fix(docker): package selected external plugins in source-built images by steipete · Pull Request #103629 · openclaw/openclaw

steipete · 2026-07-10T10:21:09Z

What Problem This Solves

Fixes an issue where operators building a source-based OpenClaw OCI image with OPENCLAW_EXTENSIONS could successfully stage a selected official plugin's dependencies while the final image still lacked a runnable /app/dist/extensions/<id> runtime for plugins excluded from the root bundled distribution.

Why This Change Was Made

The Docker build now validates and canonicalizes selected plugin ids, passes the selection only to the in-container unified build, and compiles selected plugins whose package metadata keeps them outside the ordinary root distribution. Known dependency/source-only selections retain their existing staging behavior, unknown ids fail closed, and ordinary npm/release artifact selection remains unchanged.

The final-image lane verifies manifests, rewritten package entries, production dependencies, runtime capabilities, implicit ClawRouter availability, unselected-plugin absence, no-browser defaults, and caller-supplied build provenance. Release guards reject accidental external-plugin trees from the core package.

This is intentionally an OCI-image packaging change for standalone gateways and generic Docker users. Crabhelm-managed gateways consume a separate private x86_64 appliance archive containing an OpenClaw npm tarball; they do not consume these custom OCI images.

User Impact

Operators can build digest-pinned amd64 or arm64 OpenClaw images with selected ClickClack, Slack, or Microsoft Teams runtimes and receive an image that actually loads the selected channel after configuration. Existing ClawRouter, Teams, internal-plugin, dependency-only selection, pruning, and npm/release behavior remain intact.

Risk is medium because the Docker build and final runtime artifact layout change. The risk is bounded to source-built images and covered on native amd64 and arm64 Docker hosts; no registry image, deployment, credential, release, version, tag, or npm publication is part of this PR.

Evidence

Exact PR head 63f959f1648dbfac4b240cda879142c8e7f71fc9: 131 focused assertions passed (src/dockerfile.test.ts, build-entry/release guards, and Docker packaging E2E), plus Docker E2E boundary and generated docs-map checks on Testbox run 29085883120.
git diff --check passed on the exact PR head.
Native amd64 final-image proof passed on the patch-identical pre-rebase tree: selected runtimes loaded, unknown ids failed closed, known dependency-only ids staged, unselected artifacts stayed absent, build provenance matched, and the image was sha256:8e415c4f9bc7f85a7a960a2292903baff52f7ff01d9bd344d47449818498ddf3 (Testbox host run 29083946067).
Native arm64 final-image proof passed with the same assertions and image sha256:dc7e3c1bb2f5bd7a421477f4c54233e434366d1cc59b41a21d0c879abd96f975 (Crabbox run).
Source-blind behavior validation confirmed embedded provenance, selected channel loading, implicit ClawRouter text-inference capability, fresh-container retry, unselected Signal failure, and absent browser payloads (Crabbox run).
git range-diff reports all three commits patch-identical across the final rebase; upstream drift did not touch Docker/plugin packaging or selected plugin inputs, so native images were not rebuilt solely for commit-id drift.
check:changed all lanes and final autoreview passed on the same patch before the patch-identical rebase; autoreview reported no accepted/actionable findings.
Public Model Identifier Gate: PASS; this patch, its generated delta, proof text, issue, and PR body add no concrete model identifiers.

No CHANGELOG.md edit: normal OpenClaw PRs leave changelog generation to the release process.

AI-assisted implementation; no agent transcript is included by explicit request.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 63f959f164

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bb60f3b885

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

steipete · 2026-07-10T12:00:17Z

Land-ready proof for exact head 59d449b7415b9d7d70cf653b5dbd52f396fd57ce (tree 7f38c032a271b3172c6b96b0b4f357deb4fe588e):

Repo-native review artifacts validate with no findings. Review caught package-less selection, manifest-id/source-directory mismatch, and build-context shadow cases; all are fixed, replied to where public, and resolved. Two final autoreview passes are clean.
Authoritative exact-head checks are green in CI run 29090691699, including docs, build artifacts, plugin boundaries, Windows, CodeQL, Blacksmith Testbox, and Blacksmith ARM. Repo-native OPENCLAW_TESTBOX=1 scripts/pr prepare-run passed with hosted_exact_or_recent_rebase and confirmed the public head.
Focused exact-head proof: 54 assertions; manifest-only and manifest-id selections resolve; build-context shadowing is isolated; invalid, unknown, and ambiguous selections fail closed; docs-map, Docker E2E boundaries, formatting, and git diff --check pass.
Tested-tree broad proof: all-lanes check:changed passed; the clean test:changed rerun passed 5,085 assertions. The final rebase was patch-identical by git range-diff, and upstream drift did not touch Docker/plugin packaging or selected-plugin inputs.
Native final-image E2E passed on amd64 (sha256:ae096075cd318e60da00c1f8c21cc7f756c9b8a963dcebd78c1b568e9d3ad46c) and arm64 (sha256:9d84844c0efdc13c62c2d71b16582a8b5effc66f5f51e9fb95358c48de90fd48) on the patch-identical tested head. It verifies selected ClickClack/Slack/Teams manifests, entries, dependencies, and runtime capabilities; manifest-id normalization; implicit ClawRouter availability; unselected-plugin absence; provenance; and the no-browser default. These images are local proof artifacts only and were not published.
Risk boundary: the selector accepts known official source-tree plugin identities deterministically, compiles only supported external selections, preserves dependency-only selections, and rejects invalid, unknown, or ambiguous values. The canonical selection stays outside the build-context destination. Ordinary npm/release artifacts remain selector-independent and reject leaked excluded plugin trees.
Distribution boundary: this OCI path is for standalone gateways and generic Docker users. Crabhelm consumes a separate private x86_64 appliance archive, not these OCI images. No registry publication, deployment, release, version/tag, credential, environment, or changelog mutation is part of this PR.
Public Model Identifier Gate: PASS for the exact diff, tests, generated metadata, CI/proof text, issue, and PR surfaces; no candidate model identifiers were present.

Issue: #103626.

steipete · 2026-07-10T12:00:56Z

Merged via squash.

Prepared head SHA: 59d449b7415b9d7d70cf653b5dbd52f396fd57ce
Landed commit: a238dead67bd9a5e5a44dea4892a00a1d1e83203

…openclaw#103629) * build(docker): package selected external plugins * test(docker): auto-clean plugin fixture * fix(docker): preserve selected image provenance * fix(docker): accept manifest-only plugin selections * fix(docker): resolve selected plugin manifest ids * fix(docker): isolate resolved plugin selection

steipete requested a review from a team as a code owner July 10, 2026 10:21

openclaw-barnacle Bot added docs Improvements or additions to documentation scripts Repository scripts docker Docker and sandbox tooling extensions: clawrouter Extension: clawrouter size: L maintainer Maintainer-authored PR labels Jul 10, 2026

chatgpt-codex-connector Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread Dockerfile Outdated

openclaw-barnacle Bot added app: macos App: macos app: web-ui App: web-ui extensions: qa-lab size: XL and removed size: L labels Jul 10, 2026

steipete requested a review from a team as a code owner July 10, 2026 11:01

steipete force-pushed the codex/docker-selected-external-plugins branch from 7369115 to bb60f3b Compare July 10, 2026 11:03

openclaw-barnacle Bot removed app: ios App: ios app: macos App: macos app: web-ui App: web-ui gateway Gateway runtime labels Jul 10, 2026

chatgpt-codex-connector Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread Dockerfile Outdated

steipete added 6 commits July 10, 2026 04:49

build(docker): package selected external plugins

94df899

test(docker): auto-clean plugin fixture

148c64f

fix(docker): preserve selected image provenance

411536e

fix(docker): accept manifest-only plugin selections

2868227

fix(docker): resolve selected plugin manifest ids

b9d189f

fix(docker): isolate resolved plugin selection

59d449b

steipete force-pushed the codex/docker-selected-external-plugins branch from bb60f3b to 59d449b Compare July 10, 2026 11:50

steipete merged commit a238dea into main Jul 10, 2026
100 checks passed

steipete deleted the codex/docker-selected-external-plugins branch July 10, 2026 12:00

github-actions Bot mentioned this pull request Jul 10, 2026

📡 Upstream Digest — 2026-07-10 14:03 UTC curtismercier/openclaw-mods#1251

Open

sallyom mentioned this pull request Jul 10, 2026

Podman build cannot read selected-plugin Dockerfile source bind mounts on amd64 #103741

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(docker): package selected external plugins in source-built images#103629

fix(docker): package selected external plugins in source-built images#103629
steipete merged 6 commits into
mainfrom
codex/docker-selected-external-plugins

steipete commented Jul 10, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

steipete commented Jul 10, 2026

Uh oh!

Uh oh!

steipete commented Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

steipete commented Jul 10, 2026

What Problem This Solves

Why This Change Was Made

User Impact

Evidence

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

steipete commented Jul 10, 2026

Uh oh!

Uh oh!

steipete commented Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant