Issue Station
Sign In
Tools hereToolbox

openclaw - 💡(How to fix) Fix [Bug] Sandbox policy reports runtime=sandboxed, but Claude CLI runner disables sandbox and target=sandbox browser is unavailable

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

In OpenClaw 2026.5.19, when using Anthropic models through Claude CLI OAuth, the effective sandbox policy reports that the agent/session should run sandboxed, but the actual agent execution uses the Claude CLI runner with sandbox disabled.

As a result, no openclaw-sbx-* containers are created for the turn, sandboxBridgeUrl is missing, and the browser tool with target="sandbox" fails with a misleading error:

Sandbox browser is unavailable. Enable agents.defaults.sandbox.browser.enabled or use target="host" if allowed.

The config already has sandbox browser enabled.

Error Message

As a result, no openclaw-sbx-* containers are created for the turn, sandboxBridgeUrl is missing, and the browser tool with target="sandbox" fails with a misleading error: Actual browser tool error: If target="sandbox" browser requires sandboxBridgeUrl, then the user-facing error should mention that the current runner/session is not sandboxed or has no sandbox bridge, rather than saying agents.defaults.sandbox.browser.enabled is disabled. Please clarify whether Claude CLI OAuth/runner is expected to support sandboxed agent execution. If not, sandbox explain and the browser error should make that explicit.

Root Cause

In OpenClaw 2026.5.19, when using Anthropic models through Claude CLI OAuth, the effective sandbox policy reports that the agent/session should run sandboxed, but the actual agent execution uses the Claude CLI runner with sandbox disabled.

As a result, no openclaw-sbx-* containers are created for the turn, sandboxBridgeUrl is missing, and the browser tool with target="sandbox" fails with a misleading error:

Sandbox browser is unavailable. Enable agents.defaults.sandbox.browser.enabled or use target="host" if allowed.

The config already has sandbox browser enabled.

Code Example

Sandbox browser is unavailable. Enable agents.defaults.sandbox.browser.enabled or use target="host" if allowed.

---

OpenClaw: 2026.5.19 (a185ca2)
Install type: npm/global package
OS: Linux VPS
Gateway: systemd user service
Model: anthropic/claude-opus-4-7
Auth: Claude CLI OAuth profile
Runner observed: claude-cli / cli

---

{
  "agents": {
    "defaults": {
      "workspace": "/home/claw/.openclaw/workspace",
      "models": {
        "anthropic/claude-opus-4-7": {},
        "anthropic/claude-sonnet-4-6": {}
      },
      "model": {
        "primary": "anthropic/claude-opus-4-7",
        "fallbacks": [
          "anthropic/claude-sonnet-4-6"
        ]
      },
      "sandbox": {
        "mode": "all",
        "workspaceAccess": "rw",
        "scope": "agent",
        "docker": {
          "image": "openclaw-sandbox-browser:bookworm-slim"
        },
        "browser": {
          "enabled": true,
          "enableNoVnc": true,
          "autoStart": true,
          "binds": [
            "/home/claw/.openclaw/workspace/.openclaw-browser-home:/tmp/openclaw-home"
          ]
        }
      }
    }
  },
  "auth": {
    "profiles": {
      "anthropic:claude-cli": {
        "provider": "claude-cli",
        "mode": "oauth"
      }
    }
  }
}

---

openclaw config get agents.defaults.sandbox

---

{
  "mode": "all",
  "workspaceAccess": "rw",
  "scope": "agent",
  "docker": {
    "image": "openclaw-sandbox-browser:bookworm-slim"
  },
  "browser": {
    "enabled": true,
    "enableNoVnc": true,
    "autoStart": true,
    "binds": [
      "/home/claw/.openclaw/workspace/.openclaw-browser-home:/tmp/openclaw-home"
    ]
  }
}

---

openclaw sandbox explain --session agent:main:telegram:group:<redacted>

---

Effective sandbox:
  agentId: main
  sessionKey: agent:main:telegram:group:<redacted>
  mainSessionKey: agent:main:main
  runtime: sandboxed
  mode: all   scope: agent
  workspaceAccess: rw   workspaceRoot: /home/claw/.openclaw/sandboxes

---

openclaw agent --agent main --message "ping sandbox test" --json

---

{
  "systemPromptReport": {
    "provider": "claude-cli",
    "model": "claude-opus-4-7",
    "sandbox": {
      "mode": "off",
      "sandboxed": false
    }
  },
  "executionTrace": {
    "winnerProvider": "claude-cli",
    "winnerModel": "claude-opus-4-7",
    "runner": "cli"
  }
}

---

docker ps -a --filter "name=openclaw-sbx-"

---

No openclaw-sbx-* containers are created for the agent turn.

---

Sandbox browser is unavailable. Enable agents.defaults.sandbox.browser.enabled or use target="host" if allowed.

---

runtime: sandboxed
mode: all   scope: agent

---

"sandbox": {
  "mode": "off",
  "sandboxed": false
}

---

"runner": "cli",
"winnerProvider": "claude-cli"

---

Image: openclaw-sandbox-browser:bookworm-slim ✓

---

openclaw sandbox explain  ->  runtime: sandboxed

---

openclaw agent --json  ->  runner: cli, sandbox.mode: off, sandboxed: false
RAW_BUFFERClick to expand / collapse

Summary

In OpenClaw 2026.5.19, when using Anthropic models through Claude CLI OAuth, the effective sandbox policy reports that the agent/session should run sandboxed, but the actual agent execution uses the Claude CLI runner with sandbox disabled.

As a result, no openclaw-sbx-* containers are created for the turn, sandboxBridgeUrl is missing, and the browser tool with target="sandbox" fails with a misleading error:

Sandbox browser is unavailable. Enable agents.defaults.sandbox.browser.enabled or use target="host" if allowed.

The config already has sandbox browser enabled.

Environment

OpenClaw: 2026.5.19 (a185ca2)
Install type: npm/global package
OS: Linux VPS
Gateway: systemd user service
Model: anthropic/claude-opus-4-7
Auth: Claude CLI OAuth profile
Runner observed: claude-cli / cli

Relevant config

~/.openclaw/openclaw.json:

{
  "agents": {
    "defaults": {
      "workspace": "/home/claw/.openclaw/workspace",
      "models": {
        "anthropic/claude-opus-4-7": {},
        "anthropic/claude-sonnet-4-6": {}
      },
      "model": {
        "primary": "anthropic/claude-opus-4-7",
        "fallbacks": [
          "anthropic/claude-sonnet-4-6"
        ]
      },
      "sandbox": {
        "mode": "all",
        "workspaceAccess": "rw",
        "scope": "agent",
        "docker": {
          "image": "openclaw-sandbox-browser:bookworm-slim"
        },
        "browser": {
          "enabled": true,
          "enableNoVnc": true,
          "autoStart": true,
          "binds": [
            "/home/claw/.openclaw/workspace/.openclaw-browser-home:/tmp/openclaw-home"
          ]
        }
      }
    }
  },
  "auth": {
    "profiles": {
      "anthropic:claude-cli": {
        "provider": "claude-cli",
        "mode": "oauth"
      }
    }
  }
}

Steps to reproduce

  1. Configure Anthropic through Claude CLI OAuth.
  2. Enable sandbox for all agent runs:
openclaw config get agents.defaults.sandbox

Actual output:

{
  "mode": "all",
  "workspaceAccess": "rw",
  "scope": "agent",
  "docker": {
    "image": "openclaw-sandbox-browser:bookworm-slim"
  },
  "browser": {
    "enabled": true,
    "enableNoVnc": true,
    "autoStart": true,
    "binds": [
      "/home/claw/.openclaw/workspace/.openclaw-browser-home:/tmp/openclaw-home"
    ]
  }
}
  1. Check sandbox policy for the Telegram session:
openclaw sandbox explain --session agent:main:telegram:group:<redacted>

Actual output:

Effective sandbox:
  agentId: main
  sessionKey: agent:main:telegram:group:<redacted>
  mainSessionKey: agent:main:main
  runtime: sandboxed
  mode: all   scope: agent
  workspaceAccess: rw   workspaceRoot: /home/claw/.openclaw/sandboxes
  1. Run an agent turn through the Gateway:
openclaw agent --agent main --message "ping sandbox test" --json

Actual output includes:

{
  "systemPromptReport": {
    "provider": "claude-cli",
    "model": "claude-opus-4-7",
    "sandbox": {
      "mode": "off",
      "sandboxed": false
    }
  },
  "executionTrace": {
    "winnerProvider": "claude-cli",
    "winnerModel": "claude-opus-4-7",
    "runner": "cli"
  }
}
  1. Check containers:
docker ps -a --filter "name=openclaw-sbx-"

Actual result:

No openclaw-sbx-* containers are created for the agent turn.
  1. Ask the agent to use the browser tool with target="sandbox".

Actual browser tool error:

Sandbox browser is unavailable. Enable agents.defaults.sandbox.browser.enabled or use target="host" if allowed.

Expected behavior

When agents.defaults.sandbox.mode = "all" and openclaw sandbox explain reports runtime: sandboxed, the actual agent execution should either:

  1. run in a sandboxed execution context and create the expected openclaw-sbx-* runtime, or
  2. clearly report that Claude CLI runner does not support sandbox execution, instead of showing runtime: sandboxed in sandbox explain.

If target="sandbox" browser requires sandboxBridgeUrl, then the user-facing error should mention that the current runner/session is not sandboxed or has no sandbox bridge, rather than saying agents.defaults.sandbox.browser.enabled is disabled.

Actual behavior

sandbox explain says the session is sandboxed:

runtime: sandboxed
mode: all   scope: agent

But actual execution disables sandbox:

"sandbox": {
  "mode": "off",
  "sandboxed": false
}

and uses:

"runner": "cli",
"winnerProvider": "claude-cli"

No sandbox containers are created, and browser target="sandbox" fails due to missing sandbox bridge.

Additional notes

The sandbox browser image itself appears valid:

Image: openclaw-sandbox-browser:bookworm-slim ✓

Earlier stale image and Chromium profile lock issues were resolved separately. The current issue is not Docker permissions, not Telegram routing, and not browser.enabled=false.

The contradiction is between:

openclaw sandbox explain  ->  runtime: sandboxed

and:

openclaw agent --json  ->  runner: cli, sandbox.mode: off, sandboxed: false

Please clarify whether Claude CLI OAuth/runner is expected to support sandboxed agent execution. If not, sandbox explain and the browser error should make that explicit.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

When agents.defaults.sandbox.mode = "all" and openclaw sandbox explain reports runtime: sandboxed, the actual agent execution should either:

  1. run in a sandboxed execution context and create the expected openclaw-sbx-* runtime, or
  2. clearly report that Claude CLI runner does not support sandbox execution, instead of showing runtime: sandboxed in sandbox explain.

If target="sandbox" browser requires sandboxBridgeUrl, then the user-facing error should mention that the current runner/session is not sandboxed or has no sandbox bridge, rather than saying agents.defaults.sandbox.browser.enabled is disabled.

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - 💡(How to fix) Fix [Bug] Sandbox policy reports runtime=sandboxed, but Claude CLI runner disables sandbox and target=sandbox browser is unavailable