Fix: User rights and sandboxing problems.

.env.example

@@ -5,6 +5,10 @@
 # --- LLM ENGINE & MODEL SELECTION ---
 MODEL_LIST=gemma4:e4b,qwen3.6:35b-a3b-q4_K_M
 OLLAMA_KEEP_ALIVE=-1
+# KV cache quantization for large contexts (recommended on desktop GPUs): q8_0 or q4_0
+# OLLAMA_KV_CACHE_TYPE=q8_0
+# Reserve VRAM for display/compositor to avoid amdgpu allocation failures (bytes)
+# OLLAMA_GPU_OVERHEAD=4294967296
 
 # --- HARDWARE RESOURCES ---
 # GPU Vendor (e.g. "amd", "nvidia", "intel")
@@ -25,3 +29,18 @@ HOST_USER_ID=1000
 HOST_OPENCLAW_JSON_PATH=./openclaw/config/openclaw.json
 # Local path for the AI workspace (persistent storage for agent's work)
 HOST_WORKSPACE_PATH=./storage/workspace
+# Local path for additional repositories/code visible to the agent
+HOST_REPOS_PATH=.
+
+# --- OPTIONAL RUNTIME OVERRIDES ---
+# Container engine used by ghostnet.sh (podman|docker)
+CONTAINER_ENGINE=podman
+# Optional explicit socket path for sandbox container creation API
+# HOST_DOCKER_SOCKET_PATH=/run/user/1000/podman/podman.sock
+# Optional explicit mount options for openclaw.json (default podman: :ro,Z | docker: :ro)
+# HOST_OPENCLAW_CONFIG_MOUNT_OPTS=:ro,Z
+# Optional explicit host workspace path seen by sandbox runtime
+# OPENCLAW_SANDBOX_HOST_WORKSPACE=/absolute/path/to/storage/workspace
+
+# Sandbox base image is auto-built by ghostnet.sh as
+# localhost/ghostnet-openclaw_sandbox:latest to include rootless apt defaults.