openclaw - 💡(How to fix) Fix [2026.5.12 regression] bind-mounted :rw paths not included in writableRoots when workspaceAccess:ro

Summary

When an agent is configured with sandbox.mode: "all", workspaceAccess: "ro", and Docker bind mounts declared :rw, writes to those bind-mounted paths fail with operation not permitted. This worked in 2026.5.7 and regressed in 2026.5.12.

Reproduction

{
  "sandbox": {
    "mode": "all",
    "workspaceAccess": "ro",
    "docker": {
      "image": "openclaw-sandbox:bookworm-slim",
      "network": "none",
      "dangerouslyAllowExternalBindSources": true,
      "binds": [
        "/path/to/external/data:/data:rw"
      ]
    }
  }
}

Ask the agent to write anything to /data/ → operation not permitted.

Expected behavior

Writes to bind-mounted paths succeed. The binds are declared :rw and dangerouslyAllowExternalBindSources: true is explicitly set, which signals the operator's intent to allow writes to those paths.

Actual behavior

Bash writes to bind-mounted paths fail with operation not permitted.

Note: the OpenClaw write tool is also disabled when sandbox is active, but bash writes via bind mount are the primary concern here.

Root cause

In resolveCodexAppServerSandboxPolicyForOpenClawSandbox:

const effectiveWorkspace =
  sandbox.workspaceAccess === "rw"
    ? resolvedWorkspace
    : sandbox.workspaceDir;

return { type: "workspaceWrite", writableRoots: [effectiveWorkspace] };

When workspaceAccess: "ro", writableRoots is set to the scratch sandbox dir only. Bind-mounted paths are never added, regardless of their :rw declaration.

Suggested fix

When dangerouslyAllowExternalBindSources: true and bind mounts are declared :rw, include those mount target paths in writableRoots.

Workaround

sandbox.mode: "off" restores write functionality but disables sandboxing entirely.

Related issues

• #57271 and #46111 describe bind mount source path validation errors (sandbox fails to start without dangerouslyAllowExternalBindSources). This issue is distinct: the sandbox starts and Docker mounts correctly, but writes fail at the Codex app-server policy level.

Timeline

• 2026.5.7: works correctly
• 2026.5.12: regression introduced — resolveCodexAppServerSandboxPolicyForOpenClawSandbox is in the same file modified for #83347

Version

2026.5.18-beta.1