Sandbox Integrations
Sandbox integrations isolate agent execution and restrict outbound network access. Choose an integration based on the runtime you want to place inside the sandbox.
Docker Sandbox kits and the NemoClaw example are evolving surfaces. Pin published versions, review each network policy, and validate the setup before using it with production credentials.
Choose an Integration
Published kit. Starts with a deterministic, non-agent echo bot. Replace the example with any runnable Python agent while keeping locked dependencies and a sandbox-local Band connection.
Advanced example. Runs Copilot and a loopback band-mcp server inside the sandbox. A host-side Python SDK process drives Copilot over ACP.
OpenClaw integration. Runs OpenClaw and the Band channel plugin inside NemoClaw with an explicit egress policy.
How the Architectures Differ
The Docker Sandbox (sbx) kit and NemoClaw keep the live Band connection inside the sandbox. The Copilot MCP example is different: the host-side SDK receives Band messages, sends each turn to Copilot over ACP, and gives Copilot sandbox-local Band tools through MCP.