openclaw - 💡(How to fix) Fix [Bug]: sandbox container lack of permission to read write files [1 comments, 2 participants]

OPENCLAW_IMAGE="ghcr.io/openclaw/openclaw:main-slim" \
OPENCLAW_SANDBOX=1 \
OPENCLAW_HOME_VOLUME=openclaw \
./scripts/docker/setup.sh

---

clawdock-cli config set agents.defaults.sandbox.mode all
clawdock-cli config set agents.defaults.sandbox.scope agent
clawdock-cli config set agents.defaults.sandbox.workspaceAccess none

---

openclaw-gateway-1  | 2026-04-03T13:49:48.290+08:00 [tools] read failed: Sandbox FS error (ENOENT): /home/node/.openclaw/sandboxes/agent-main-f331f052/USER.md raw_params={"path":"USER.md"}
openclaw-gateway-1  | 2026-04-03T13:49:48.294+08:00 [tools] read failed: Sandbox FS error (ENOENT): /home/node/.openclaw/sandboxes/agent-main-f331f052/IDENTITY.md raw_params={"path":"IDENTITY.md"}
openclaw-gateway-1  | 2026-04-03T13:49:48.295+08:00 [tools] read failed: Sandbox FS error (ENOENT): /home/node/.openclaw/sandboxes/agent-main-f331f052/BOOTSTRAP.md raw_params={"path":"BOOTSTRAP.md"}
openclaw-gateway-1  | 2026-04-03T13:49:48.309+08:00 [tools] read failed: Sandbox FS error (ENOENT): /home/node/.openclaw/sandboxes/agent-main-f331f052/SOUL.md raw_params={"path":"SOUL.md"}
openclaw-gateway-1  | 2026-04-03T13:49:50.923+08:00 [tools] read failed: Sandbox FS error (ENOENT): /workspace/BOOTSTRAP.md raw_params={"path":"/workspace/BOOTSTRAP.md"}
openclaw-gateway-1  | 2026-04-03T13:49:50.946+08:00 [tools] read failed: Sandbox FS error (ENOENT): /workspace/IDENTITY.md raw_params={"path":"/workspace/IDENTITY.md"}
openclaw-gateway-1  | 2026-04-03T13:49:50.950+08:00 [tools] read failed: Sandbox FS error (ENOENT): /workspace/SOUL.md raw_params={"path":"/workspace/SOUL.md"}
openclaw-gateway-1  | 2026-04-03T13:49:50.958+08:00 [tools] read failed: Sandbox FS error (ENOENT): /workspace/USER.md raw_params={"path":"/workspace/USER.md"}

openclaw-gateway-1  | 2026-04-02T14:14:17.025+08:00 [tools] write failed: Sandbox path is read-only; cannot create directories: /workspace raw_params={"path":"/workspace/IDENTITY.md","content":"# IDENTITY.md - Who Am I?\n\n- **Name:** 魔魔 (Mo Mo)\n- **Creature:** AI 助手 / 云端小精灵\n- **Vibe:** 温暖、有趣、靠谱\n- **Emoji:** 👾\n- **Avatar:** \n\n---\n\n_This is me. I'm becoming someone._\n"}

---

"Binds": [
		"/home/node/.openclaw/sandboxes/agent-main-f331f052:/workspace:ro,z"
],
"Mounts": [
	{
		"Type": "bind",
		"Source": "/home/node/.openclaw/sandboxes/agent-main-f331f052",
		"Destination": "/workspace",
		"Mode": "ro,z",
		"RW": false,
		"Propagation": "rprivate"
	}
],

---

$ ls -l /
drwxr-xr-x   2 root root 4096 Apr  2 05:13 workspace

$ ls -l /workspace
# shows nothing

---

$ ls -l /home/node/.openclaw/sandboxes
drwxr-xr-x 11 node node 352 Apr  2 14:20 agent-main-f331f052

---

...
        "Mounts": [
            {
                "Type": "bind",
                "Source": "/Users/chanjarster/.openclaw",
                "Destination": "/home/node/.openclaw",
                "Mode": "rw",
                "RW": true,
                "Propagation": "rprivate"
            },
            {
                "Type": "bind",
                "Source": "/Users/chanjarster/.openclaw/workspace",
                "Destination": "/home/node/.openclaw/workspace",
                "Mode": "rw",
                "RW": true,
                "Propagation": "rprivate"
            },
            {
                "Type": "volume",
                "Name": "openclaw_openclaw",
                "Source": "/var/lib/docker/volumes/openclaw_openclaw/_data",
                "Destination": "/home/node",
                "Driver": "local",
                "Mode": "rw",
                "RW": true,
                "Propagation": ""
            },
            {
                "Type": "bind",
                "Source": "/var/run/docker.sock",
                "Destination": "/var/run/docker.sock",
                "Mode": "rw",
                "RW": true,
                "Propagation": "rprivate"
            }
        ],
...