Skip to content
This repository was archived by the owner on Feb 27, 2026. It is now read-only.

Update fly.io config - #28

Draft
neekolas wants to merge 7 commits into
02-16-refactor_xmtp_modulefrom
02-16-fly.io_config
Draft

Update fly.io config#28
neekolas wants to merge 7 commits into
02-16-refactor_xmtp_modulefrom
02-16-fly.io_config

Conversation

@neekolas

@neekolas neekolas commented Feb 16, 2026

Copy link
Copy Markdown

Summary

  • Problem: Docker container runs as non-root user, causing permission issues when mounting volumes
  • Why it matters: Users deploying with Docker/Fly.io face data directory permission errors
  • What changed: Added proper entrypoint script with gosu to fix volume ownership before dropping privileges
  • What did NOT change: Core application functionality remains the same

Change Type (select all)

  • Bug fix
  • Feature
  • Refactor
  • Docs
  • Security hardening
  • Chore/infra

Scope (select all touched areas)

  • Gateway / orchestration
  • Skills / tool execution
  • Auth / tokens
  • Memory / storage
  • Integrations
  • API / contracts
  • UI / DX
  • CI/CD / infra

Linked Issue/PR

  • Closes #

User-visible / Behavior Changes

  • Docker containers now properly handle volume mounts with correct permissions
  • Added XMTP channel documentation
  • Updated channel index to include XMTP

Security Impact (required)

  • New permissions/capabilities? (Yes)
  • Secrets/tokens handling changed? (No)
  • New/changed network calls? (No)
  • Command/tool execution surface changed? (No)
  • Data access scope changed? (No)
  • If any Yes, explain risk + mitigation: Container now runs as root initially but drops privileges after fixing permissions, following Docker best practices for volume handling.

Repro + Verification

Environment

  • OS: Linux
  • Runtime/container: Docker
  • Relevant config: Docker volume mount to /data

Steps

  1. Run container with volume mount: docker run -v ./data:/data openclaw/openclaw
  2. Verify container starts without permission errors
  3. Verify data directory has correct ownership (node:node)

Expected

  • Container starts successfully
  • Data directory permissions are correct

Actual

  • Container starts successfully
  • Data directory permissions are correct

Evidence

  • Trace/log snippets

Human Verification (required)

What you personally verified (not just CI), and how:

  • Verified scenarios: Docker container startup with volume mounts
  • Edge cases checked: Container restart with existing data
  • What you did not verify: Long-term stability in production environments

Compatibility / Migration

  • Backward compatible? (Yes)
  • Config/env changes? (No)
  • Migration needed? (No)

Failure Recovery (if this breaks)

  • How to disable/revert this change quickly: Revert to previous Dockerfile
  • Files/config to restore: Dockerfile
  • Known bad symptoms reviewers should watch for: Permission errors, container startup failures

Risks and Mitigations

  • Risk: Running as root initially could theoretically increase attack surface
    • Mitigation: Container drops privileges immediately after fixing permissions, following Docker best practices

neekolas commented Feb 16, 2026

Copy link
Copy Markdown
Author

@neekolas neekolas mentioned this pull request Feb 16, 2026
15 tasks
@macroscopeapp

macroscopeapp Bot commented Feb 16, 2026

Copy link
Copy Markdown

Update Fly deployment by switching app to listen on port 18789 and start via docker-entrypoint.sh that drops privileges with gosu

Introduce a sh entrypoint that fixes /data ownership and execs as node, add gosu to the image, run a second pnpm install after copying the source, and change Fly app name, volume, env paths, and internal port to 18789 in fly.toml.

📍Where to Start

Start with the entrypoint logic in docker-entrypoint.sh, then review image changes in Dockerfile and Fly settings in fly.toml.


Macroscope summarized 19d8e87. (Automatic summaries will resume when PR exits draft mode or review begins).

@neekolas
neekolas force-pushed the 02-16-fly.io_config branch from 19d8e87 to 2b28cab Compare February 16, 2026 20:32
Comment thread xmtp-config.json Outdated

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 Critical

xmtp-config.json:37 Hardcoded authentication token committed to repository. Consider using an environment variable reference instead (e.g., ${GATEWAY_AUTH_TOKEN} or reading from a secrets file).

Suggested change
"token": "42c36667c7fb7d0a6ba098880a89111edb699c15ba1bbbd316a7fd8be230353b",
"token": "${GATEWAY_AUTH_TOKEN}",

🚀 Want me to fix this? Reply ex: "fix it for me".

🤖 Prompt for AI
In file xmtp-config.json around line 37:

Hardcoded authentication token committed to repository. Consider using an environment variable reference instead (e.g., `${GATEWAY_AUTH_TOKEN}` or reading from a secrets file).

@github-actions

Copy link
Copy Markdown

⚠️ Formal models conformance drift detected

The formal models extracted constants (generated/*) do not match this openclaw PR.

This check is informational (not blocking merges yet).
See the formal-models-conformance-drift artifact for the diff.

If this change is intentional, follow up by updating the formal models repo or regenerating the extracted artifacts there.

@neekolas
neekolas force-pushed the 02-16-fly.io_config branch from 2b28cab to baf8651 Compare February 16, 2026 21:04
@github-actions

Copy link
Copy Markdown

⚠️ Formal models conformance drift detected

The formal models extracted constants (generated/*) do not match this openclaw PR.

This check is informational (not blocking merges yet).
See the formal-models-conformance-drift artifact for the diff.

If this change is intentional, follow up by updating the formal models repo or regenerating the extracted artifacts there.

@neekolas
neekolas force-pushed the 02-16-refactor_xmtp_module branch from fa7821b to 2a564f9 Compare February 16, 2026 21:28
@neekolas
neekolas force-pushed the 02-16-fly.io_config branch from baf8651 to a4e0884 Compare February 16, 2026 21:28
@github-actions

Copy link
Copy Markdown

⚠️ Formal models conformance drift detected

The formal models extracted constants (generated/*) do not match this openclaw PR.

This check is informational (not blocking merges yet).
See the formal-models-conformance-drift artifact for the diff.

If this change is intentional, follow up by updating the formal models repo or regenerating the extracted artifacts there.

@neekolas
neekolas force-pushed the 02-16-fly.io_config branch 2 times, most recently from 4b4216d to 5d5191d Compare February 16, 2026 21:38
@github-actions

Copy link
Copy Markdown

⚠️ Formal models conformance drift detected

The formal models extracted constants (generated/*) do not match this openclaw PR.

This check is informational (not blocking merges yet).
See the formal-models-conformance-drift artifact for the diff.

If this change is intentional, follow up by updating the formal models repo or regenerating the extracted artifacts there.

@neekolas
neekolas force-pushed the 02-16-fly.io_config branch from 5d5191d to 0521f77 Compare February 16, 2026 23:32
@github-actions

Copy link
Copy Markdown

⚠️ Formal models conformance drift detected

The formal models extracted constants (generated/*) do not match this openclaw PR.

This check is informational (not blocking merges yet).
See the formal-models-conformance-drift artifact for the diff.

If this change is intentional, follow up by updating the formal models repo or regenerating the extracted artifacts there.

neekolas and others added 7 commits February 16, 2026 17:13
Document the XMTP extension following established channel doc conventions.
Covers setup, configuration, access control, ENS resolution, media via
Pinata IPFS, reactions, and troubleshooting. Also adds XMTP to channel index.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@neekolas
neekolas force-pushed the 02-16-fly.io_config branch from 0521f77 to 9bf79c3 Compare February 17, 2026 01:20
@github-actions

Copy link
Copy Markdown

⚠️ Formal models conformance drift detected

The formal models extracted constants (generated/*) do not match this openclaw PR.

This check is informational (not blocking merges yet).
See the formal-models-conformance-drift artifact for the diff.

If this change is intentional, follow up by updating the formal models repo or regenerating the extracted artifacts there.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant