nemoclaw-user-manage-sandboxes
Compare original and translation side by side
🇺🇸
Original
English🇨🇳
Translation
Chinese<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
<!-- SPDX-License-Identifier: Apache-2.0 -->
<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
<!-- SPDX-License-Identifier: Apache-2.0 -->
Manage Sandbox Lifecycle
管理Sandbox生命周期
Use this guide after you finish the OpenClaw quickstart (use the skill).
It covers day-two sandbox operations such as listing sandboxes, checking health, managing ports, rebuilding safely, upgrading, and uninstalling.
When a workflow uses the lower-level OpenShell CLI, see CLI Selection Guide (use the skill) for the boundary between and .
nemoclaw-user-get-startednemoclaw-user-referencenemoclawopenshell完成OpenClaw快速入门(使用技能)后,请参考本指南。
本文涵盖Sandbox的日常运维操作,例如列出sandboxes、检查健康状态、管理端口、安全重建、版本升级及卸载等。
若工作流使用底层OpenShell CLI,请查看《CLI选择指南》(使用技能)了解与的适用边界。
nemoclaw-user-get-startednemoclaw-user-referencenemoclawopenshellList Sandboxes
列出Sandboxes
List every sandbox registered on this host:
console
$ nemoclaw listThe list shows each sandbox's model, provider, policy presets, active SSH session indicator, and dashboard URL when a dashboard port is recorded.
Use JSON output for scripts:
console
$ nemoclaw list --json列出当前主机上已注册的所有sandboxes:
console
$ nemoclaw list列表将显示每个sandbox的模型、提供商、策略预设、活跃SSH会话标识,以及已记录的仪表盘URL。
若要为脚本生成JSON格式的输出,请执行:
console
$ nemoclaw list --jsonCheck Sandbox Health
检查Sandbox健康状态
Check a specific sandbox's health, inference route, active connections, live policy, update status, and messaging-channel overlap warnings:
console
$ nemoclaw my-assistant statusUse the host-level status command when you want the sandbox inventory plus host auxiliary service state, such as cloudflared:
console
$ nemoclaw status检查特定sandbox的健康状态、推理路由、活跃连接、实时策略、更新状态及消息通道重叠警告:
console
$ nemoclaw my-assistant status若要查看sandbox清单及主机辅助服务(如cloudflared)的状态,请使用主机级别的状态命令:
console
$ nemoclaw statusInspect Logs
查看日志
View recent sandbox logs:
console
$ nemoclaw my-assistant logsStream logs while you reproduce a problem:
console
$ nemoclaw my-assistant logs --followThe log command reads both OpenClaw gateway output and OpenShell audit events, so policy denials appear beside gateway logs.
查看sandbox的近期日志:
console
$ nemoclaw my-assistant logs在复现问题时实时流式查看日志:
console
$ nemoclaw my-assistant logs --follow日志命令会同时读取OpenClaw网关输出和OpenShell审计事件,因此策略拒绝信息会与网关日志一同显示。
Collect Diagnostics
收集诊断信息
Collect diagnostics for bug reports or support handoff:
console
$ nemoclaw debug --sandbox my-assistant --output nemoclaw-debug.tar.gzUse for a smaller local summary:
--quickconsole
$ nemoclaw debug --quick --sandbox my-assistantThe debug command gathers system information, Docker state, gateway logs, and sandbox status.
收集诊断信息用于提交bug报告或移交支持团队:
console
$ nemoclaw debug --sandbox my-assistant --output nemoclaw-debug.tar.gz使用参数生成更精简的本地摘要:
--quickconsole
$ nemoclaw debug --quick --sandbox my-assistantdebug命令会收集系统信息、Docker状态、网关日志及sandbox状态。
Manage Dashboard Ports
管理仪表盘端口
If the forward stopped, or the installer reported that no active forward was found and the URL does not load, restart it manually with the port from the install summary.
console
$ openshell forward start --background <dashboard-port> my-gpt-clawTo list active forwards across all sandboxes, run the following command.
console
$ openshell forward list如果端口转发已停止,或安装程序提示未找到活跃转发且URL无法加载,请使用安装摘要中的端口手动重启转发:
console
$ openshell forward start --background <dashboard-port> my-gpt-claw要列出所有sandboxes的活跃转发,请执行以下命令:
console
$ openshell forward listRun Multiple Sandboxes
运行多个Sandboxes
Each sandbox needs its own dashboard port, since refuses to bind a port that another sandbox is already using.
When the default port is already held by another sandbox, scans ports through and uses the next free port.
openshell forwardnemoclaw onboard1878918799console
$ nemoclaw onboard # first sandbox uses 18789
$ nemoclaw onboard # second sandbox uses the next free port, such as 18790To choose a specific port, pass :
--control-ui-portconsole
$ nemoclaw onboard --control-ui-port 19000You can also set or before onboarding:
CHAT_UI_URLNEMOCLAW_DASHBOARD_PORTconsole
$ CHAT_UI_URL=http://127.0.0.1:19000 nemoclaw onboard
$ NEMOCLAW_DASHBOARD_PORT=19000 nemoclaw onboardFor full details on port conflicts and overrides, refer to Port already in use (use the skill).
nemoclaw-user-reference每个sandbox需要独立的仪表盘端口,因为会拒绝绑定已被其他sandbox占用的端口。
当默认端口已被占用时,会扫描18789至18799端口,并使用下一个可用端口。
openshell forwardnemoclaw onboardconsole
$ nemoclaw onboard # 第一个sandbox使用18789端口
$ nemoclaw onboard # 第二个sandbox使用下一个可用端口,例如18790若要指定特定端口,请传递参数:
--control-ui-portconsole
$ nemoclaw onboard --control-ui-port 19000你也可以在执行onboarding前设置或环境变量:
CHAT_UI_URLNEMOCLAW_DASHBOARD_PORTconsole
$ CHAT_UI_URL=http://127.0.0.1:19000 nemoclaw onboard
$ NEMOCLAW_DASHBOARD_PORT=19000 nemoclaw onboard有关端口冲突与覆盖的详细信息,请参考《端口已被占用》(使用技能)。
nemoclaw-user-referenceReconfigure or Recover
重新配置或恢复
Recover from a misconfigured sandbox without re-running the full onboard wizard or destroying workspace state.
无需重新运行完整的onboarding向导或销毁工作区状态,即可从配置错误的sandbox中恢复。
Change Inference Model or API
更改推理模型或API
Change the active model or provider at runtime without rebuilding the sandbox:
console
$ nemoclaw inference set --model <model> --provider <provider>Refer to Switch Inference Providers (use the skill) for provider-specific model IDs and API compatibility notes.
nemoclaw-user-configure-inference无需重建sandbox,即可在运行时更改活跃模型或提供商:
console
$ nemoclaw inference set --model <model> --provider <provider>有关提供商特定的模型ID及API兼容性说明,请参考《切换推理提供商》(使用技能)。
nemoclaw-user-configure-inferenceRestart the Gateway and Port Forward
重启网关与端口转发
If reports the sandbox is alive but the gateway is not running, run the recover command instead of opening a shell.
nemoclaw <name> statusconsole
$ nemoclaw <sandbox-name> recoverThe command restarts the in-sandbox gateway and re-establishes the dashboard port-forward in one step.
It is idempotent and safe to script.
Refer to (use the skill) for details.
nemoclaw <name> recovernemoclaw-user-reference若显示sandbox处于活跃状态但网关未运行,请执行recover命令,而非打开shell:
nemoclaw <name> statusconsole
$ nemoclaw <sandbox-name> recover该命令会一步重启sandbox内的网关并重新建立仪表盘端口转发。
它具有幂等性,可安全地用于脚本。
详细信息请参考(使用技能)。
nemoclaw <name> recovernemoclaw-user-referenceReset a Stored Credential
重置存储的凭证
If a provider credential was entered incorrectly during onboarding, clear the gateway-registered value and re-enter it on the next onboard run:
console
$ nemoclaw credentials list # see which providers are registered
$ nemoclaw credentials reset <PROVIDER> # clear a single provider, for example nvidia-prod
$ nemoclaw onboard # re-run to re-enter the cleared providerThe credentials command is documented in full at (use the skill).
nemoclaw credentials reset <PROVIDER>nemoclaw-user-reference若在onboarding期间输入的提供商凭证有误,请清除网关注册的值,并在下次运行onboarding时重新输入:
console
$ nemoclaw credentials list # 查看已注册的提供商
$ nemoclaw credentials reset <PROVIDER> # 清除单个提供商的凭证,例如nvidia-prod
$ nemoclaw onboard # 重新运行以重新输入已清除的提供商凭证凭证命令的完整文档请参考(使用技能)。
nemoclaw credentials reset <PROVIDER>nemoclaw-user-referenceRebuild a Sandbox While Preserving Workspace State
保留工作区状态的同时重建Sandbox
If you changed the underlying Dockerfile, upgraded OpenClaw, or want to pick up a new base image without losing your sandbox's workspace files, use instead of destroying and recreating:
rebuildconsole
$ nemoclaw <sandbox-name> rebuildRebuild preserves the mounted workspace and registered policies while recreating the container.
If NemoClaw cannot archive any requested state path, it reports the backup failure and stops before deleting the original sandbox.
Refer to (use the skill) for flag details.
nemoclaw <name> rebuildnemoclaw-user-reference若你修改了底层Dockerfile、升级了OpenClaw,或希望在不丢失sandbox工作区文件的情况下使用新的基础镜像,请使用命令,而非销毁并重新创建sandbox:
rebuildconsole
$ nemoclaw <sandbox-name> rebuildRebuild操作会保留挂载的工作区及已注册的策略,同时重新创建容器。
若NemoClaw无法归档任何请求的状态路径,它会报告备份失败并在删除原始sandbox前停止操作。
有关参数的详细信息,请参考(使用技能)。
nemoclaw <name> rebuildnemoclaw-user-referenceAdd a Network Preset After Onboarding
Onboarding后添加网络预设
Apply an additional preset, such as Telegram or GitHub, to a running sandbox without re-onboarding:
console
$ nemoclaw <sandbox-name> policy-addRefer to (use the skill) for usage details and flags.
nemoclaw <name> policy-addnemoclaw-user-referenceNon-interactive re-onboards in the default policy mode preserve presets added this way.
To make a re-onboard authoritative, set and provide with the exact list to apply; onboarding removes anything else.
See (use the skill) for the full table.
suggestedNEMOCLAW_POLICY_MODE=customNEMOCLAW_POLICY_PRESETSNEMOCLAW_POLICY_MODEnemoclaw-user-reference无需重新执行onboarding,即可向运行中的sandbox应用额外的预设(如Telegram或GitHub):
console
$ nemoclaw <sandbox-name> policy-add有关使用方法及参数的详细信息,请参考(使用技能)。
nemoclaw <name> policy-addnemoclaw-user-reference默认策略模式下的非交互式重新onboarding会保留以此方式添加的预设。
若要使重新onboarding具有权威性,请设置并提供参数指定要应用的精确预设列表;onboarding会移除列表外的所有预设。
完整表格请参考(使用技能)。
suggestedNEMOCLAW_POLICY_MODE=customNEMOCLAW_POLICY_PRESETSNEMOCLAW_POLICY_MODEnemoclaw-user-referenceUpdate to the Latest Version
更新至最新版本
When a new NemoClaw release becomes available, update the CLI on your host and check existing sandboxes for stale agent/runtime versions.
nemoclaw当NemoClaw发布新版本时,请更新主机上的 CLI,并检查现有sandboxes的agent/运行时版本是否过时。
nemoclawUpdate the NemoClaw CLI
更新NemoClaw CLI
Re-run the installer.
Before it onboards anything, the installer calls (use the skill) automatically, storing a snapshot of each running sandbox in as a safety net.
If your existing gateway is from OpenShell earlier than , the installer prompts before it runs the new automatic gateway upgrade path.
The automatic path is offered only when the existing CLI supports ; older installs must preserve sandbox state manually before retiring the gateway.
For unattended installs, set , or manually run and before rerunning the installer as .
nemoclaw backup-allnemoclaw-user-reference~/.nemoclaw/rebuild-backups/0.0.37nemoclawbackup-allNEMOCLAW_ACCEPT_EXPERIMENTAL_OPENSHELL_UPGRADE=1nemoclaw backup-allopenshell gateway destroy -g nemoclaw || openshell gateway destroycurl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_OPENSHELL_UPGRADE_PREPARED=1 bashconsole
$ curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash重新运行安装程序。
在执行任何onboarding操作前,安装程序会自动调用(使用技能),将每个运行中的sandbox的快照存储在目录中作为安全保障。
若你现有的网关来自版本早于的OpenShell,安装程序会在运行新的自动网关升级路径前进行提示。
仅当现有 CLI支持时才会提供自动升级路径;旧版本安装必须在停用网关前手动保留sandbox状态。
对于无人值守安装,请设置,或手动运行和,然后执行重新运行安装程序。
nemoclaw backup-allnemoclaw-user-reference~/.nemoclaw/rebuild-backups/0.0.37nemoclawbackup-allNEMOCLAW_ACCEPT_EXPERIMENTAL_OPENSHELL_UPGRADE=1nemoclaw backup-allopenshell gateway destroy -g nemoclaw || openshell gateway destroycurl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_OPENSHELL_UPGRADE_PREPARED=1 bashconsole
$ curl -fsSL https://www.nvidia.com/nemoclaw.sh | bashUpgrade Sandboxes with Stale Agent and Runtime Versions
升级agent与运行时版本过时的Sandboxes
The installer checks registered sandboxes after onboarding succeeds and runs for stale running sandboxes.
Use directly to verify the result, rebuild when you skipped the installer or onboarding step, or handle sandboxes that were stopped or could not be version-checked.
The upgrade flow is non-destructive by default because NemoClaw preserves manifest-defined workspace state, but a manual snapshot before any major upgrade gives you a state restore point.
nemoclaw upgrade-sandboxes --autoupgrade-sandboxesconsole
$ nemoclaw <sandbox-name> snapshot create --name pre-upgrade # optional, recommended
$ nemoclaw update --yes # updates CLI through the maintained installer flow
$ nemoclaw upgrade-sandboxes --check # verify or list remaining stale/unknown sandboxes
$ nemoclaw upgrade-sandboxes # manually rebuild remaining stale running sandboxesnemoclaw updatecurl -fsSL https://www.nvidia.com/nemoclaw.sh | bashnemoclaw update --checkFor scripted manual rebuilds, use to skip the confirmation prompt.
nemoclaw upgrade-sandboxes --autoIf the upgraded sandbox needs its workspace state reverted, restore the pre-upgrade snapshot into the running sandbox.
This restores saved state directories only; it does not downgrade the sandbox image or agent/runtime:
console
$ nemoclaw <sandbox-name> snapshot restore pre-upgrade安装程序在onboarding成功后会检查已注册的sandboxes,并对运行中版本过时的sandboxes执行。
若你跳过了安装程序或onboarding步骤,或需要处理已停止或无法检查版本的sandboxes,请直接使用命令验证结果并重建。
默认情况下,升级流程是非破坏性的,因为NemoClaw会保留清单定义的工作区状态,但在进行重大升级前手动创建快照可提供状态恢复点。
nemoclaw upgrade-sandboxes --autoupgrade-sandboxesconsole
$ nemoclaw <sandbox-name> snapshot create --name pre-upgrade # 可选,推荐执行
$ nemoclaw update --yes # 通过维护的安装流程更新CLI
$ nemoclaw upgrade-sandboxes --check # 验证或列出剩余的过时/未知版本sandboxes
$ nemoclaw upgrade-sandboxes # 手动重建剩余的运行中过时版本sandboxesnemoclaw updatecurl -fsSL https://www.nvidia.com/nemoclaw.sh | bashnemoclaw update --check对于脚本化的手动重建,请使用跳过确认提示。
nemoclaw upgrade-sandboxes --auto若升级后的sandbox需要恢复工作区状态,请将升级前的快照恢复到运行中的sandbox。
此操作仅恢复保存的状态目录;不会降级sandbox镜像或agent/运行时版本:
console
$ nemoclaw <sandbox-name> snapshot restore pre-upgradeWhat Changes During a Rebuild
重建期间会发生哪些变化
Each rebuild destroys the existing container and creates a new one.
NemoClaw protects your data through the same backup-and-restore flow as (use the skill):
nemoclaw <name> rebuildnemoclaw-user-reference- NemoClaw preserves manifest-defined workspace state. Before deleting the old container, NemoClaw snapshots the state directories and durable state files defined in the agent manifest, typically ; for Hermes this also includes
/sandbox/.openclaw/workspace/and the SQLite database behindSOUL.md. Stored credentials (.hermes/state.db) and registered policy presets live on the host and are re-applied to the new sandbox automatically.~/.nemoclaw/credentials.json - NemoClaw does not preserve runtime changes outside the workspace state directories. This includes packages installed inside the running container with or
apt, files in non-workspace paths, and in-memory or process state. If you have customized the running container at runtime, capture that aspipchanges forDockerfileor a manualnemoclaw onboard --frombefore the rebuild starts.openshell sandbox download
Aborts before the destroy step are non-destructive.
The flow refuses to proceed past preflight if a credential is missing or past backup if required manifest-defined state cannot be copied, so a failed run leaves the original sandbox intact and ready to retry.
When a backup command reports partial archive output, NemoClaw keeps the usable entries and reports only the manifest-defined paths that could not be archived.
See Backup and Restore (use the skill) for the full list of state-preservation guarantees, snapshot retention, and instructions for manual backups when the auto-flow is not enough.
nemoclaw-user-manage-sandboxesIf the rebuild aborts with :
Missing credential: <KEY>The rebuild preflight reads the provider credential recorded by your last session.
If you have switched providers since onboarding, for example from a remote API to a local Ollama setup, the preflight may still reference the old key and fail before any destroy step runs.
nemoclaw onboardTo recover, re-run and select your current provider.
This refreshes the session metadata.
Your existing container keeps serving traffic until the new image is ready.
nemoclaw onboard每次重建都会销毁现有容器并创建新容器。
NemoClaw通过与(使用技能)相同的备份与恢复流程保护你的数据:
nemoclaw <name> rebuildnemoclaw-user-reference- NemoClaw会保留清单定义的工作区状态。在删除旧容器前,NemoClaw会对agent清单中定义的状态目录和持久化状态文件创建快照,通常包括;对于Hermes,还包括
/sandbox/.openclaw/workspace/和SOUL.md背后的SQLite数据库。存储的凭证(.hermes/state.db)和已注册的策略预设存储在主机上,会自动应用到新的sandbox。~/.nemoclaw/credentials.json - NemoClaw不会保留工作区状态目录之外的运行时更改。这包括使用或
apt在运行中的容器内安装的包、非工作区路径中的文件,以及内存或进程状态。若你在运行时自定义了容器,请在重建开始前将其捕获为pip的Dockerfile更改,或手动执行nemoclaw onboard --from。openshell sandbox download
在销毁步骤前中止操作是非破坏性的。
如果缺少凭证,预检查会拒绝继续;如果无法复制所需的清单定义状态,备份步骤会拒绝继续,因此失败的运行会保留原始sandbox并可重试。
当备份命令报告部分归档输出时,NemoClaw会保留可用条目,并仅报告无法归档的清单定义路径。
有关状态保留保障、快照保留策略,以及自动流程不足时的手动备份说明,请参考《备份与恢复》(使用技能)。
nemoclaw-user-manage-sandboxes若重建因中止:
Missing credential: <KEY>重建预检查会读取你上次会话记录的提供商凭证。
若你在onboarding后切换了提供商(例如从远程API切换到本地Ollama设置),预检查可能仍会引用旧密钥并在销毁步骤前失败。
nemoclaw onboard要恢复,请重新运行并选择当前提供商。
这会刷新会话元数据。
现有容器会继续提供服务,直到新镜像准备就绪。
nemoclaw onboardUninstall
卸载
To remove NemoClaw and all resources created during setup, run the CLI's built-in uninstall command:
bash
nemoclaw uninstall| Flag | Effect |
|---|---|
| Skip the confirmation prompt. |
| Leave OpenShell binaries installed. |
| Also remove NemoClaw-pulled Ollama models. |
nemoclaw uninstalluninstall.shIf the CLI is missing or broken, fall back to the hosted script:
nemoclawbash
curl -fsSL https://raw.githubusercontent.com/NVIDIA/NemoClaw/refs/heads/main/uninstall.sh | bashThe same , , and flags listed above also apply to the hosted script. Pass them after .
--yes--keep-openshell--delete-modelsbash -s --bash
curl -fsSL https://raw.githubusercontent.com/NVIDIA/NemoClaw/refs/heads/main/uninstall.sh | bash -s -- --yes --delete-modelsFor a full comparison of the two forms, including what they fetch, what they trust, and when to prefer each, see vs. the hosted (use the skill).
nemoclaw uninstalluninstall.shnemoclaw-user-reference要移除NemoClaw及安装过程中创建的所有资源,请运行CLI内置的卸载命令:
bash
nemoclaw uninstall| 参数 | 效果 |
|---|---|
| 跳过确认提示。 |
| 保留OpenShell二进制文件。 |
| 同时移除NemoClaw拉取的Ollama模型。 |
nemoclaw uninstalluninstall.sh若 CLI丢失或损坏,请使用托管脚本作为备选:
nemoclawbash
curl -fsSL https://raw.githubusercontent.com/NVIDIA/NemoClaw/refs/heads/main/uninstall.sh | bash上述、和参数同样适用于托管脚本,请在后传递这些参数。
--yes--keep-openshell--delete-modelsbash -s --bash
curl -fsSL https://raw.githubusercontent.com/NVIDIA/NemoClaw/refs/heads/main/uninstall.sh | bash -s -- --yes --delete-models有关两种形式的完整对比(包括获取内容、信任机制及适用场景),请参考 vs. 托管(使用技能)。
nemoclaw uninstalluninstall.shnemoclaw-user-referenceReferences
参考资料
- references/runtime-controls.md — Single page that answers what can change at runtime versus what requires a rebuild for NemoClaw sandboxes.
- Load references/backup-restore.md when downloading workspace files from a sandbox, uploading restored files into a new sandbox, or preserving sandbox state across rebuilds. Backs up and restores OpenClaw workspace files before destructive operations such as sandbox rebuilds.
- Load references/messaging-channels.md when setting up messaging channels, chat interfaces, or integrations without relying on nemoclaw tunnel start for bridges. Explains how Telegram, Discord, Slack, and WhatsApp reach sandboxed OpenClaw and Hermes agents through OpenShell-managed processes and NemoClaw channel commands.
- Load references/workspace-files.md when users ask about ,
SOUL.md,USER.md,IDENTITY.md, or other workspace files, or when preparing to back up or restore workspace state. Explains what workspace personality and configuration files are, where they live, and how they persist across sandbox restarts.AGENTS.md
- references/runtime-controls.md — 单页文档,解答NemoClaw sandboxes哪些内容可在运行时更改、哪些内容需要重建。
- 加载references/backup-restore.md:当从sandbox下载工作区文件、将恢复的文件上传到新sandbox,或在重建期间保留sandbox状态时参考。该文档介绍了在sandbox重建等破坏性操作前备份与恢复OpenClaw工作区文件的方法。
- 加载references/messaging-channels.md:当设置消息通道、聊天界面或集成,且不依赖nemoclaw tunnel start搭建桥梁时参考。该文档解释了Telegram、Discord、Slack和WhatsApp如何通过OpenShell管理的进程及NemoClaw通道命令与沙箱化的OpenClaw和Hermes agents通信。
- 加载references/workspace-files.md:当用户询问、
SOUL.md、USER.md、IDENTITY.md或其他工作区文件,或准备备份/恢复工作区状态时参考。该文档解释了工作区个性与配置文件的用途、存储位置,以及如何在sandbox重启后持久化。AGENTS.md
Related Skills
相关技能
- — Monitor Sandbox Activity (use the
nemoclaw-user-monitor-sandboxskill) for observability toolsnemoclaw-user-monitor-sandbox
- — 监控Sandbox活动(使用
nemoclaw-user-monitor-sandbox技能),获取可观测性工具相关内容nemoclaw-user-monitor-sandbox