Customize the Sandbox Network Policy

Gotchas

• Custom preset hosts bypass NemoClaw's review process and can widen sandbox egress to arbitrary destinations.

Prerequisites

• A running NemoClaw sandbox for dynamic changes, or the NemoClaw source repository for static changes.
• The OpenShell CLI on your PATH.

Add, remove, or modify the endpoints that the sandbox is allowed to reach.

The sandbox policy is defined in a declarative YAML file in the NemoClaw repository and enforced at runtime by NVIDIA OpenShell. NemoClaw supports both static policy changes that persist across restarts and dynamic updates applied to a running sandbox through the OpenShell CLI.