openclaw - 💡(How to fix) Fix docker.binds rejected for paths outside per-session sandbox dir [1 participants]

Bug

sandbox.docker.binds rejects bind mount sources outside the per-session sandbox directory and agent workspace, even though the sandboxing docs show examples with arbitrary host paths (/home/user/source, /var/data/myapp, /mnt/cache).

Error

Sandbox security: bind mount "/Users/X/.openclaw/sandboxes/agent-io/systems/outbox:/outbox:rw"
source "/Users/X/.openclaw/sandboxes/agent-io/systems/outbox" is outside allowed roots
(/Users/X/.openclaw/sandboxes/agent-systems-main-060f8cd1, /Users/X/.openclaw/workspace-systems).
Use a dangerous override only when you fully trust this runtime.

Reproduction

1. Create a directory outside the per-session sandbox dir:

   mkdir -p ~/.openclaw/custom-data/outbox

2. Add a bind mount to any sandboxed agent:

   {
     "id": "myagent",
     "sandbox": {
       "mode": "all",
       "docker": {
         "binds": ["/Users/X/.openclaw/custom-data/outbox:/outbox:rw"]
       }
     }
   }

3. Trigger the agent — sandbox creation fails with the above error.

Expected

Per the docs, docker.binds should accept any host path except explicitly dangerous ones (docker.sock, /etc, /proc, /sys, /dev). The security boundary should be the bind mode (:ro/:rw), not a path allowlist restricted to the per-session sandbox hash directory.

Actual

The runtime only allows bind sources from:

1. The per-session sandbox dir (~/.openclaw/sandboxes/agent-{id}-{hash})
2. The agent workspace (~/.openclaw/workspace-{id})

Any other path — including subdirectories of ~/.openclaw/ itself — is rejected.

Additional context

• The error message says "Use a dangerous override only when you fully trust this runtime" but no such override flag is documented.
• Tested with paths inside ~/.openclaw/agent-io/, ~/.openclaw/sandboxes/agent-io/, and ~/.openclaw/data-lake/ — all rejected.
• Workaround: use workspaceAccess: "rw" and write to the agent workspace instead.
• Three separate attempts, all failed with the same error.

Environment

• OpenClaw: latest (npm)
• Docker: OrbStack
• OS: macOS 15 (Apple Silicon M1)