From 8735910f57555b3aef15ca224097c83f31ce97ea Mon Sep 17 00:00:00 2001 From: Justin Merrell Date: Mon, 31 Aug 2026 13:57:26 +0000 Subject: [PATCH] fix(items): bump openclaw to 2026.8.1 and correct the gateway probe and bind MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Pin ghcr.io/openclaw/openclaw:2026.8.1 (released 2026-08-31, multi-arch amd64/arm64, index digest sha256:e7849cb6c1ef1ead39ab4be7d85edb2df89611f4 86e283284c7cf35ce39a20d4), and fix two defects found while re-checking the component against upstream's container contract. Readiness moves from /readyz to /startupz. Upstream defines /readyz as startup plus deep per-channel readiness, and /startupz as startup only with channel health not consulted — the latter being what it designates for orchestrator traffic admission. On /readyz a single lapsed Telegram or Discord credential returns 503 and pulls an otherwise healthy Control UI out of service. The comment defending the old choice was also wrong: /healthz is a dedicated probe answering {"ok":true,"status":"live"}, not the Control UI shell. The gateway exec now passes --bind lan --port 18789, as upstream's own docker-compose.yml does. gateway.bind defaults to loopback, so the listener was reachable only because `config set` wrote bind=lan to the persisted volume — a load-bearing step sitting behind a comment claiming the default bind was already routable and that OPENCLAW_GATEWAY_BIND was being left alone deliberately. Neither was true: OPENCLAW_GATEWAY_BIND is a Compose-level variable the runtime never reads. Also pin the container-side paths upstream pins (HOME, OPENCLAW_HOME, OPENCLAW_STATE_DIR, OPENCLAW_CONFIG_DIR, OPENCLAW_CONFIG_PATH, OPENCLAW_WORKSPACE_DIR, OPENCLAW_GATEWAY_PORT). These already resolved correctly via the image's node passwd entry, but stating them makes the mountPath values and the paths the runtime uses the same by construction. Listing picks up the version string, the note that tools installed into the container home rather than the state dir do not survive a redeploy, and the note that 2026.8.1 consolidates memory and learns skills in the background by default, so an idle deployment can still bill the user's model provider. Verified: typecheck, item suite 25/25, full corpus 377/377; the folded command scalar resolves to one well-formed shell string whose --batch-json argument parses as valid JSON with the three intended ops and the trailing slash stripped from OPENCLAW_PUBLIC_ORIGIN. Not verified — no container runtime in the devcontainer: the live smoke test, the bind negative control, and the 2026.7.1 -> 2026.8.1 in-place upgrade across the two breaking migrations in this release. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01PB8wsC93YQxG8XKNscdY2D --- items/openclaw/components/openclaw.yaml | 75 ++++++++++++++++++++----- items/openclaw/listing.yaml | 11 +++- 2 files changed, 72 insertions(+), 14 deletions(-) diff --git a/items/openclaw/components/openclaw.yaml b/items/openclaw/components/openclaw.yaml index 87ab1b1..2c7aed8 100755 --- a/items/openclaw/components/openclaw.yaml +++ b/items/openclaw/components/openclaw.yaml @@ -8,12 +8,12 @@ spec: source: type: IMAGE # Latest stable calendar release (beta tags are not pinned for the catalog). - ref: ghcr.io/openclaw/openclaw:2026.7.1 + ref: ghcr.io/openclaw/openclaw:2026.8.1 # Converge config through OpenClaw's own `config set` CLI, then exec the # stock gateway entrypoint (`tini -s --` passes argv through, so `sh -c` works). # # The Control UI origin allowlist (`gateway.controlUi.allowedOrigins`) is - # CONFIG-FILE-ONLY — verified against 2026.7.1, whose bundle declares no + # CONFIG-FILE-ONLY — re-verified against 2026.8.1, whose bundle declares no # matching env var — and without this deployment's public origin in it the # gateway rejects the browser with "Browser origin not allowed". # @@ -22,19 +22,25 @@ spec: # normalized document carrying the `meta.lastTouchedVersion` stamp the gateway # expects, whereas a hand-rolled file is rejected as clobbered config # ("existing config is missing gateway.mode"). Verified live: after - # `config set`, the origin survives gateway startup and /readyz returns 200. + # `config set`, the origin survives gateway startup and /startupz returns 200. # # Run unconditionally on every boot rather than behind a first-boot guard — # the config lives on a persistent volume, so a guard would pin the very first # boot's origin forever and leave a re-deployed app permanently unreachable. # `config set` is declarative, so re-applying is a no-op. + # + # `--bind lan --port 18789` repeats on argv what `config set` just wrote, the + # way upstream's own docker-compose.yml does. `gateway.bind` DEFAULTS TO + # `loopback`, so the listener is only reachable through the platform edge + # because something sets it; passing it here means that no longer depends + # solely on the persisted config being intact. command: >- sh -c 'set -e; node /app/dist/index.js config set --batch-json "[{\"path\":\"gateway.mode\",\"value\":\"local\"}, {\"path\":\"gateway.bind\",\"value\":\"lan\"}, {\"path\":\"gateway.controlUi.allowedOrigins\",\"value\":[\"${OPENCLAW_PUBLIC_ORIGIN%/}\"]}]"; - exec node openclaw.mjs gateway' + exec node openclaw.mjs gateway --bind lan --port 18789' endpoints: primary: containerPort: 18789 @@ -42,27 +48,64 @@ spec: visibility: PUBLIC health: readiness: - # /readyz is the machine-readable gate; /healthz can return the Control UI - # HTML shell with a 200, which would falsely read as ready. - path: /readyz + # /startupz reports "startup finished, not draining" WITHOUT consulting + # channel health, which is what upstream designates for orchestrator + # traffic admission. /readyz additionally runs deep per-channel checks, + # so one lapsed Telegram or Discord credential would 503 and pull an + # otherwise healthy Control UI out of service (docs.openclaw.ai + # gateway/health#http-probes). + path: /startupz endpoint: primary - # Node boot + SQLite migrations run before the gate opens on first start. + # Node boot, SQLite migrations, and (since 2026.8.1) startup-safe config + # migrations all run before the gate opens on first start. initialDelaySeconds: 45 timeoutSeconds: 5 successThreshold: 1 failureThreshold: 10 liveness: + # /healthz is the dedicated liveness probe: "the HTTP server is live", + # answering {"ok":true,"status":"live"}. It is not the Control UI shell. path: /healthz endpoint: primary periodSeconds: 30 timeoutSeconds: 5 failureThreshold: 3 envVars: - # OPENCLAW_GATEWAY_BIND is deliberately left at its default (routable) bind: - # the "loopback" guidance assumes a reverse proxy sharing the container's - # network namespace, but here the platform edge is a separate hop, so a - # loopback bind would make containerPort 18789 unreachable. - # + # Container-side paths, pinned the way upstream's docker-compose.yml pins + # them. They already resolve correctly here (HOME comes from the image's + # `node` passwd entry and no host .env is imported), but stating them makes + # the mountPath values below and the paths the runtime actually uses the + # same thing by construction rather than by inference. + - key: HOME + value: + type: LITERAL + value: /home/node + - key: OPENCLAW_HOME + value: + type: LITERAL + value: /home/node + - key: OPENCLAW_STATE_DIR + value: + type: LITERAL + value: /home/node/.openclaw + - key: OPENCLAW_CONFIG_DIR + value: + type: LITERAL + value: /home/node/.openclaw + - key: OPENCLAW_CONFIG_PATH + value: + type: LITERAL + value: /home/node/.openclaw/openclaw.json + - key: OPENCLAW_WORKSPACE_DIR + value: + type: LITERAL + value: /home/node/.openclaw/workspace + # The in-container listener port, matching containerPort above. This is + # also the port in-container CLI invocations dial. + - key: OPENCLAW_GATEWAY_PORT + value: + type: LITERAL + value: '18789' # No mDNS advertising inside a container network (also auto-disabled when # the runtime detects a container; kept explicit for intent). - key: OPENCLAW_DISABLE_BONJOUR @@ -73,6 +116,12 @@ spec: # Core state: openclaw.json, SQLite session DBs, installed plugins, .env, and # the agent workspace (default /home/node/.openclaw/workspace lives inside # this directory, so a single claim covers config + workspace). + # + # Deliberately NOT all of /home/node (upstream's OPENCLAW_HOME_VOLUME): a + # Claude Code CLI login under ~/.local and ~/.claude, and a first-run + # Playwright Chromium under ~/.cache, therefore do not survive a redeploy. + # Called out in the listing; widening this claim would nest auth-secrets + # below inside it and belongs in its own change. config: sizeGib: 10 mountPath: /home/node/.openclaw diff --git a/items/openclaw/listing.yaml b/items/openclaw/listing.yaml index c1762c1..bbaf84f 100755 --- a/items/openclaw/listing.yaml +++ b/items/openclaw/listing.yaml @@ -24,7 +24,7 @@ spec: providers behind one gateway. ## Defaults - Single-container deployment of `ghcr.io/openclaw/openclaw:2026.7.1` + Single-container deployment of `ghcr.io/openclaw/openclaw:2026.8.1` with the Control UI on port 18789 behind the platform's HTTPS edge. Access is gated by an auto-generated gateway token — copy it from the deployment's Configuration tab and enter it on your first visit, then @@ -36,6 +36,15 @@ spec: keep configuration, session history, and the OAuth-token encryption key across restarts. + Tools installed into the container home itself rather than into + OpenClaw's state directory — a Claude Code CLI login, a browser + downloaded on first use — fall outside those volumes and are + reinstalled after a redeploy. + + This release consolidates memory and learns skills in the background + by default, so the deployment can call your model provider even when + no one is chatting. Both are switchable off under Settings. + Messaging-channel onboarding (WhatsApp, Telegram, Discord) requires the interactive CLI and is not available in this deployment yet. category: AI_ML