69 lines
2.1 KiB
Docker
69 lines
2.1 KiB
Docker
FROM ghcr.io/openclaw/openclaw:latest
|
|
|
|
USER root
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y docker.io \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN set -eu; \
|
|
cat >/tmp/patch-openclaw-sandbox.js <<'EOF'
|
|
const fs = require("fs");
|
|
const path = require("path");
|
|
|
|
const distDir = "/app/dist";
|
|
const files = fs
|
|
.readdirSync(distDir)
|
|
.filter((name) => /^docker-.*\.js$/.test(name))
|
|
.map((name) => path.join(distDir, name));
|
|
|
|
if (!files.length) {
|
|
throw new Error("No docker-*.js bundles found in /app/dist");
|
|
}
|
|
|
|
const bindNeedle =
|
|
'return `${params.hostPath}:${params.containerPath}:${params.readOnly ? "ro,z" : "z"}`;';
|
|
const bindReplacement =
|
|
'const useUidShift = process.env.OPENCLAW_SANDBOX_UIDSHIFT === "1";\n' +
|
|
' const hostWorkspaceRoot = process.env.OPENCLAW_SANDBOX_HOST_WORKSPACE?.trim();\n' +
|
|
' const containerWorkspaceRoot = process.env.OPENCLAW_SANDBOX_CONTAINER_WORKSPACE?.trim() || "/home/node/.openclaw/workspace";\n' +
|
|
' let hostPath = params.hostPath;\n' +
|
|
' if (hostWorkspaceRoot && (hostPath === containerWorkspaceRoot || hostPath.startsWith(`${containerWorkspaceRoot}/`))) hostPath = `${hostWorkspaceRoot}${hostPath.slice(containerWorkspaceRoot.length)}`;\n' +
|
|
' return `${hostPath}:${params.containerPath}:${params.readOnly ? useUidShift ? "ro,U,z" : "ro,z" : useUidShift ? "U,z" : "z"}`;';
|
|
|
|
let patchedFiles = 0;
|
|
|
|
for (const filePath of files) {
|
|
const original = fs.readFileSync(filePath, "utf8");
|
|
let patched = original;
|
|
|
|
if (!patched.includes(bindNeedle)) {
|
|
continue;
|
|
}
|
|
|
|
patched = patched.replace(bindNeedle, bindReplacement);
|
|
|
|
if (patched === original) {
|
|
continue;
|
|
}
|
|
|
|
fs.writeFileSync(filePath, patched, "utf8");
|
|
patchedFiles += 1;
|
|
}
|
|
|
|
if (!patchedFiles) {
|
|
throw new Error("OpenClaw dist patch failed: expected patterns not found in docker bundles");
|
|
}
|
|
|
|
console.log(`Patched ${patchedFiles} OpenClaw docker dist bundle(s).`);
|
|
EOF
|
|
|
|
RUN node /tmp/patch-openclaw-sandbox.js \
|
|
&& rm -f /tmp/patch-openclaw-sandbox.js
|
|
|
|
ENV OPENCLAW_SANDBOX_UIDSHIFT=0
|
|
ENV OPENCLAW_SANDBOX_HOST_WORKSPACE=
|
|
ENV OPENCLAW_SANDBOX_CONTAINER_WORKSPACE=/home/node/.openclaw/workspace
|
|
|
|
USER node
|