From c83f3aab9030ca60b9ca8b90fbc8d6c70d8557fc Mon Sep 17 00:00:00 2001
From: Viktor Barzin <viktorbarzin@meta.com>
Date: Sun, 1 Mar 2026 16:18:53 +0000
Subject: [PATCH] [ci skip] openclaw: disable sandbox, run commands on
 container host
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- exec.host: sandbox → local (run directly on container, no Docker sandbox)
- exec.security: full → off (no restrictions on command execution)
---
 stacks/openclaw/main.tf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/stacks/openclaw/main.tf b/stacks/openclaw/main.tf
index 37a3d339..19a74a23 100644
--- a/stacks/openclaw/main.tf
+++ b/stacks/openclaw/main.tf
@@ -112,8 +112,8 @@ resource "kubernetes_config_map" "openclaw_config" {
         profile = "full"
         deny    = []
         exec = {
-          host        = "sandbox"
-          security    = "full"
+          host        = "local"
+          security    = "off"
           ask         = "off"
           pathPrepend = ["/tools", "/workspace/infra"]
         }