docs: update sub-agent config exec examples

[glenn-agent]

Summary

• replace stale openshell-cluster-nemoclaw / kubectl exec examples in the sub-agent setup guide
• use nemoclaw <sandbox> exec for read-only config inspection
• use the current Docker-driver sandbox container pattern for root-owned config writes, preserving the mutable sandbox:sandbox / 660 config state
• sync the generated skill reference copies with the docs page

Closes #3720

Tests

• npm run docs:check-agent-variants
• git diff --check
• git verify-commit HEAD

Signed-off-by: Glenn-Agent glenn_agent@163.com

Summary by CodeRabbit

• Documentation
  • Updated NemoClaw sub-agent setup instructions with revised command execution patterns for sandbox configuration management.
  • Streamlined the sandbox configuration retrieval, update, and validation workflows in setup documentation.
  • Modified container discovery and permission management procedures across multiple setup guides.
  • Refined configuration deployment steps and ownership/permission settings for improved setup clarity.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 59034d56-bf27-4d5e-8306-a6bff1cda1d8

📥 Commits

Reviewing files that changed from the base of the PR and between 17734b1 and dd9d2a0.

📒 Files selected for processing (3)

• .agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md
• docs/inference/set-up-sub-agent.mdx
• skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md

---

📝 Walkthrough

Walkthrough

This PR updates three sub-agent setup reference documentation files to replace Kubernetes kubectl exec patterns with nemoclaw CLI commands and direct docker exec invocations for sandbox configuration management, addressing the removal of k3s infrastructure.

Changes

Sub-Agent Setup Documentation Modernization

Layer / File(s)	Summary
Config Export via nemoclaw exec .agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md, docs/inference/set-up-sub-agent.mdx, skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md	Config retrieval replaces kubectl exec via DOCKER_CTR with nemoclaw "$SANDBOX" exec -- cat to read /sandbox/.openclaw/openclaw.json.
Config Upload and Hash Refresh via docker exec .agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md, docs/inference/set-up-sub-agent.mdx, skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md	Config upload workflow now discovers SANDBOX_CTR via docker ps, uses docker exec --user root to write the patched openclaw.json, regenerates .config-hash, and sets sandbox:sandbox ownership with chmod 660 permissions, replacing prior kubectl-based chmod sequences.
Credentials Directory Ownership via docker exec .agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md, docs/inference/set-up-sub-agent.mdx, skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md	The chown -R command for sub-agent credentials directory switches to docker exec --user root "$SANDBOX_CTR" instead of kubectl exec targeting the agent container.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

• NVIDIA/NemoClaw#4117: Both PRs modernize documentation command workflows to use nemoclaw <name> exec for in-sandbox one-off commands instead of lower-level openshell/kubectl exec patterns.

Suggested labels

documentation

Suggested reviewers

• cv
• prekshivyas

Poem

🐰 Kubectl exec bids farewell with grace,
Docker and nemoclaw now take its place—
Sandbox configs dance with newfound ease,
Three docs aligned in harmony, please! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'docs: update sub-agent config exec examples' accurately summarizes the main change—updating documentation examples for sub-agent config execution patterns.
Linked Issues check	✅ Passed	The PR fulfills all coding objectives from issue #3720: removes kubectl exec patterns, replaces with docker exec/nemoclaw exec, updates ownership/chmod guidance, and syncs generated reference copies.
Out of Scope Changes check	✅ Passed	All changes are documentation updates directly addressing the requirements in issue #3720; no out-of-scope code or unrelated modifications are present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[glenn-agent]

Remote validation update: re-ran the PR checks on the user-designated remote test machine rather than the local host.

Validated:

• npm run docs:check-agent-variants
• git diff --check
• targeted grep confirmed no remaining kubectl exec -n openshell / openshell-cluster-nemoclaw strings in the touched sub-agent docs/reference files

[wscurran]

✨ Thanks for submitting this detailed PR about updating sub-agent config exec examples in the documentation. This proposes improvements to the documentation and sub-agent setup guide.

---

Related open issues:

• #3720 [All Platforms][Docs] inference/set-up-sub-agent still uses kubectl command in docker exec

[miyoungc]

Thanks for the docs cleanup here. Please revise this PR so it only changes the source docs page under docs/.

The contributor guide points doc updates at the docs/ source tree, and docs/CONTRIBUTING.md is explicit that generated user-skill output should not be edited in contributor doc PRs: docs/ is the source of truth, generated nemoclaw-user-* skill files are overwritten by the docs-to-skills pipeline, and NemoClaw maintainers refresh those generated skills during release prep.

Please revert the generated skill/reference changes in:

• .agents/skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md
• skills/nemoclaw-user-configure-inference/references/set-up-sub-agent.md

Keeping the docs/inference/set-up-sub-agent.mdx change is the right shape; maintainers will handle any generated skill refresh separately.

[miyoungc]

I also checked the proposed command examples against the current codebase.

The source-docs command shape looks correct: nemoclaw <sandbox> exec -- ... routes through NemoClaw's sandbox:exec command, which forwards to openshell sandbox exec --name <sandbox> -- ..., and OpenShell's exec path supports streaming stdout and piped stdin. The Docker-driver container names are currently created as openshell-<sandbox-name>-<sandbox-id-suffix> for normal validated sandbox names, so the SANDBOX_CTR discovery pattern matches the Docker-driver naming used by current OpenShell. NemoClaw's config-sync path also normalizes mutable OpenClaw config files to 660, so keeping openclaw.json and .config-hash at sandbox:sandbox/660 is consistent with the mutable-default state described by the docs.

So I do not see a correctness blocker in the docs/inference/set-up-sub-agent.mdx command replacement itself. My requested change is only about removing the generated skill/reference files from this contributor PR.

Validation I ran locally:

npm test -- src/lib/actions/sandbox/exec.test.ts src/lib/cli/public-argv-translation.test.ts

[glenn-agent]

Thanks for the review. I updated the branch to keep only the source docs page change under docs/inference/set-up-sub-agent.mdx and reverted both generated skill/reference files from the PR diff.

Validation rerun:

npm run docs:check-agent-variants
git diff --check
git diff --cached --check
git verify-commit HEAD

The latest commit is signed and DCO-signed.

[miyoungc]

Thanks for taking this on and for helping clean up the docs.

We merged #5247, which resolves the QA-reported command drift covered by #5084, #3720, #3685, and #3686, so I’m closing this PR as superseded to keep the queue tidy.

If there are unrelated doc fixes from this branch that you still want to pursue, a smaller follow-up PR would be welcome.