manage-mounts

Restrict container access to specific host directories by configuring an allowlist at ~/.config/nanoclaw/mount-allowlist.json. You can add validated paths with read/write permissions, remove access, or reset the list entirely to control filesystem exposure.

Add a new host path to the NanoClaw mount allowlist using the add workflow, which validates the directory path and configures read/write permissions for non-main agents before saving the updated configuration.

Yes, you can manage filesystem mounts for agent containers across both macOS and Linux deployments. The skill supports show, add, remove, and reset workflows to modify the mount allowlist on these operating systems.

Container filesystem permission changes are not applied immediately because the allowlist must be reloaded. You need to restart the NanoClaw service after modifying the mount allowlist for the new directory access rules to take effect.

The best way to revoke agent access to a mounted host directory is to use the remove workflow. This edits the allowlist to delete the specified path, and a subsequent NanoClaw service restart applies the restricted access.

The mount allowlist prevents accidental host filesystem exposure by explicitly defining which directories agent containers can access. Any path not present in the configuration file is blocked, ensuring containers operate only within approved boundaries.