Skip to content

fix(entrypoint): pre-create OpenClaw temp dirs and fix router log redirect #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
woddll wants to merge 2 commits into from
Closed

fix(entrypoint): pre-create OpenClaw temp dirs and fix router log redirect #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4712609
fix(entrypoint): pre-create OpenClaw temp dirs and fix router log red…
donghapaek Mar 24, 2026
04dc9f5
fix: Bing grounding auto-discovery and seccomp inotify allowlist
donghapaek Mar 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion cli/src/plugin.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1564,7 +1564,8 @@ const azureClawPlugin = definePluginEntry({
const conns = await routerCall("GET", "/connections?api-version=2025-05-15-preview");
const bingConn = (conns.value || conns || []).find(
(c: any) => c.type === "GroundingWithBingSearch" ||
c.properties?.category === "GroundingWithBingSearch"
c.properties?.category === "GroundingWithBingSearch" ||
c.metadata?.type === "bing_grounding"
);
if (bingConn) connId = bingConn.id; // full resource ID
} catch { /* fall through to default */ }
Expand Down
17 changes: 16 additions & 1 deletion sandbox-images/openclaw/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,20 @@ else
IS_ROOT=false
fi

# ── Pre-create OpenClaw temp directories ────────────────────────────────────
# OpenClaw requires /tmp/openclaw-{UID} dirs on startup. They must exist, be
# owned by the running user, and have mode 700 (security check rejects
# world-writable dirs). Docker --tmpfs /tmp starts empty, so create them here.
_oc_tmpdir="/tmp/openclaw-$(id -u)"
mkdir -p "$_oc_tmpdir" && chmod 700 "$_oc_tmpdir"
if [ "$IS_ROOT" = "true" ]; then
# Dev mode: also create dirs for sandbox (1000) and router (1001)
for _uid in 1000 1001; do
_dir="/tmp/openclaw-${_uid}"
mkdir -p "$_dir" && chown "${_uid}:${_uid}" "$_dir" && chmod 700 "$_dir"
done
fi

# ── Egress guard: iptables restricts UID 1000 to localhost + DNS ────────────
# Only applies when running as root (dev mode). On AKS, the egress-guard init
# container handles this before the sandbox container starts.
Expand Down Expand Up @@ -503,7 +517,8 @@ echo "${GATEWAY_TOKEN}" > /tmp/gateway-token
# where the router runs in a separate container with internet access.
# In AKS, the controller deploys the router as a separate sidecar container.
if [ "${AZURECLAW_AUTH_MODE:-}" != "workload-identity" ]; then
# Ensure router can write its log file
# Ensure router can write its log file (remove stale file from previous runs)
rm -f /tmp/inference-router.log
touch /tmp/inference-router.log
[ "$IS_ROOT" = "true" ] && chown 1001:1001 /tmp/inference-router.log
# Dev mode: make Docker socket accessible to router (UID 1001) for sub-agent spawning
Expand Down
Loading