Skip to content

Persist Docker auth profile key mount#80991

Merged
obviyus merged 3 commits into
mainfrom
codex/docker-auth-profile-key
May 12, 2026
Merged

Persist Docker auth profile key mount#80991
obviyus merged 3 commits into
mainfrom
codex/docker-auth-profile-key

Conversation

@obviyus

@obviyus obviyus commented May 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Mount a durable auth-profile secret key directory into Docker gateway and CLI containers at the existing Linux key path.
  • Have docker setup create, persist, and chown that host directory, including home-volume overlays.
  • Document the persisted key directory.

Verification

  • pnpm test src/docker-setup.e2e.test.ts
  • bash -n scripts/docker/setup.sh
  • pnpm oxfmt --check --threads=1 src/docker-setup.e2e.test.ts
  • git diff --check
  • OPENCLAW_CONFIG_DIR=/tmp/openclaw OPENCLAW_WORKSPACE_DIR=/tmp/openclaw/workspace OPENCLAW_AUTH_PROFILE_SECRET_DIR=/tmp/openclaw-auth-profile-secrets docker compose config

Real behavior proof

Before the fix, a Docker bot on latest main failed before reply:

failed to create oauth profile secret key file
Error: OAuth profile secret key source is required to persist OAuth profile secrets
Embedded agent failed before reply

After mounting the auth-profile key path as durable host state, the same Docker bot completed a model reply:

$ openclaw agent --agent main --message "Reply with OK" --json --timeout 120
{"type":"message","text":"OK"}

$ stat -c '%a %n' /home/<user>/.config/openclaw/auth-profile-secret-key
600 /home/<user>/.config/openclaw/auth-profile-secret-key

@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation scripts Repository scripts docker Docker and sandbox tooling size: S maintainer Maintainer-authored PR labels May 12, 2026
@obviyus obviyus self-assigned this May 12, 2026
@clawsweeper

clawsweeper Bot commented May 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs real behavior proof before merge.

Summary
The branch adds a durable Docker bind mount for the auth-profile secret key directory, teaches docker setup to create/chown/persist it, and documents the directory.

Reproducibility: yes. source-level: current main resolves the Linux OAuth profile key under /home/node/.config/openclaw while Docker persists only /home/node/.openclaw and the workspace. I did not run a live Docker OAuth replay in this review.

Real behavior proof
Not applicable: This is a maintainer-labeled PR, so the external contributor real-behavior-proof gate does not apply; the body still includes a before-error and after-success note.

Next step before merge
No repair job: the PR already contains the focused change and no discrete code defect was found; remaining action is maintainer review and landing.

Security
Cleared: No concrete security or supply-chain regression was found; the diff adds a local Docker bind mount and uses the existing mount validation/chown pattern without new third-party code or workflow changes.

Review details

Best possible solution:

Land the focused Docker mount/setup/docs change after maintainer review, keeping OAuth auth-profile key material durable and outside the mounted OpenClaw state directory.

Do we have a high-confidence way to reproduce the issue?

Yes, source-level: current main resolves the Linux OAuth profile key under /home/node/.config/openclaw while Docker persists only /home/node/.openclaw and the workspace. I did not run a live Docker OAuth replay in this review.

Is this the best way to solve the issue?

Yes, this is the narrow maintainable direction because it mounts the existing Linux key path instead of changing auth-profile encryption or moving token material back into the state directory.

What I checked:

  • Current Docker mounts: Current main binds only /home/node/.openclaw and /home/node/.openclaw/workspace into both Docker services; there is no durable /home/node/.config/openclaw mount for the Linux auth-profile secret key path. (docker-compose.yml:38, 0586da70db07)
  • Auth-profile key contract: The auth-profile secret code resolves Linux fallback key material under ${XDG_CONFIG_HOME:-$HOME/.config}/openclaw/auth-profile-secret-key and throws OAuth profile secret key source is required to persist OAuth profile secrets when no key source can be read or created. (src/agents/auth-profiles/persisted.ts:271, 0586da70db07)
  • PR implementation: The PR patch adds OPENCLAW_AUTH_PROFILE_SECRET_DIR bind mounts to gateway and CLI services, adds setup-script validation/creation/export/chown for that directory, and adds e2e assertions for the mount and directory creation. (scripts/docker/setup.sh:240, 5adc4380eb98)
  • Documentation coverage: Current Docker persistence docs list config/workspace persistence but not the auth-profile key directory; the PR updates Docker, VM runtime, ClawDock, and .env.example docs to describe the new host directory. Public docs: docs/install/docker.md. (docs/install/docker.md:258, 0586da70db07)
  • Live PR state and checks: GitHub API shows this PR is open with maintainer, docker, scripts, and docs labels; relevant CI checks are green, while the Real behavior proof check reports a failure that is not treated as a code finding for a maintainer-labeled PR. (5adc4380eb98)
  • History routing: Blame/log sampling ties the current Docker setup/compose/auth-profile surfaces mostly to recent Peter Steinberger work, with prior Docker docs work by Ayaan Zaidi and Docker setup/sandbox history by jamtujest. (7a8d86be2760)

Likely related people:

  • Peter Steinberger: Current-main blame on the Docker compose/setup files and auth-profile persisted key code points to recent commits by Peter, and Docker history shows repeated setup/release touches in this area. (role: recent area contributor; confidence: high; commits: 0586da70db07, 7a8d86be2760, dfef943f0a18; files: docker-compose.yml, scripts/docker/setup.sh, src/agents/auth-profiles/persisted.ts)
  • obviyus: Ayaan Zaidi has prior merged Docker docs history in docs/install/docker.md, and this PR is maintainer-labeled and assigned to the same login, so this is more than reporter-only involvement. (role: recent adjacent contributor; confidence: medium; commits: d134a8c7f3e2; files: docs/install/docker.md)
  • jamtujest: Introduced opt-in Docker sandbox support that shares the setup-generated compose/home-volume surface this PR adjusts. (role: adjacent Docker setup contributor; confidence: low; commits: cb491dfde5cb; files: scripts/docker/setup.sh, docker-compose.yml)

Remaining risk / open question:

  • I did not run a live Docker OAuth replay in this read-only review; behavior confidence comes from source inspection, PR body proof text, and CI status.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 0586da70db07.

@obviyus
obviyus force-pushed the codex/docker-auth-profile-key branch from 5adc438 to 367a73e Compare May 12, 2026 11:02
obviyus added a commit that referenced this pull request May 12, 2026
@obviyus
docs(changelog): mention docker auth profile key mount (#80991)
367a73e
@obviyus
obviyus force-pushed the codex/docker-auth-profile-key branch from 367a73e to 0ff4040 Compare May 12, 2026 11:04
@obviyus
obviyus merged commit 1675b2f into main May 12, 2026
87 of 88 checks passed
@obviyus
obviyus deleted the codex/docker-auth-profile-key branch May 12, 2026 11:05
@obviyus

obviyus commented May 12, 2026

Copy link
Copy Markdown
Contributor Author

Landed via rebase onto main.

  • Scoped tests: pnpm test src/docker-setup.e2e.test.ts; bash -n scripts/docker/setup.sh; pnpm oxfmt --check --threads=1 src/docker-setup.e2e.test.ts; git diff --check; OPENCLAW_CONFIG_DIR=/tmp/openclaw OPENCLAW_WORKSPACE_DIR=/tmp/openclaw/workspace OPENCLAW_AUTH_PROFILE_SECRET_DIR=/tmp/openclaw-auth-profile-secrets docker compose config
  • Changelog: CHANGELOG.md updated
  • Land commit: 0ff404053849c2288eeb7464f2e83ed17d438dce
  • Merge commit: 1675b2ff30a247fcd08b6527a89ac872a704f490

@clawsweeper clawsweeper Bot mentioned this pull request May 14, 2026
Closed
@alexisperumal alexisperumal mentioned this pull request May 15, 2026
Closed
@clawsweeper clawsweeper Bot mentioned this pull request May 21, 2026
Closed
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 24, 2026
@obviyus
docs(changelog): mention docker auth profile key mount (openclaw#80991)
2804d07
jameslcowan pushed a commit to jameslcowan/openclaw that referenced this pull request Jun 2, 2026
@obviyus
docs(changelog): mention docker auth profile key mount (openclaw#80991)
092e041
sablehead pushed a commit to sablehead/openclaw that referenced this pull request Jun 10, 2026
@obviyus
docs(changelog): mention docker auth profile key mount (openclaw#80991)
23a9404
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@obviyus obviyus

Labels

docker Docker and sandbox tooling docs Improvements or additions to documentation maintainer Maintainer-authored PR scripts Repository scripts size: S

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@obviyus