Fix: Openclaw sandbox spawn bug (partially)

.env.example

@@ -18,10 +18,10 @@ OPENCLAW_PASSWORD=mein-sicheres-passwort
 # --- NETWORK ---
 DNS_SERVER=8.8.8.8
 
-# --- HOST MOUNT VOLUMES ---
-# Local Path to Your openclaw.json
-HOST_OPENCLAW_JSON_PATH=/home/ghost/source/repos/ghostnet-openclaw/openclaw/config/openclaw.json
-# Local Path for the AI Workspace (persistent storage for agent's work)
+# --- HOST SETTINGS ---
+# Host User ID for permission mapping (match your local user ID for file access)
+HOST_USER_ID=1000
+# Local path to your openclaw.json
+HOST_OPENCLAW_JSON_PATH=./openclaw/config/openclaw.json
+# Local path for the AI workspace (persistent storage for agent's work)
 HOST_WORKSPACE_PATH=./storage/workspace
-# Local Path for Additional Repositories or Code Directories for the Agent
-HOST_REPOS_PATH=/home/ghost/source/repos

compose.amd.yaml

@@ -51,7 +51,10 @@ services:
 
   # --- CORE AGENT (GATEWAY) ---
   openclaw:
-    image: ghcr.io/openclaw/openclaw:latest
+    #image: ghcr.io/openclaw/openclaw:latest
+    build:
+      context: ./openclaw
+      dockerfile: Containerfile
     container_name: openclaw
     userns_mode: "keep-id"
     environment:
@@ -59,11 +62,13 @@ services:
       - OPENCLAW_GATEWAY_PASSWORD=${OPENCLAW_PASSWORD}
       - OLLAMA_URL=http://127.0.0.1:11434
       - OLLAMA_API_KEY=ollama-local
+      - DOCKER_HOST=unix:///var/run/docker.sock
     ports:
       - "8080:8080"
     volumes:
       - ${HOST_OPENCLAW_JSON_PATH}:/home/node/.openclaw/openclaw.json:Z
       - ${HOST_WORKSPACE_PATH}:/home/node/.openclaw/workspace:Z,U
+      - /run/user/${HOST_USER_ID}/podman/podman.sock:/var/run/docker.sock:Z
       - ${HOST_REPOS_PATH}:/repos:Z,U
     networks:
       - net.ghost.openclaw
@@ -71,8 +76,10 @@ services:
       - ollama
       - tool-router
 
+
+
   # --- NETWORK TUNNEL (SIDECAR) ---
-  ollama-bridge:
+  openclaw-ollama-bridge:
     image: docker.io/alpine/socat:latest
     container_name: openclaw-ollama-bridge
     network_mode: "service:openclaw"
@@ -162,7 +169,9 @@ services:
 
 networks:
   net.ghost.openclaw:
+    name: net.ghost.openclaw
     driver: bridge
     internal: true
   net.ghost.tools:
+    name: net.ghost.tools
     driver: bridge

openclaw/Containerfile

@@ -0,0 +1,9 @@
+FROM ghcr.io/openclaw/openclaw:latest
+
+USER root
+
+RUN apt-get update \
+ && apt-get install -y docker.io \
+ && rm -rf /var/lib/apt/lists/*
+
+USER node

openclaw/config/openclaw.json

@@ -9,7 +9,17 @@
   },
   "agents": {
     "defaults": {
-      "model": "ollama/qwen-coding"
+      "model": "ollama/qwen-coding",
+      "workspace": "/home/node/.openclaw/workspace",
+      "sandbox": {
+        "mode": "all",
+        "workspaceAccess": "rw",
+        "docker": {
+          "image": "docker.io/nikolaik/python-nodejs:python3.14-nodejs26-slim",
+          "network": "net.ghost.tools",
+          "pidsLimit": 2048
+        }
+      }
     }
   },
   "mcp": {
@@ -20,4 +30,4 @@
       }
     }
   }
-}
+}