A robust infrastructure for deploying isolated, sandboxed agents that collaborate across gateways via Discord and private networking.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install multi-agent-sandbox
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install multi-agent-sandbox using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Multi-Agent Sandbox?
The Multi-Agent Sandbox is a sophisticated framework designed to facilitate secure communication and shared workspaces between autonomous agents. By leveraging Openclaw Skills, developers can instantiate sandbox agents within Docker containers, ensuring strict data isolation while enabling complex inter-agent workflows.
This setup utilizes three primary pillars: socat bridges for container-to-host routing, Tailscale mesh VPN for private networking, and Discord integration for inter-agent communication. It is designed to allow agents from different gateways to share a VPS workspace without exposing the main agent's private data or local environment.
Multi-Agent Sandbox Use Cases
- Creating isolated environments for cross-gateway agent collaboration.
- Setting up multi-bot Discord architectures with strict requireMention gating to prevent loops.
- Configuring socat bridges for secure container-to-VPS SSH access via Tailscale.
- Enabling bidirectional agent-to-agent communication via sessions_send with granular allowlists.
- Sharing a VPS workspace between disparate agents while maintaining strict sandbox isolation.
How Multi-Agent Sandbox Works
- Agent Definition: Configure the sandbox agent in the global configuration with strict Docker constraints and restricted tool allowlists.
- Hub-Spoke Communication: Establish Agent-to-Agent (A2A) permissions to enable secure messaging between the primary controller and the sandbox.
- Networking Layer: Deploy Tailscale for mesh networking and configure socat bridges on the host to route traffic from the Docker container to the shared VPS.
- Discord Integration: Connect separate Discord bot accounts for different agents to facilitate external triggers and cross-gateway interaction.
- Workspace Synchronization: Map shared directories on a remote VPS to allow agents to collaborate asynchronously on a unified set of files.
Multi-Agent Sandbox Setup
First, update your agent configuration to include the sandbox definition with readOnlyRoot: true. Next, rebuild your sandbox image to include SSH capabilities:
docker build -f Dockerfile.sandbox -t openclaw-sandbox:bookworm-slim .
Configure the network bridges using systemd services to link the Docker bridge to your Tailscale mesh:
sudo systemctl enable --now socat-bridge-docker0-gateway socat-bridge-docker0-vps-ssh
Ensure Tailscale is active on all nodes involved in the Openclaw Skills workflow:
sudo tailscale up --ssh
Finally, enable the Discord Multi-Bot settings in your configuration, ensuring requireMention is set to true for shared channels.
Multi-Agent Sandbox Data Schema & Taxonomy
The sandbox organizes its operations through the following schema:
| Component | Description |
|---|---|
openclaw.json |
Defines agent IDs, tool permissions, and Discord account mappings. |
/workspace-sandbox |
The primary read/write directory for the sandboxed agent. |
SOUL.md |
Defines the specific identity, mission, and constraints of the sandbox agent. |
TOOLS.md |
Contains documentation for the agent regarding its SSH access via 172.17.0.1. |
socat Bridges |
System-level services routing TCP traffic between the container and the Tailscale interface. |
Multi-Agent Sandbox Advanced Features
- Identity-based SSH via Tailscale, eliminating the need for static key management.
- Automated cross-agent session management using
sessions_sendandsessions_spawn. - Multi-bot routing logic that supports separate Discord accounts per agent.
- Per-agent network isolation utilizing the
docker0bridge and strict UFW firewall rules. - Immutable root filesystems for agents to ensure environment consistency and security.
SKILL.md
Loading
Related Openclaw Skills
localhost-bridge
A networking utility that bridges Docker containers to host-side localhost services using socat and systemd for seamless AI agent deployments.
AX Development Framework
A comprehensive engineering framework for designing libraries, CLIs, and APIs specifically optimized for autonomous AI agent consumption.
TickTick Official CLI Skill
A command-line interface for managing Dida365 projects and tasks using the official Open API and OAuth authentication.
Dida365 (TickTick) Task Manager
A comprehensive CLI-based tool for managing Dida365 tasks and projects through Openclaw Skills.
Umami Setup
A professional tool for deploying privacy-focused Umami analytics with same-domain proxying to ensure adblocker-proof data collection.
fastfish-hot
A robust automated hotspot fetching system that synchronizes trending news to Telegram, Feishu, and DingTalk with keyword filtering and scheduling.
Featured*
