Greptile Summary

Added OPENCLAW_EXTENSIONS build arg to enable pre-installing extension npm dependencies at image build time

• Dockerfile: Uses bind mount to selectively copy extension package.json files before pnpm install, keeping layer size optimal
• Setup scripts: Both docker-setup.sh and setup-podman.sh now pass the build arg correctly
• Bonus fix: setup-podman.sh now properly forwards OPENCLAW_DOCKER_APT_PACKAGES to podman builds (was missing before)
• Documentation: Clear examples in both Docker and Podman install guides
• CI coverage: Added smoke test for extension build path

The approach is solid for K8s/immutable deployments where runtime npm install would fail or cause cold-start penalties.

Confidence Score: 4/5

• Safe to merge - well-implemented optional build-time optimization with no breaking changes to default behavior
• Implementation follows Docker best practices and existing patterns in the codebase. The feature is opt-in (default behavior unchanged), properly tested via CI smoke test, and clearly documented. Minor point: no validation of extension names in the build arg, but this is low risk since build args are controlled by the image builder.
• No files require special attention

_{Last reviewed commit: 84b2c14}

I dug into the dependency concern here because at first glance it looks like diagnostics-otel should need a direct core package dep.

What I found:

• The missing openclaw package dependency is not the bug here.
• Bundled extensions resolve openclaw/plugin-sdk/* through the plugin loader alias path in core, not through a direct dependencies.openclaw entry in each extension manifest.
• OPENCLAW_EXTENSIONS is only controlling whether an extension's own npm dependencies get preinstalled into the Docker image during the early pnpm install layer.

So the distinction is:

• openclaw/plugin-sdk/* comes from the host/core package at load time.
• @opentelemetry/*, Matrix SDK packages, etc. come from the extension's own package.json and need to be present if we want to avoid first-load runtime installs.

That means the build arg is coherent: it is an opt-in for baking selected extension dependency trees into the image while keeping the default image smaller.

My remaining concern is CI coverage, not package metadata:

• the new smoke path currently proves docker build succeeds and openclaw --version runs
• it does not prove that an image built with OPENCLAW_EXTENSIONS="diagnostics-otel" can actually load that extension at runtime

So I would not treat the missing core dep as a blocker, but I do think we should either:

• add a follow-up smoke that enables and loads diagnostics-otel in-container, or
• explicitly accept that this PR only validates build-time preinstallation, not end-to-end extension loading

That clarification should be in the thread before merge.