Description

[Description]
/sandbox/.nemoclaw ownership changes from root:root (set by Dockerfile) to sandbox:sandbox at container runtime. This allows the sandbox user to create arbitrary files in the
.nemoclaw parent directory, bypassing the intended DAC protection layer.

[Environment]
Device: DGX (aarch64)
Kernel: 6.17.0-1008-nvidia
Node.js: v22.22.2
npm: 10.9.7
Docker: Docker Engine 29.1.3
OpenShell CLI: 0.0.24
NemoClaw: 0.1.0
OpenClaw: 2026.3.11 (29dc654)

[Steps to Reproduce]

1. nemoclaw onboard (complete full onboard flow)
2. nemoclaw my-assistant connect
3. ls -ld /sandbox/.nemoclaw

[Expected Result]
drwxr-xr-x root root (755, root-owned)

[Actual Result]
sandbox@my-assistant:~$ ls -ld /sandbox/.nemoclaw
drwxr-xr-x 3 sandbox sandbox 4096 Apr 8 08:41 /sandbox/.nemoclaw

[Root Cause Analysis]
Dockerfile sets chown root:root /sandbox/.nemoclaw — image build is correct.

Image-level verification (image built by docker build during nemoclaw onboard):
docker run --rm --entrypoint "" openshell/sandbox-from:1775637131 ls -ld /sandbox/.nemoclaw
drwxr-xr-x 1 root root 4096 ... /sandbox/.nemoclaw

However, ownership changes to sandbox:sandbox at runtime.

Bug Details

[NVB# 6059437]

[NVB#6059437]