Skip to content

docs: clarify network approval prerequisites #5403

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
WilliamK112 wants to merge 2 commits into from
Closed

docs: clarify network approval prerequisites #5403

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ff82b39
docs: clarify network approval prerequisites
WilliamK112 Jun 13, 2026
bc862c1
docs: split approval walkthrough sentences
WilliamK112 Jun 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 18 additions & 3 deletions docs/network-policy/approve-network-requests.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ OpenShell intercepts these requests and presents them in the TUI for operator ap

- A running NemoClaw sandbox.
- The OpenShell CLI on your `PATH`.
- A local NemoClaw source checkout if you plan to run the walkthrough script.

## Open the TUI

Expand All @@ -27,12 +28,15 @@ Start the OpenShell terminal UI to monitor sandbox activity:
openshell term
```

For a remote sandbox, pass the instance name:
For a remote sandbox, connect to the host that owns the sandbox:

```bash
ssh my-gpu-box 'cd ~/nemoclaw && . .env && openshell term'
SANDBOX_HOST=your-sandbox-host
ssh "$SANDBOX_HOST" 'cd ~/nemoclaw && . .env && openshell term'
```

Replace `your-sandbox-host` with the SSH host or alias where your NemoClaw sandbox is running before you run the command.

The TUI displays the sandbox state, active inference provider, and a live feed of network activity.

## Trigger a Blocked Request
Expand All @@ -47,6 +51,8 @@ The blocked request includes the following details:
## Approve or Deny the Request

The TUI presents an approval prompt for each blocked request.
Select the sandbox that shows the blocked request.
Then follow the prompt in the TUI to approve or deny it.

- **Approve** the request to add the endpoint to the running policy for the current session.
- **Deny** the request to keep the endpoint blocked.
Expand All @@ -57,7 +63,16 @@ To keep an endpoint allowed after a restart, update the policy YAML or apply a p

## Run the Walkthrough

From the NemoClaw repository root, run the walkthrough script after you have onboarded at least one sandbox and it is reachable:
The walkthrough script lives in the NemoClaw source repository.
If you installed NemoClaw from the installer and do not have a source checkout, clone the repository first:

```bash
git clone https://github.com/NVIDIA/NemoClaw.git
cd NemoClaw
```

From the NemoClaw repository root, run the walkthrough script.
Ensure at least one sandbox is onboarded and reachable before running it:

```bash
./scripts/walkthrough.sh
Expand Down