fix: remove docker policy preset (#1406) by zyang-dev · Pull Request #1647 · NVIDIA/NemoClaw

zyang-dev · 2026-04-08T23:20:15Z

Summary

Remove the docker policy preset. There is no practical use case for Docker registry access from inside the sandbox.

Related Issue

Fixes #1406

Changes

Delete nemoclaw-blueprint/policies/presets/docker.yaml
Update test/policies.test.js — remove docker from expected presets, update count from 11 to 10
Update docs/security/best-practices.md — remove docker preset reference
Update .agents/skills/nemoclaw-security-best/references/best-practices.md — same

Type of Change

Code change for a new feature, bug fix, or refactor.
Code change with doc updates.
Doc only. Prose changes without code sample modifications.
Doc only. Includes code sample changes.

Testing

npx prek run --all-files passes (or equivalently make check).
npm test passes.
make docs builds without warnings. (for doc-only changes)

Checklist

General

I have read and followed the contributing guide.
I have read and followed the style guide. (for doc-only changes)

Code Changes

Formatters applied — npx prek run --all-files auto-fixes formatting (or make format for targeted runs).
Tests added or updated for new or changed behavior.
No secrets, API keys, or credentials committed.
Doc pages updated for any user-facing behavior changes (new commands, changed defaults, new features, bug fixes that contradict existing docs).

Doc Changes

Follows the style guide. Try running the nemoclaw-contributor-update-docs agent skill to draft changes while complying with the style guide. For example, prompt your agent with "/nemoclaw-contributor-update-docs catch up the docs for the new changes I made in this PR."
New pages include SPDX license header and frontmatter, if creating a new page.
Cross-references and links verified.

Signed-off-by: zyang-dev 267119621+zyang-dev@users.noreply.github.com

Summary by CodeRabbit

Release Notes

Documentation
- Updated security best practices guidance for the Development posture profile, removing the recommendation to apply the Docker policy preset for agents that build or pull container images.
Chores
- Removed the Docker policy preset definition and its associated network policy configurations.
- Updated test expectations to reflect the removal of the Docker preset.

Signed-off-by: zyang-dev <267119621+zyang-dev@users.noreply.github.com>

coderabbitai · 2026-04-08T23:20:28Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 07498c99-4f92-44df-911c-6fe3d6bb4884

📥 Commits

Reviewing files that changed from the base of the PR and between 8f6995c and 550d57d.

📒 Files selected for processing (4)

.agents/skills/nemoclaw-user-configure-security/references/best-practices.md
docs/security/best-practices.md
nemoclaw-blueprint/policies/presets/docker.yaml
test/policies.test.js

💤 Files with no reviewable changes (3)

docs/security/best-practices.md
.agents/skills/nemoclaw-user-configure-security/references/best-practices.md
nemoclaw-blueprint/policies/presets/docker.yaml

📝 Walkthrough

Walkthrough

This PR removes the non-functional docker policy preset definition and updates all related documentation and test expectations. The preset specified a binary path (/usr/bin/docker) that does not exist in the NemoClaw sandbox environment, rendering the policy ineffective.

Changes

Cohort / File(s)	Summary
Documentation updates `.agents/skills/nemoclaw-user-configure-security/references/best-practices.md`, `docs/security/best-practices.md`	Removed guidance instructing agents to apply the `docker` preset when building or pulling container images.
Policy preset deletion `nemoclaw-blueprint/policies/presets/docker.yaml`	Deleted entire preset configuration (`network_policies.docker_registries` for Docker Hub and NVIDIA registries with binary scope `/usr/bin/docker`).
Test expectations `test/policies.test.js`	Updated `listPresets` test to expect 10 presets instead of 11; removed `"docker"` from asserted preset names list.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Poem

🐰 A docker so broken, now gone with the breeze,
The sandbox ne'er had /usr/bin/docker to please,
With preset removed and tests made anew,
The config now shines, functional and true! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix: remove docker policy preset' accurately describes the primary change: removing the unusable docker policy preset file and related references.
Linked Issues check	✅ Passed	The PR fully addresses issue `#1406` by removing the docker preset file, updating documentation, and adjusting tests to reflect the removal.
Out of Scope Changes check	✅ Passed	All changes are directly related to removing the docker preset and its references; no out-of-scope modifications are present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/remove-docker-preset

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

## Summary - Document `nemoclaw credentials list` and `nemoclaw credentials reset` commands in commands reference (#1597) - Add `--dry-run` flag documentation for `policy-add` (#1276) - Update policy presets table: remove `docker` (#1647), add `brave` and `brew`, update HuggingFace endpoint (#1540) - Document `NEMOCLAW_LOCAL_INFERENCE_TIMEOUT` env var for local providers (#1620) - Document `NEMOCLAW_PROXY_HOST`/`NEMOCLAW_PROXY_PORT` env vars (#1563) - Add troubleshooting entries for Docker group permissions (#1614), sandbox survival after gateway restart (#1587), and proxy configuration - Regenerate `nemoclaw-user-*` skills from updated docs ## Test plan - [x] `make docs` builds without warnings - [x] All pre-commit and pre-push hooks pass - [ ] Verify rendered pages in docs site preview 🤖 Generated with [Claude Code](https://claude.com/claude-code)  ## Summary by CodeRabbit * **New Features** * Added `nemoclaw credentials list` command to display stored credential names * Added `nemoclaw credentials reset <KEY>` command with `--yes` flag to remove credentials * Added `--dry-run` flag for policy-add to preview endpoint changes * New policy presets: `brave` and `brew` * New configuration options: `NEMOCLAW_LOCAL_INFERENCE_TIMEOUT`, `NEMOCLAW_PROXY_HOST`, and `NEMOCLAW_PROXY_PORT` * **Documentation** * Expanded troubleshooting guides for Docker permissions, sandbox connectivity, local inference timeouts, and proxy configuration  Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

## Summary Remove the `docker` policy preset. There is no practical use case for Docker registry access from inside the sandbox. ## Related Issue Fixes NVIDIA#1406 ## Changes - Delete `nemoclaw-blueprint/policies/presets/docker.yaml` - Update `test/policies.test.js` — remove `docker` from expected presets, update count from 11 to 10 - Update `docs/security/best-practices.md` — remove docker preset reference - Update `.agents/skills/nemoclaw-security-best/references/best-practices.md` — same ## Type of Change - [x] Code change for a new feature, bug fix, or refactor. - [x] Code change with doc updates. - [ ] Doc only. Prose changes without code sample modifications. - [ ] Doc only. Includes code sample changes. ## Testing - [x] `npx prek run --all-files` passes (or equivalently `make check`). - [x] `npm test` passes. - [ ] `make docs` builds without warnings. (for doc-only changes) ## Checklist ### General - [x] I have read and followed the [contributing guide](https://github.com/NVIDIA/NemoClaw/blob/main/CONTRIBUTING.md). - [ ] I have read and followed the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). (for doc-only changes) ### Code Changes - [x] Formatters applied — `npx prek run --all-files` auto-fixes formatting (or `make format` for targeted runs). - [x] Tests added or updated for new or changed behavior. - [x] No secrets, API keys, or credentials committed. - [x] Doc pages updated for any user-facing behavior changes (new commands, changed defaults, new features, bug fixes that contradict existing docs). ### Doc Changes - [x] Follows the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). Try running the `nemoclaw-contributor-update-docs` agent skill to draft changes while complying with the style guide. For example, prompt your agent with "`/nemoclaw-contributor-update-docs` catch up the docs for the new changes I made in this PR." - [ ] New pages include SPDX license header and frontmatter, if creating a new page. - [x] Cross-references and links verified. ---  Signed-off-by: zyang-dev <267119621+zyang-dev@users.noreply.github.com>  ## Summary by CodeRabbit ## Release Notes * **Documentation** * Updated security best practices guidance for the Development posture profile, removing the recommendation to apply the Docker policy preset for agents that build or pull container images. * **Chores** * Removed the Docker policy preset definition and its associated network policy configurations. * Updated test expectations to reflect the removal of the Docker preset.  Signed-off-by: zyang-dev <267119621+zyang-dev@users.noreply.github.com>

## Summary - Document `nemoclaw credentials list` and `nemoclaw credentials reset` commands in commands reference (NVIDIA#1597) - Add `--dry-run` flag documentation for `policy-add` (NVIDIA#1276) - Update policy presets table: remove `docker` (NVIDIA#1647), add `brave` and `brew`, update HuggingFace endpoint (NVIDIA#1540) - Document `NEMOCLAW_LOCAL_INFERENCE_TIMEOUT` env var for local providers (NVIDIA#1620) - Document `NEMOCLAW_PROXY_HOST`/`NEMOCLAW_PROXY_PORT` env vars (NVIDIA#1563) - Add troubleshooting entries for Docker group permissions (NVIDIA#1614), sandbox survival after gateway restart (NVIDIA#1587), and proxy configuration - Regenerate `nemoclaw-user-*` skills from updated docs ## Test plan - [x] `make docs` builds without warnings - [x] All pre-commit and pre-push hooks pass - [ ] Verify rendered pages in docs site preview 🤖 Generated with [Claude Code](https://claude.com/claude-code)  ## Summary by CodeRabbit * **New Features** * Added `nemoclaw credentials list` command to display stored credential names * Added `nemoclaw credentials reset <KEY>` command with `--yes` flag to remove credentials * Added `--dry-run` flag for policy-add to preview endpoint changes * New policy presets: `brave` and `brew` * New configuration options: `NEMOCLAW_LOCAL_INFERENCE_TIMEOUT`, `NEMOCLAW_PROXY_HOST`, and `NEMOCLAW_PROXY_PORT` * **Documentation** * Expanded troubleshooting guides for Docker permissions, sandbox connectivity, local inference timeouts, and proxy configuration  Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

fix: remove docker policy preset (#1406)

550d57d

Signed-off-by: zyang-dev <267119621+zyang-dev@users.noreply.github.com>

brandonpelfrey approved these changes Apr 8, 2026

View reviewed changes

brandonpelfrey merged commit 2513f2f into main Apr 8, 2026
15 checks passed

brandonpelfrey self-assigned this Apr 8, 2026

miyoungc mentioned this pull request Apr 9, 2026

docs: catch up documentation for v0.0.10 changes #1654

Merged

3 tasks

wscurran mentioned this pull request Apr 14, 2026

fix(policy): allow real sandbox clients in docker preset (Fixes #1406) #1434

Closed

wscurran added the bug-fix PR fixes a bug or regression label Jun 8, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: remove docker policy preset (#1406)#1647

fix: remove docker policy preset (#1406)#1647
brandonpelfrey merged 1 commit into
mainfrom
fix/remove-docker-preset

zyang-dev commented Apr 8, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Apr 8, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

zyang-dev commented Apr 8, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related Issue

Changes

Type of Change

Testing

Checklist

General

Code Changes

Doc Changes

Summary by CodeRabbit

Release Notes

Uh oh!

coderabbitai Bot commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

zyang-dev commented Apr 8, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 8, 2026 •

edited

Loading