sbx/openclaw-kit:20260831-e777e45cf0f81f48a6681d61dd255d5293622723

schemaVersion: "2"
kind: sandbox
name: openclaw
displayName: OpenClaw
description: Personal AI assistant with multi-platform chat, skills, and gateway support. Uses a pre-baked image so sandboxes start in seconds.
sandbox:
    image: docker.io/sbx/openclaw-image:latest
    entrypoint:
        - sh
    command:
        default:
            - /home/agent/.local/bin/openclaw-start.sh
        interactive:
            - /home/agent/.local/bin/openclaw-start.sh
agentInstructions:
    filename: AGENTS.md
permissions:
    network:
        allow:
            - api.anthropic.com
            - claude.ai
            - console.anthropic.com
            - openrouter.ai
            - auth.docker.io
            - production.cloudfront.docker.com
            - registry-1.docker.io
            - registry.npmjs.org
            - '*.npmjs.org'
            - clawhub.ai:443
            - raw.githubusercontent.com
            - '*.telegram.org'
            - '*.discord.com'
            - gateway.discord.gg
            - '*.whatsapp.com'
            - '*.whatsapp.net'
            - '*.slack.com'
            - platform.claude.com:443
            - openclaw.ai
            - docs.openclaw.ai
ports:
    - container: 18789
      name: gateway
credentials:
    - service: anthropic
      apiKey:
        name: ANTHROPIC_API_KEY
        proxyManaged: true
        inject:
            - domain: api.anthropic.com
              header: x-api-key
              format: '%s'
            - domain: claude.ai
              header: x-api-key
              format: '%s'
            - domain: console.anthropic.com
              header: x-api-key
              format: '%s'
      oauth:
        tokenEndpoint:
            host: platform.claude.com
            path: /v1/oauth/token
        resourceHosts:
            - api.anthropic.com
        sentinels:
            accessToken: sk-ant-oat01-proxy-managed
            refreshToken: sk-ant-ort01-proxy-managed
        credentialFile:
            path: ~/.claude/.credentials.json
            structure:
                claudeAiOauth:
                    accessToken: '{{.AccessToken}}'
                    expiresAt: '{{.ExpiresAt}}'
                    refreshToken: '{{.RefreshToken}}'
                    scopes: '{{.Scopes}}'
environment:
    variables:
        OPENCLAW_STATE_DIR: /home/agent/.openclaw
        PLAYWRIGHT_BROWSERS_PATH: /opt/ms-playwright
setup:
    startup:
        - command:
            - sh
            - /home/agent/.local/bin/openclaw-gateway-up.sh
          user: "1000"
          description: Start the OpenClaw gateway so the published port and CLI work without attaching the TUI