Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

Docker E2E and package-backed Docker lanes can fail before the test container starts when the local Docker daemon rejects OpenClaw's default --memory, --cpus, or --pids-limit resource controls.

Steps to reproduce

1. Run an OpenClaw Docker E2E helper on a Docker host that accepts the command but rejects cgroup/resource-limit controls during container create/start.
2. Use the default helper behavior that injects --memory, --cpus, and --pids-limit.
3. Observe the Docker run fail before the target test container starts.

Expected behavior

The Docker E2E helper should handle daemon/runtime resource-limit rejection by retrying without only OpenClaw's default injected resource caps, while preserving ordinary Docker failures.

Actual behavior

The helper fails immediately on the resource-limit create/start error. Operators have to know to set OPENCLAW_DOCKER_E2E_DISABLE_RESOURCE_LIMITS=1 manually, and failed named-container or --cidfile attempts can leave artifacts that block retry.

OpenClaw version

Current main before PR #98579.

Operating system

Docker hosts with constrained, nested, rootless, or otherwise limited cgroup support.

Install method

Source checkout / Docker E2E helper scripts.

Model

N/A

Provider / routing chain

N/A

Logs

Original daemon/runtime resource-cap failures covered by the report:

OCI runtime create failed: crun: controller pids is not available

OCI runtime create failed: crun: cgroup controller pids is not available

Real rootless Docker daemon repro from 122.51.21.218:

docker: Error response from daemon: NanoCPUs can not be set, as your kernel does not support CPU CFS scheduler or the cgroup is not mounted

Screenshots, recordings, and evidence

PR #98579 now includes live daemon proof from 122.51.21.218:

• Host Docker recovered to server=29.6.1 cgroup=2 driver=overlayfs cgroupDriver=systemd.
• Control run on the normal system daemon accepted both plain and resource-limited Docker runs.
• A temporary rootless Docker daemon started as a systemd user service accepted a plain docker run but rejected docker run --memory 64m --cpus 0.5 --pids-limit 64 with Docker's real NanoCPUs can not be set ... cgroup is not mounted error.
• Before the classifier extension, the helper returned status 125 on that daemon. After the fix, the same helper printed the retry warning and returned status 0.
• Cleanup after proof reported Docker containers=0, running=0, and images=0.

Focused tests also cover both helper paths:

• scripts/lib/docker-e2e-container.sh retrying after cgroup/resource-cap rejection.
• scripts/lib/docker-e2e-package.sh retrying after the same class of rejection.
• Image-boundary cleanup for post-image --name / --cidfile arguments.
• False-positive guard for container stderr that only looks like a resource-limit error.

Impact and severity

Affected: developers and CI operators running Docker E2E lanes on constrained Docker hosts.

Severity: Medium. The test lane fails before exercising the OpenClaw behavior under test.

Frequency: Reproducible on hosts where Docker rejects the default cgroup/resource-limit controls.

Consequence: Operators need manual environment knowledge to disable resource caps, and failed --name / --cidfile artifacts can make retry less obvious.

Additional information

Fix PR: #98579