fix(sandbox): add python -> python3 symlink in base image

[BenediktSchackenberg]

Summary

Partially fixes #1452.

The sandbox base image installs python3 but has no python binary. Scripts using the bare python command (shebangs, subprocess calls, AI-generated code) fail with python: command not found. This is the specific trigger described in #1452 that causes tool call failures, which in turn can lead to agent hallucination.

Change

Adds ln -s /usr/bin/python3 /usr/local/bin/python in the base image apt-get layer so python resolves to python3 without any user action.

Scope

This PR addresses the sandbox-side trigger. The broader agent hallucination behaviour on tool failure is an OpenClaw agent loop issue outside the scope of NemoClaw.

Signed-off-by: Benedikt Schackenberg 6381261+BenediktSchackenberg@users.noreply.github.com

Summary by CodeRabbit

• Chores
  • Enhanced the sandbox environment so scripts and tools that invoke the standard python command run correctly without additional setup. This improves out-of-the-box compatibility for Python-based workflows and tooling.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a152af95-9816-4e3f-8520-6f008e3a7ec9

📥 Commits

Reviewing files that changed from the base of the PR and between b2a6613 and 21f74d7.

📒 Files selected for processing (1)

• Dockerfile.base

🚧 Files skipped from review as they are similar to previous changes (1)

• Dockerfile.base

---

📝 Walkthrough

Walkthrough

The Dockerfile.base now creates a /usr/local/bin/python symlink to /usr/bin/python3 during the apt install RUN step so the bare python command resolves to Python 3 inside the sandbox.

Changes

Cohort / File(s)	Summary
Docker Base Image Dockerfile.base	Added symlink creation in the apt install RUN command: ln -s /usr/bin/python3 /usr/local/bin/python, ensuring python resolves to Python 3 in the container.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

A symlink so small, yet brave and spry,
Now python points where python3 lies.
No more "command not found" in the sand—
The rabbit hops safely across the land. 🐇✨

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding a python → python3 symlink in the sandbox base image.
Linked Issues check	✅ Passed	The PR directly addresses the specific mitigation requested in issue #1452 by adding the python → python3 symlink to prevent the 'python not found' trigger.
Out of Scope Changes check	✅ Passed	The change is limited to adding a single symlink in the Dockerfile, which is directly aligned with the linked issue's requested mitigation.
Description check	✅ Passed	PR objectives clearly explain the purpose, scope boundaries, and connection to issue #1452.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR updates the NemoClaw sandbox base image to ensure python is available on PATH by adding a symlink to python3, preventing failures for scripts and tool calls that invoke python (as described in #1452).

Changes:

• Add a python -> python3 symlink during the base image apt layer build step.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

ln -s will fail the image build if /usr/local/bin/python already exists (e.g., if the upstream base image or a future layer introduces it). Consider making this idempotent (e.g., conditional creation or forcing/replacing the link) so rebuilds remain robust while still ensuring python resolves to python3.

Suggested change

	&& ln -s /usr/bin/python3 /usr/local/bin/python
	&& ln -sf /usr/bin/python3 /usr/local/bin/python

[wscurran]

✨ Thanks for submitting this pull request, which proposes a way to fix tool call failures in the sandbox by adding a python → python3 symlink in the base image.

---

Possibly related open issues:

• #1452 [Bug] Agent fabricates successful execution output after tool failure (exec: python not found)