Configuration

clawrun.json

Every ClawRun instance is configured through a clawrun.json file. This file is generated automatically by clawrun deploy and bundled into the deployed app. You don't need to create it manually.

The file lives at ~/.clawrun/<instance-name>/clawrun.json.

instance

Identity and deployment metadata for the instance.

agent

Agent selection and configuration.

sandbox

Controls sandbox lifecycle, resource allocation, and network access.

resources

networkPolicy

Controls what the agent can access from inside the sandbox. Three modes are supported:

• "allow-all" Unrestricted network access (default).
• "deny-all" No outbound network access.
• Restricted. Allowlist specific domains and subnets:

{
  "allow": ["api.openai.com", "api.anthropic.com"],
  "subnets": {
    "allow": ["192.168.0.0/16"],
    "deny": ["10.0.0.0/8"]
  }
}

When using restricted mode, clawrun deploy automatically adds required domains based on your LLM provider, messaging channels, and selected tools.

secrets

All secrets are generated automatically during clawrun deploy and deployed as environment variables. They are stripped from the bundled clawrun.json and never committed to source control.

state

ClawRun uses Redis for persisting sandbox state across sleep/wake cycles.

During deploy, the CLI provisions an Upstash KV store or connects to an existing one.