Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: Sandbox prune does not clean up workspace directory [2 pull requests, 1 comments, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#43797•Fetched 2026-04-08 00:17:59
View on GitHub
Comments
1
Participants
1
Timeline
15
Reactions
0
Author
climbranclimbran
Participants
climbranclimbran
Timeline (top)
referenced ×9cross-referenced ×3labeled ×2commented ×1

Sandbox prune removes Docker containers but leaves workspace directories behind, causing disk space leak over time

Root Cause

Sandbox prune removes Docker containers but leaves workspace directories behind, causing disk space leak over time

Fix Action

Fixed

PR fix notes

PR #43831: fix(sandbox): prune should also clean up workspace directories

Description (problem / solution / changelog)

Summary

  • Problem: Sandbox prune removes Docker containers but leaves workspace directories (~/.openclaw/sandboxes/) behind, causing disk space leak
  • Why it matters: Over time, orphaned directories accumulate and waste disk space
  • What changed: Added workspace directory cleanup in pruneSandboxContainers onRemoved callback
  • What did NOT change: Shared scope workspaces are preserved (not deleted)

Change Type

  • Bug fix

Scope

  • Gateway / orchestration

Linked Issue

  • Closes #43797

User-visible Changes

  • Sandbox prune now cleans up both Docker containers AND workspace directories

Security Impact

  • New permissions/capabilities? No
  • Secrets/tokens handling changed? No
  • New/changed network calls? No
  • Command/tool execution surface changed? No
  • Data access scope changed? No

Repro + Verification

Steps

  1. Configure sandbox.prune.idleHours or sandbox.prune.maxAgeDays
  2. Wait for sandbox to expire (or trigger prune manually)
  3. Check ~/.openclaw/sandboxes/

Expected

Both Docker containers AND workspace directories are removed.

Actual (before fix)

Only Docker containers removed. Workspace directories persist.

Evidence

  • Code change is straightforward and follows existing patterns

Human Verification

  • Verified: onRemoved callback correctly computes workspace directory path
  • Verified: Only deletes when scope is not shared
  • Verified: Gracefully handles ENOENT/ENOTDIR errors

Compatibility

  • Backward compatible? Yes
  • Config/env changes? No
  • Migration needed? No

Failure Recovery

  • Revert this commit if issues arise
  • No config changes to restore

Risks

  • Risk: Accidental deletion of workspace still in use
    • Mitigation: Only delete when scope is session/agent (not shared), and only after container is already removed

Changed files

  • apps/macos/Sources/OpenClawProtocol/GatewayModels.swift (modified, +5/-9)
  • apps/shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift (modified, +5/-9)
  • src/agents/sandbox/prune.ts (modified, +25/-1)

PR #43835: fix(sandbox): cleanup workspace directories during prune

Description (problem / solution / changelog)

Summary

Fixes #43797

Sandbox prune removes Docker containers but leaves workspace directories behind, causing disk space leaks. This PR adds cleanup for the workspace directories.

Changes

  • Added workspace directory cleanup after container removal
  • Uses existing resolveSandboxScopeKey and resolveSandboxWorkspaceDir helpers
  • Skips cleanup for shared scope to avoid affecting other sessions

Test Plan

  • All 164 existing sandbox tests pass
  • Manually verified edge cases (shared scope, missing directories)

Changed files

  • src/agents/sandbox/prune.ts (modified, +29/-1)
RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Summary

Sandbox prune removes Docker containers but leaves workspace directories behind, causing disk space leak over time

Steps to reproduce

  1. Configure an agent with sandbox.prune.idleHours or sandbox.prune.maxAgeDays (e.g., idleHours: 168)
  2. Wait for the sandbox to expire (or trigger prune manually via openclaw sandbox prune)
  3. Check ~/.openclaw/sandboxes/ - old directories remain
  4. Docker containers are removed, but the agent-<agentid>-xxxx directories persist

Expected behavior

Both Docker containers AND workspace directories (~/.openclaw/sandboxes/agent-<agentid>-xxxx) should be cleaned up when sandbox expires due to idleHours or maxAgeDays

Actual behavior

Only Docker containers are removed (via docker rm -f). The workspace directories in ~/.openclaw/sandboxes/ persist after prune. This causes disk space leak over time.

OpenClaw version

2026.3.8

Operating system

macOS 25.2.0 (arm64)

Install method

No response

Model

minimax/MiniMax-M2.5

Provider / routing chain

minimax-portal (direct)

Config file / key location

No response

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

Affected: Users with sandbox-enabled agents using prune settings Severity: Medium (disk space leak) Frequency: Always when sandbox expires Consequence: Over time, ~/.openclaw/sandboxes/ fills up with orphaned directories, wasting disk space

Additional information

Source code location: src/agents/sandbox/prune.ts - the pruneSandboxRegistryEntries function only removes Docker containers and registry entries, but does not delete the workspace directory (~/.openclaw/sandboxes/agent-<agentid>-xxxx). Suggested fix: add fs.rm() to remove the sandbox workspace directory after container removal.

extent analysis

Problem Summary

openclaw sandbox prune deletes the Docker container but leaves the sandbox workspace directory (~/.openclaw/sandboxes/agent-<agentid>-xxxx) on disk, causing a gradual disk‑space leak.

Root Cause

src/agents/sandbox/prune.ts → pruneSandboxRegistryEntries only calls docker rm -f and removes the registry entry. It never removes the on‑disk workspace folder.

Fix Plan

  1. Add filesystem cleanup

    • After the container is removed, delete the sandbox directory with fs.promises.rm (recursive, force).
    • Wrap in a try/catch so a failure to delete does not abort the whole prune run.

  2. Update imports

    import { promises as fs } from "fs";

  3. Modify pruneSandboxRegistryEntries (excerpt)

    // src/agents/sandbox/prune.ts
import { promises as fs } from "fs";
import { exec } from "child_process";
// … other imports

export async function pruneSandboxRegistryEntries() {
  const entries = await loadSandboxRegistry(); // whatever loads the JSON map
  for (const [key, entry] of Object.entries(entries)) {
    try {
      // 1️⃣ Remove Docker container
      await execPromise(`docker rm -f ${entry.containerId}`);

      // 2️⃣ Remove workspace directory
      const sandboxPath = path.join(os.homedir(), ".openclaw", "sandboxes", entry.dirName);
      await fs.rm(sandboxPath, { recursive: true, force: true });
      console.log(`✅ Deleted sandbox folder ${sandboxPath}`);

      // 3️⃣ Remove registry entry
      delete entries[key];
    } catch (err) {
      console.error(`⚠️ Failed to prune sandbox ${key}:`, err);
      // continue with next entry
    }
  }

  await saveSandboxRegistry(entries);
}

// Helper to promisify exec
function execPromise(cmd: string): Promise<{ stdout: string; stderr: string }> {
  return new Promise((resolve, reject) => {
    exec(cmd

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Both Docker containers AND workspace directories (~/.openclaw/sandboxes/agent-<agentid>-xxxx) should be cleaned up when sandbox expires due to idleHours or maxAgeDays

#api#ssr#installation#tensor shape#autograd error#retriever error#indexing error#inference speed#output truncation#response parsing

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING