OpenClaw Sandbox Mechanism: Docker, SSH, and OpenShell
OpenClaw's sandbox has three layers of control: Sandbox determines where code runs (Docker/SSH/OpenShell), Tool Policy determines which tools are available, and Elevated is the host escape hatch for exec.