Expand post to cover both OpenClaw and Hermes agents

Signed-off-by: Shane McDonald <me@shanemcd.com>

Author: shanemcd

content/posts/10-openshell-openclaw-podman-discord-bot.md

@@ -1,8 +1,8 @@
 ---
-title: Running an OpenClaw Discord Bot inside an OpenShell Sandbox with Podman
+title: Running AI Agents inside OpenShell Sandboxes with Rootless Podman
 ---
 
-I've been running AI agents on my workstation for a while now. First it was [[03-ollama-rootless-podman-quadlet|Ollama under rootless Podman]], then Hermes Agent with Vertex AI. Recently I wanted to replace Hermes with [OpenClaw](https://openclaw.ai/) as my Discord bot, but I didn't want to just run it as a bare container. If an AI agent is going to have network access and API credentials, I want something between it and the outside world.
+I've been running AI agents on my workstation for a while now. First it was [[03-ollama-rootless-podman-quadlet|Ollama under rootless Podman]], then Hermes Agent with Vertex AI. Recently I wanted to run both [OpenClaw](https://openclaw.ai/) and [Hermes Agent](https://github.com/NousResearch/hermes-agent) as Discord bots, but I didn't want to just run them as bare containers. If an AI agent is going to have network access and API credentials, I want something between it and the outside world.
 
 [NVIDIA OpenShell](https://github.com/NVIDIA/OpenShell) provides exactly that: sandboxed runtimes for AI agents with kernel-level isolation, policy-enforced network egress, and credential injection. The agent never sees your real API keys. The proxy intercepts every outbound connection and evaluates it against a YAML policy before anything leaves the box.
 
@@ -15,8 +15,8 @@ I haven't seen anyone else running this exact combination, so I thought I would
 There are three pieces:
 
 1. **OpenShell gateway** runs as a Podman Quadlet systemd service. It manages sandbox lifecycle, mTLS, JWT auth, provider credentials, and network policy.
-2. **OpenClaw sandbox** is created by the gateway via the Podman driver. It runs inside an OpenShell supervisor with a network namespace, transparent proxy, Landlock filesystem restrictions, and credential injection.
-3. **NemoClaw image** is the container image. It's built from [NVIDIA's NemoClaw](https://github.com/NVIDIA/NemoClaw) repo (which bundles OpenClaw with security hardening and proxy preload scripts), then layered with the Discord plugin and config.
+2. **Agent sandboxes** are created by the gateway via the Podman driver. Each runs inside an OpenShell supervisor with a network namespace, transparent proxy, Landlock filesystem restrictions, and credential injection.
+3. **NemoClaw images** are the container images. They're built from [NVIDIA's NemoClaw](https://github.com/NVIDIA/NemoClaw) repo (which bundles agents with security hardening and proxy preload scripts), then layered with Discord config.
 
 The gateway and sandboxes sit on the same Podman bridge network (`openshell`) so they can communicate directly. The gateway is published on `0.0.0.0:8080` so I can reach it from other machines on my Tailscale network.
 
@@ -118,9 +118,101 @@ guest_tls_key = "/home/shanemcd/.local/state/openshell/tls/client/tls.key"
 
 The `guest_tls_*` paths are host filesystem paths because the Podman driver bind-mounts them into sandbox containers. If you put container-internal paths here, the host Podman daemon won't find the files.
 
-## Building the image
+## Creating providers
+
+OpenShell providers hold credentials and inject them into sandboxes as opaque placeholders. The agent process never sees the real values. The proxy resolves placeholders at egress time.
+
+```bash
+openshell provider create --name openrouter --type openai \
+  --credential "OPENAI_API_KEY=$(secret-tool lookup service openshell key openrouter-api-key)" \
+  --credential "OPENROUTER_API_KEY=$(secret-tool lookup service openshell key openrouter-api-key)" \
+  --config "OPENAI_BASE_URL=https://openrouter.ai/api/v1"
+
+openshell provider create --name discord --type generic \
+  --credential "DISCORD_BOT_TOKEN=$(secret-tool lookup service openshell key discord-bot-token)"
+```
+
+The OpenRouter provider needs both `OPENAI_API_KEY` and `OPENROUTER_API_KEY` because different agents read different env vars. OpenClaw uses `OPENROUTER_API_KEY`. Hermes uses the OpenAI SDK which reads `OPENAI_API_KEY`. Having both means the same provider works for either agent.
+
+## The network policy
+
+This is where OpenShell earns its keep. Every outbound connection from the sandbox goes through the transparent proxy and is evaluated against the policy. If there's no matching rule, the connection is denied with a 403.
+
+```yaml
+version: 1
+
+filesystem_policy:
+  read_only: [/usr, /lib, /etc]
+  read_write: [/sandbox, /tmp, /dev/null, /dev/urandom]
+
+landlock:
+  compatibility: best_effort
+
+process:
+  run_as_user: sandbox
+  run_as_group: sandbox
+
+network_policies:
+  discord_gateway:
+    name: discord-gateway
+    endpoints:
+      - host: "*.discord.gg"
+        port: 443
+        protocol: websocket
+        enforcement: enforce
+        access: full
+        websocket_credential_rewrite: true
+    binaries:
+      - path: /usr/local/bin/node
+      - path: /usr/bin/python3.13
+
+  discord_api:
+    name: discord-api
+    endpoints:
+      - host: discord.com
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        access: full
+      - host: discordapp.com
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        access: full
+    binaries:
+      - path: /usr/local/bin/node
+      - path: /usr/bin/python3.13
+
+  openrouter:
+    name: openrouter
+    endpoints:
+      - host: openrouter.ai
+        port: 443
+        protocol: rest
+        enforcement: enforce
+        access: full
+    binaries:
+      - path: /usr/local/bin/node
+      - path: /usr/bin/python3.13
+```
+
+The Discord WebSocket endpoint needs `websocket_credential_rewrite: true` so the proxy can resolve the bot token placeholder in the WebSocket IDENTIFY payload. Without this, Discord rejects the connection with error code 4004 (authentication failed) because it receives the placeholder string instead of the real token.
+
+I've included both `node` and `python3.13` in the binary allowlists so the same policy works for OpenClaw (Node.js) and Hermes (Python). You could split these into separate policy files per agent if you want tighter binary restrictions.
+
+The policy is hot-reloadable. If you need to add a new endpoint, you update the YAML and run:
+
+```bash
+openshell policy set <sandbox-name> --policy policy.yaml
+```
+
+No sandbox restart needed. The proxy picks up the new rules within seconds.
+
+## OpenClaw
+
+OpenClaw is a Node.js agent. The image is a two-layer build: the NemoClaw base from source, then a config layer with the Discord plugin.
 
-The image is a two-layer build. First, the NemoClaw base from source:
+### Building the NemoClaw base
 
 ```bash
 git clone --depth 1 https://github.com/NVIDIA/NemoClaw.git /tmp/nemoclaw-src
@@ -136,14 +228,15 @@ podman build -t nemoclaw-discord:latest \
   /tmp/nemoclaw-src
 ```
 
-Then a config layer that installs the Discord plugin, bootstraps the OpenClaw config, and pre-configures the Discord channel:
+### Config layer
 
 ```dockerfile
 FROM localhost/nemoclaw-discord:latest
 
 USER root
 ENV HOME=/sandbox
 
+# Disable managed proxy during build (points at sandbox proxy that doesn't exist yet)
 RUN node -e ' \
   const fs = require("fs"); \
   const p = "/sandbox/.openclaw/openclaw.json"; \
@@ -165,6 +258,7 @@ RUN openclaw doctor --fix 2>/dev/null; \
     openclaw models set openrouter/anthropic/claude-sonnet-5 && \
     openclaw config set agents.defaults.memorySearch.enabled false
 
+# Pre-configure Discord channel and owner
 RUN node -e ' \
   const fs = require("fs"); \
   const p = "/sandbox/.openclaw/openclaw.json"; \
@@ -200,124 +294,103 @@ WORKDIR /sandbox
 
 The proxy toggle during the plugin install is necessary because the NemoClaw base image bakes in a managed proxy config pointing at `10.200.0.1:3128` (the OpenShell sandbox proxy). That proxy doesn't exist at build time, so npm would hang trying to route through it.
 
-The owner and allowed users are baked into the image because once the sandbox is running, Landlock filesystem restrictions prevent the OpenClaw CLI from writing to its SQLite database. You can't run `openclaw pairing approve` inside a running sandbox.
+The owner and allowed users are baked into the image because once the sandbox is running, Landlock filesystem restrictions prevent the OpenClaw CLI from writing to its SQLite database.
 
-## Creating providers
-
-OpenShell providers hold credentials and inject them into sandboxes as opaque placeholders. The agent process never sees the real values. The proxy resolves placeholders at egress time.
+### Creating the sandbox
 
 ```bash
-openshell provider create --name openrouter --type generic \
-  --credential "OPENROUTER_API_KEY=$(secret-tool lookup service openshell key openrouter-api-key)"
-
-openshell provider create --name discord --type generic \
-  --credential "DISCORD_BOT_TOKEN=$(secret-tool lookup service openshell key discord-bot-token)"
+openshell sandbox create \
+  --name clankr \
+  --from localhost/nemoclaw-discord-configured:latest \
+  --provider openrouter \
+  --provider discord \
+  --policy policy.yaml \
+  --no-tty \
+  -- /usr/local/bin/nemoclaw-start
 ```
 
-One thing that tripped me up: OpenClaw's built-in OpenRouter support expects `OPENROUTER_API_KEY`, not `OPENAI_API_KEY`. If you use the `openai` provider type with `OPENAI_API_KEY`, the credential gets injected but OpenClaw ignores it and you get `401 Missing Authentication header` from OpenRouter.
+The `nemoclaw-start` entrypoint is important for OpenClaw. It handles privilege separation, gateway auth token generation, and most critically, it loads a Node.js preload script (`http-proxy-fix.js`) that patches `https.request()` to properly route WebSocket CONNECT tunnels through the sandbox proxy. Without this preload, Node.js tries to resolve DNS directly (which is blocked by nftables in the sandbox network namespace) and you get `EAI_AGAIN` errors on every connection.
 
-## The network policy
+## Hermes Agent
 
-This is where OpenShell earns its keep. Every outbound connection from the sandbox goes through the transparent proxy and is evaluated against the policy. If there's no matching rule, the connection is denied with a 403.
+Hermes is a Python agent. The setup is simpler because Python's `httpx` (used by the OpenAI SDK) natively respects the transparent proxy without needing preload hacks.
 
-```yaml
-version: 1
+### Building the image
 
-filesystem_policy:
-  read_only: [/usr, /lib, /etc]
-  read_write: [/sandbox, /tmp, /dev/null, /dev/urandom]
+The NemoClaw base for Hermes:
 
-landlock:
-  compatibility: best_effort
+```bash
+podman build -t nemoclaw-hermes:latest \
+  -f /tmp/nemoclaw-src/agents/hermes/Dockerfile \
+  /tmp/nemoclaw-src
+```
 
-process:
-  run_as_user: sandbox
-  run_as_group: sandbox
+Then a config layer using Hermes's native `config set` commands:
 
-network_policies:
-  discord_gateway:
-    name: discord-gateway
-    endpoints:
-      - host: "*.discord.gg"
-        port: 443
-        protocol: websocket
-        enforcement: enforce
-        access: full
-        websocket_credential_rewrite: true
-    binaries:
-      - path: /usr/local/bin/node
+```dockerfile
+FROM localhost/nemoclaw-hermes:latest
 
-  discord_api:
-    name: discord-api
-    endpoints:
-      - host: discord.com
-        port: 443
-        protocol: rest
-        enforcement: enforce
-        access: full
-      - host: discordapp.com
-        port: 443
-        protocol: rest
-        enforcement: enforce
-        access: full
-    binaries:
-      - path: /usr/local/bin/node
+USER root
+ENV HOME=/sandbox
 
-  openrouter:
-    name: openrouter
-    endpoints:
-      - host: openrouter.ai
-        port: 443
-        protocol: rest
-        enforcement: enforce
-        access: full
-    binaries:
-      - path: /usr/local/bin/node
-```
+RUN mkdir -p /sandbox/.hermes && \
+    hermes config set model.default anthropic/claude-sonnet-5 && \
+    hermes config set model.provider custom && \
+    hermes config set model.base_url https://openrouter.ai/api/v1 && \
+    hermes config set providers.custom.api https://openrouter.ai/api/v1 && \
+    hermes config set providers.custom.default_model anthropic/claude-sonnet-5 && \
+    hermes config set platforms.discord.enabled true && \
+    hermes config set discord.require_mention 1 && \
+    hermes config set discord.auto_thread true && \
+    hermes config set discord.reactions true
 
-The Discord WebSocket endpoint needs `websocket_credential_rewrite: true` so the proxy can resolve the bot token placeholder in the WebSocket IDENTIFY payload. Without this, Discord rejects the connection with error code 4004 (authentication failed) because it receives the placeholder string instead of the real token.
+# Remove api_key fields so the OpenAI SDK falls back to OPENAI_API_KEY env var
+RUN sed -i '/api_key:/d' /sandbox/.hermes/config.yaml
 
-The `protocol: rest` endpoints get full L7 inspection. The proxy terminates TLS, checks the request against the policy rules, resolves any credential placeholders in headers or URL paths, and forwards the request upstream. The `protocol: websocket` endpoint gets the WebSocket handshake validated, then switches to raw bidirectional relay after the upgrade.
+RUN printf 'DISCORD_ALLOWED_USERS=YOUR_DISCORD_USER_ID\nDISCORD_ALLOW_ALL_USERS=false\n' \
+    > /sandbox/.hermes/.env
 
-The policy is hot-reloadable. If you need to add a new endpoint (say, the agent wants to fetch something from GitHub), you update the YAML and run:
+RUN chown -R sandbox:sandbox /sandbox/.hermes
 
-```bash
-openshell policy set clankr --policy policy.yaml
+USER sandbox
+WORKDIR /sandbox
 ```
 
-No sandbox restart needed. The proxy picks up the new rules within seconds.
+The `sed` to remove `api_key` lines is the key trick. The NemoClaw base bakes in `sk-OPENSHELL-PROXY-REWRITE` as a static placeholder that NemoClaw's own proxy would resolve, but the OpenShell proxy doesn't know about it. With no `api_key` in the config, the OpenAI SDK falls back to the `OPENAI_API_KEY` environment variable, which OpenShell injects as a credential placeholder. The proxy resolves that placeholder in the `Authorization: Bearer` header at egress time.
 
-## Creating the sandbox
+### Creating the sandbox
 
 ```bash
 openshell sandbox create \
-  --name clankr \
-  --from localhost/nemoclaw-discord-configured:latest \
+  --name hermes \
+  --from localhost/nemoclaw-hermes-configured:latest \
   --provider openrouter \
   --provider discord \
   --policy policy.yaml \
   --no-tty \
-  -- /usr/local/bin/nemoclaw-start
+  -- hermes gateway run --force
 ```
 
-The `nemoclaw-start` entrypoint is important. It handles privilege separation, gateway auth token generation, and most critically, it loads a Node.js preload script (`http-proxy-fix.js`) that patches `https.request()` to properly route WebSocket CONNECT tunnels through the sandbox proxy. Without this preload, Node.js tries to resolve DNS directly (which is blocked by nftables in the sandbox network namespace) and you get `EAI_AGAIN` errors on every connection.
+Unlike OpenClaw, Hermes can skip the `nemoclaw-start` entrypoint and run `hermes gateway run --force` directly. Python handles the transparent proxy correctly without preload scripts. The tradeoff is losing NemoClaw's privilege separation and config integrity checks, but for a personal Discord bot, the OpenShell sandbox provides more than enough isolation.
+
+## What it looks like running
 
 After about 30 seconds, the bot comes online on Discord. You can verify from the proxy logs:
 
 ```bash
-openshell logs clankr
+openshell logs <sandbox-name>
 ```
 
 ```
 NET:OPEN  [INFO] ALLOWED /usr/local/bin/node(428) -> discord.com:443 [policy:discord_api engine:opa]
 HTTP:GET  [INFO] ALLOWED GET http://discord.com:443/api/v10/users/@me [policy:discord_api engine:l7]
-NET:UPGRADE [INFO] gateway.discord.gg:443
-NET:OTHER [INFO] ALLOWED gateway.discord.gg:443 [policy:discord_gateway engine:l7-websocket]
+NET:UPGRADE [INFO] gateway-us-east1-c.discord.gg:443
+NET:OTHER [INFO] ALLOWED gateway-us-east1-c.discord.gg:443 [policy:discord_gateway engine:l7-websocket]
 HTTP:POST [INFO] ALLOWED POST http://openrouter.ai:443/api/v1/chat/completions [policy:openrouter engine:l7]
 HTTP:POST [INFO] ALLOWED POST http://discord.com:443/api/v10/channels/.../messages [policy:discord_api engine:l7]
 ```
 
-Every connection is logged with the policy rule that allowed it, the engine that evaluated it (OPA for L4, l7 for HTTP, l7-websocket for WebSocket), and the binary that initiated it.
+Every connection is logged with the policy rule that allowed it, the engine that evaluated it (OPA for L4, l7 for HTTP, l7-websocket for WebSocket), and the binary that initiated it. Anything not in the policy gets a 403 and an OCSF log entry.
 
 ## Gotchas
 
@@ -328,7 +401,9 @@ A few things I ran into that aren't obvious:
 - **OpenRouter models in OpenClaw use the format `openrouter/<author>/<slug>`**, not `openrouter:author/slug`. The colon-separated format causes OpenClaw to treat the model name as a filesystem path and crash with a "Bundled plugin dirName must be a single directory" error.
 - **After regenerating TLS certs, you must recreate sandboxes.** Running sandboxes have the old certs mounted and lose connectivity to the gateway. The supervisor can't fetch policy updates, so hot-reload stops working.
 - **Wildcard the Discord gateway hostname.** The policy needs `*.discord.gg`, not just `gateway.discord.gg`. Discord uses regional gateways like `gateway-us-east1-c.discord.gg` for reconnections, and the bot goes offline when the proxy denies the regional hostname.
+- **Hermes needs `api_key` fields removed from config, not set to empty.** The NemoClaw base bakes in a static proxy placeholder. Empty string makes the OpenAI SDK send an empty Bearer token. Removing the field entirely makes it fall back to the `OPENAI_API_KEY` env var, which OpenShell injects as a resolvable placeholder.
+- **One Discord bot token, one consumer.** If you run both agents with the same bot token, only the last one to connect will receive messages. Use a separate bot token per agent if you want both online simultaneously.
 
 ## Source
 
-Everything is in my [clankr](https://github.com/shanemcd/clankr) repo under `agents/openclaw/`. The gateway quadlet and config live in my [dotfiles](https://github.com/shanemcd/dotfiles).
+Everything is in my [clankr](https://github.com/shanemcd/clankr) repo under `agents/openclaw/` and `agents/hermes/`. The gateway quadlet and config live in my [dotfiles](https://github.com/shanemcd/dotfiles).