FROM ghcr.io/openclaw/openclaw:latest

USER root

RUN apt-get update \
 && apt-get install -y docker.io \
 && rm -rf /var/lib/apt/lists/*

RUN set -eu; \
 cat >/tmp/patch-openclaw-sandbox.js <<'EOF'
const fs = require("fs");
const path = require("path");

const distDir = "/app/dist";
const files = fs
	.readdirSync(distDir)
	.filter((name) => /^docker-.*\.js$/.test(name))
	.map((name) => path.join(distDir, name));

if (!files.length) {
	throw new Error("No docker-*.js bundles found in /app/dist");
}

const bindNeedle =
	'return `${params.hostPath}:${params.containerPath}:${params.readOnly ? "ro,z" : "z"}`;';
const bindReplacement =
	'const useUidShift = process.env.OPENCLAW_SANDBOX_UIDSHIFT === "1";\n' +
	'        const hostWorkspaceRoot = process.env.OPENCLAW_SANDBOX_HOST_WORKSPACE?.trim();\n' +
	'        const containerWorkspaceRoot = process.env.OPENCLAW_SANDBOX_CONTAINER_WORKSPACE?.trim() || "/home/node/.openclaw/workspace";\n' +
	'        let hostPath = params.hostPath;\n' +
	'        if (hostWorkspaceRoot && (hostPath === containerWorkspaceRoot || hostPath.startsWith(`${containerWorkspaceRoot}/`))) hostPath = `${hostWorkspaceRoot}${hostPath.slice(containerWorkspaceRoot.length)}`;\n' +
	'        return `${hostPath}:${params.containerPath}:${params.readOnly ? useUidShift ? "ro,U,z" : "ro,z" : useUidShift ? "U,z" : "z"}`;';

let patchedFiles = 0;

for (const filePath of files) {
	const original = fs.readFileSync(filePath, "utf8");
	let patched = original;

	if (!patched.includes(bindNeedle)) {
		continue;
	}

	patched = patched.replace(bindNeedle, bindReplacement);

	if (patched === original) {
		continue;
	}

	fs.writeFileSync(filePath, patched, "utf8");
	patchedFiles += 1;
}

if (!patchedFiles) {
	throw new Error("OpenClaw dist patch failed: expected patterns not found in docker bundles");
}

console.log(`Patched ${patchedFiles} OpenClaw docker dist bundle(s).`);
EOF

RUN node /tmp/patch-openclaw-sandbox.js \
 && rm -f /tmp/patch-openclaw-sandbox.js

ENV OPENCLAW_SANDBOX_UIDSHIFT=0
ENV OPENCLAW_SANDBOX_HOST_WORKSPACE=
ENV OPENCLAW_SANDBOX_CONTAINER_WORKSPACE=/home/node/.openclaw/workspace

USER node