outside of the workspace from being attached to the docker container. This is extremely counter-intuitive and defeats the purpose of having a "binds" property in the first place.

Code Example

No containers found matching the criteria.

---

No containers found matching the criteria.

---
RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Summary

Version: OpenClaw 2026.3.11 (29dc654)

I've tried creating a custom docker image several times for OpenClaw to handle agents running inside a docker container, but no dice. I don't see anything sandbox, despite there being documentation supporting the options. I have tried running openclaw sandbox explain, openclaw sandbox recreate --all, and every single config option in the documentation. Yet, all I get is the following message no matter what I do:

No containers found matching the criteria.

Possibly related: #24151

I appreciate the effort that has gone into security hardening recently but it is a huge red flag if docker sandboxing doesn't work properly in Linux.

Steps to reproduce

  1. Create a custom docker image (with or without build script)
  2. Point the OpenClaw gateway to use the custom docker image under ~/.openclaw/openclaw.json
  3. Crickets. Followed by No containers found matching the criteria.

Expected behavior

Openclaw should use the docker command to build and run commands in the provided container image if it already exists.

Actual behavior

No error logs or anything helpful is output. Just a silent failure:

No containers found matching the criteria.

OpenClaw version

2026.3.11 (29dc654)

Operating system

Ubuntu 24.04

Install method

No response

Model

OpenRouter (all models), other OpenAI compatible models

Provider / routing chain

Ollama local endpoint with OpenRouter fallback

Config file / key location

~/.openclaw/openclaw.json

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

So I had some help debugging this after banging my head against it for so long, and it seems like the root cause is that the new sandbox security policy blocks all folders outside of the workspace from being attached to the docker container. This is extremely counter-intuitive and defeats the purpose of having a "binds" property in the first place.

Image

There is no documented way to override this either, even though the logs say "Use a dangerous override only when you fully trust this runtime."

extent analysis

Fix Plan

To resolve the issue with OpenClaw's sandbox security policy blocking folders outside of the workspace from being attached to the docker container, you can try the following steps:

  • Update the openclaw.json configuration file to include the dangerousOverride option:
{
  "sandbox": {
    "dangerousOverride": true,
    "binds": [
      "/path/to/your/folder"
    ]
  }
}
  • Alternatively, you can try setting the OPENCLAW_SANDBOX_DANGEROUS_OVERRIDE environment variable to true before running the OpenClaw command:
export OPENCLAW_SANDBOX_DANGEROUS_OVERRIDE=true
openclaw sandbox recreate --all
  • If you are using a custom docker image, ensure that the WORKDIR instruction is set to a directory within the workspace, and that the binds property is configured correctly in the openclaw.json file.

Verification

To verify that the fix worked, you can try running the openclaw sandbox explain command again and check if the containers are now being detected. You can also check the OpenClaw logs for any error messages related to the sandbox security policy.

Extra Tips

  • Be cautious when using the dangerousOverride option, as it can potentially introduce security risks if not used carefully.
  • Make sure to update the openclaw.json file and environment variables according to your specific use case and requirements.
  • If you continue to experience issues, try checking the OpenClaw documentation and GitHub issues for any known workarounds or solutions.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Openclaw should use the docker command to build and run commands in the provided container image if it already exists.

#api#ssr#installation#tensor shape#autograd error#embedding generation#cache error#pipeline error#runtime error#dependency conflict

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix [Bug]: Docker sandbox bind mounts completely broken on Ubuntu 24.04 [5 comments, 4 participants]