Summary

The top-level README Docker auth example mounts only /home/gog/.config/gogcli, but new file-keyring tokens are stored under the data directory. Users following the README can complete auth add in the container and then lose the stored tokens after the container exits.

The install and paths docs already show the safer GOG_HOME=/persist/gogcli pattern, so this appears to be README drift.

Evidence

The README currently recommends mounting only the config directory for authenticated container runs:

docker volume create gogcli-config

docker run --rm -it \
  -e GOG_KEYRING_BACKEND=file \
  -e GOG_KEYRING_PASSWORD \
  -v gogcli-config:/home/gog/.config/gogcli \
  ghcr.io/openclaw/gogcli:latest \
  auth add [email protected] --services gmail,calendar,drive

Relevant runtime behavior:

• Dockerfile sets HOME=/home/gog.
• internal/config/layout_paths.go defines:
  • primary keyring dir: DataDir/keyring
  • legacy keyring dir: ConfigDir/keyring
• Layout.KeyringDir() returns the primary data keyring for new installs unless a legacy config keyring already exists.
• internal/secrets/backend.go opens the file keyring using Layout.EnsureKeyringDir().

Other docs already use the correct pattern:

• docs/paths.md says data contains file-keyring entries.
• docs/paths.md and docs/install.md recommend mounting a single persistent GOG_HOME root:

docker run --rm -it \
  -e GOG_HOME=/persist/gogcli \
  -e GOG_KEYRING_BACKEND=file \
  -e GOG_KEYRING_PASSWORD \
  -v gogcli-state:/persist/gogcli \
  ghcr.io/openclaw/gogcli:latest \
  auth add [email protected] --services gmail,calendar,drive

Expected behavior

The README Docker auth example should persist the directories that actually contain file-keyring entries, or use GOG_HOME so config/data/state/cache are kept together.

Actual behavior

The README mounts only the config directory. On a new install, file-keyring entries are written under the data directory, so auth state is not persisted by the documented volume.

Suggested fix

Update the README Docker auth example to match docs/install.md / docs/paths.md and use a persistent GOG_HOME volume.

Related

Possibly related but not a duplicate: #622 added GOG_HOME / per-kind path support. This issue is about the README example still documenting the older config-only mount pattern.