Description
Summary
The OpenClaw gateway config file (/sandbox/.openclaw/openclaw.json) is owned by root with 0444 permissions. The sandbox user has no sudo access and the process policy rejects root. There is no documented or supported way to change the agents.defaults.model.primary field from inference/nvidia/nemotron-3-super-120b-a12b to a third-party provider (e.g., anthropic/claude-sonnet-4-6).
The host-side openshell inference set command correctly configures inference routing at the gateway level, but OpenClaw inside the sandbox still reads its own config to determine which model string to request. Changing the inference provider on the host is necessary but not sufficient — the sandbox-side config must also be updated, and there is no writable path to do so through the documented tooling.
Reproduction Steps
Steps to Reproduce
Complete nemoclaw onboard with default settings.
Create an Anthropic provider on the host:
text
export ANTHROPIC_API_KEY="sk-ant-..."
openshell provider create --name anthropic-prod --type anthropic --from-existing
Point inference routing at Anthropic:
text
openshell inference set --provider anthropic-prod --model claude-sonnet-4-6 --no-verify
Connect to the sandbox and attempt to update the OpenClaw config:
text
nemoclaw nemoclaw-sandbox connect
python3 -c "
import json
with open('/sandbox/.openclaw/openclaw.json', 'r') as f:
cfg = json.load(f)
cfg['agents']['defaults']['model']['primary'] = 'anthropic/claude-sonnet-4-6'
with open('/sandbox/.openclaw/openclaw.json', 'w') as f:
json.dump(cfg, f, indent=2)
"
Result: PermissionError: [Errno 13] Permission denied: '/sandbox/.openclaw/openclaw.json'
Environment
Environment
NemoClaw: v0.1.0
OpenClaw: 2026.3.11
OpenShell cluster image: ghcr.io/nvidia/openshell/cluster:0.0.14
Host OS: Ubuntu 24.04 (Hostinger VPS, KVM2)
Docker: Running (no K3s on host — K3s is embedded inside the cluster container)
Debug Output
Logs
Checklist
Description
Summary
The OpenClaw gateway config file (/sandbox/.openclaw/openclaw.json) is owned by root with 0444 permissions. The sandbox user has no sudo access and the process policy rejects root. There is no documented or supported way to change the agents.defaults.model.primary field from inference/nvidia/nemotron-3-super-120b-a12b to a third-party provider (e.g., anthropic/claude-sonnet-4-6).
The host-side openshell inference set command correctly configures inference routing at the gateway level, but OpenClaw inside the sandbox still reads its own config to determine which model string to request. Changing the inference provider on the host is necessary but not sufficient — the sandbox-side config must also be updated, and there is no writable path to do so through the documented tooling.
Reproduction Steps
Steps to Reproduce
Complete nemoclaw onboard with default settings.
Create an Anthropic provider on the host:
text
export ANTHROPIC_API_KEY="sk-ant-..."
openshell provider create --name anthropic-prod --type anthropic --from-existing
Point inference routing at Anthropic:
text
openshell inference set --provider anthropic-prod --model claude-sonnet-4-6 --no-verify
Connect to the sandbox and attempt to update the OpenClaw config:
text
nemoclaw nemoclaw-sandbox connect
python3 -c "
import json
with open('/sandbox/.openclaw/openclaw.json', 'r') as f:
cfg = json.load(f)
cfg['agents']['defaults']['model']['primary'] = 'anthropic/claude-sonnet-4-6'
with open('/sandbox/.openclaw/openclaw.json', 'w') as f:
json.dump(cfg, f, indent=2)
"
Result: PermissionError: [Errno 13] Permission denied: '/sandbox/.openclaw/openclaw.json'
Environment
Environment
NemoClaw: v0.1.0
OpenClaw: 2026.3.11
OpenShell cluster image: ghcr.io/nvidia/openshell/cluster:0.0.14
Host OS: Ubuntu 24.04 (Hostinger VPS, KVM2)
Docker: Running (no K3s on host — K3s is embedded inside the cluster container)
Debug Output
Logs
Checklist