OpenClaw merged a P1 sandbox hardening patch this morning that closes an uncomfortable visibility gap around environment values. PR #129781, "fix(sandbox): stop exposing environment values in process listings", targets Docker, Podman, SSH, OpenShell, and browser sandbox launch paths where configured values could appear in process arguments during startup or execution.
The core issue was not that tools lacked their environment. It was that delivering those values through command arguments could leave them visible to operators or processes that can inspect local process listings. For OpenClaw deployments that route agents through sandboxed tools, that is the kind of boundary detail that matters.
What Changed
The PR moves container environment delivery away from value-bearing --env and -e arguments. Docker and Podman paths now use private, short-lived env files instead. For SSH and OpenShell, OpenClaw stages a private remote script through a separate stdin-only SSH invocation, keeping command stdin and terminal behavior intact while avoiding environment values in argv.
The patch also tightens cleanup. SSH staging now gets best-effort removal during finalization, including cases where the remote process exits with a normal process record but the transport still fails.
There is also an important validation change. Docker and Podman env-file delivery is line-delimited, so OpenClaw now rejects nonportable names, NUL bytes, and multiline values earlier during config validation and openclaw doctor. The PR describes the remediation as manual: rename the key, use a single-line value, or deliver multiline material through a mounted file or custom image.
Why It Matters
Process listings are easy to overlook because they are not application logs. But for sandbox and Gateway operators, argv exposure can still turn a private runtime value into observable host state. That is especially sensitive when sandboxes carry API keys, tokens, browser authorization material, or integration credentials.
This patch does not claim to make container metadata secret from every privileged operator. The PR is explicit that operators with container-engine access can still inspect container environment metadata. The narrower and useful win is that OpenClaw no longer places the configured values in engine or SSH process arguments as part of normal launch paths.
Verification
The evidence attached to PR #129781 is unusually broad. The maintainers report 581 focused transport, sandbox, fleet, browser, SSH, OpenShell, and update-CLI tests, plus 340 config compatibility and owner-boundary tests. The changed-file plan also passed formatting, typechecks, lint, dead-export scans, import-cycle checks, database and schema guards, and related repository checks.
The strongest proof is live-path validation. The PR includes real Docker proof that environment delivery still works while local and remote exec argv remain free of the values, and real OpenSSH proof covering multiline values, command stdin, clean stderr, and remote staging cleanup.
Bottom Line
This is a security-boundary repair rather than a feature launch, but it is a high-signal OpenClaw change. Sandboxed tools still receive the environment they need, while Docker, Podman, SSH, and OpenShell launch paths stop advertising those values through process listings.
For operators using agent sandboxes with sensitive configuration, PR #129781 is one to track closely in the next release notes.