Docker

The Docker layer is responsible for producing buildable and runnable artifacts for OpenClaw environments.

`openenv.docker`¶

`openenv.docker` ¶

Docker image and compose generation helpers.

`openenv.docker.dockerfile`¶

`openenv.docker.dockerfile` ¶

Dockerfile generation for OpenClawenv.

`render_dockerfile(manifest, lockfile, *, raw_manifest_text, raw_lock_text)` ¶

Render a standalone Dockerfile from a manifest and lockfile.

Source code in src/openenv/docker/dockerfile.py

def render_dockerfile(
    manifest: Manifest,
    lockfile: Lockfile,
    *,
    raw_manifest_text: str,
    raw_lock_text: str,
) -> str:
    """Render a standalone Dockerfile from a manifest and lockfile."""
    sandbox_reference = lockfile.base_image["resolved_reference"]
    payload = _render_payload(
        manifest,
        raw_manifest_text=raw_manifest_text,
        raw_lock_text=raw_lock_text,
        image_reference="${OPENCLAW_IMAGE}",
    )
    payload_b64 = encode_payload(payload)
    lines: list[str] = [
        "# syntax=docker/dockerfile:1",
        f"FROM {OPENCLAW_GATEWAY_RUNTIME_IMAGE}",
        f'LABEL org.opencontainers.image.title="{_escape_label(manifest.project.name)}"',
        f'LABEL org.opencontainers.image.version="{_escape_label(manifest.project.version)}"',
        f'LABEL io.openclawenv.manifest-hash="{lockfile.manifest_hash}"',
        f'LABEL io.openclawenv.sandbox-image="{_escape_label(sandbox_reference)}"',
        "ENV PYTHONDONTWRITEBYTECODE=1",
        "USER root",
    ]
    for key, value in sorted(manifest.runtime.env.items()):
        lines.append(f"ENV {key}={json.dumps(value)}")
    lines.extend(_package_install_lines(manifest.runtime.system_packages))
    lines.extend(_python_binary_link_lines())
    lines.extend(_python_venv_lines())
    lines.append(
        "RUN if ! command -v npx >/dev/null 2>&1; then "
        "printf '%s\\n' '#!/bin/sh' 'exec npm exec --yes -- \"$@\"' "
        "> /usr/local/bin/npx && chmod +x /usr/local/bin/npx; fi"
    )
    requirements = [
        SKILL_SCANNER_REQUIREMENT,
        *(_python_package_argument(package) for package in lockfile.python_packages),
    ]
    lines.append(
        "RUN python -m pip install --no-cache-dir " + " ".join(requirements)
    )
    node_requirements = _global_node_requirements(lockfile)
    if node_requirements:
        lines.append(
            "RUN npm install --global --no-fund --no-update-notifier "
            + " ".join(node_requirements)
        )
        lines.append("RUN agent-browser install")
    lines.extend(_optional_browser_install_lines())
    lines.extend(_optional_docker_cli_install_lines())
    lines.extend(_state_link_lines(manifest))
    lines.append("RUN mkdir -p /opt/openclawenv")
    lines.append(
        'RUN ["python", "-c", '
        f'{json.dumps(_payload_writer_script(payload_b64))}'
        "]"
    )
    lines.extend(_catalog_skill_install_lines(manifest))
    lines.extend(_skill_scan_lines(manifest))
    lines.extend(_runtime_permission_lines(manifest))
    lines.append(f"USER {_effective_runtime_user(manifest)}")
    return "\n".join(lines) + "\n"

`render_runtime_payload(manifest, lockfile, *, raw_manifest_text, raw_lock_text)` ¶

Return the file payload embedded into the runtime image.

Source code in src/openenv/docker/dockerfile.py

def render_runtime_payload(
    manifest: Manifest,
    lockfile: Lockfile,
    *,
    raw_manifest_text: str,
    raw_lock_text: str,
) -> dict[str, object]:
    """Return the file payload embedded into the runtime image."""
    return _render_payload(
        manifest,
        raw_manifest_text=raw_manifest_text,
        raw_lock_text=raw_lock_text,
        image_reference="${OPENCLAW_IMAGE}",
    )

`openenv.docker.compose`¶