From 168e4159adbf924b113a09430019b3753dff0a4b Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Sat, 7 Mar 2026 21:08:15 +0000 Subject: [PATCH] fix(podman): honor OPENCLAW_GATEWAY_BIND env-file override (#38785, thanks @majinyu666) Co-authored-by: majinyu666 --- CHANGELOG.md | 1 + scripts/run-openclaw-podman.sh | 8 +++++--- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c9dfb00ca35..212b839e49f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -277,6 +277,7 @@ Docs: https://docs.openclaw.ai - Telegram/polling offset safety: confirm persisted offsets before polling startup while validating stored `lastUpdateId` values as non-negative safe integers (with overflow guards) so malformed offset state cannot cause update skipping/dropping. (#39111) Thanks @MumuTW. - Telegram/status SecretRef read-only resolution: resolve env-backed bot-token SecretRefs in config-only/status inspection while respecting provider source/defaults and env allowlists, so status no longer crashes or reports false-ready tokens for disallowed providers. (#39130) Thanks @neocody. - Agents/OpenAI WS max-token zero forwarding: treat `maxTokens: 0` as an explicit value in websocket `response.create` payloads (instead of dropping it as falsy), with regression coverage for zero-token forwarding. (#39148) Thanks @scoootscooob. +- Podman/.env gateway bind precedence: evaluate `OPENCLAW_GATEWAY_BIND` after sourcing `.env` in `run-openclaw-podman.sh` so env-file overrides are honored. (#38785) Thanks @majinyu666. ## 2026.3.2 diff --git a/scripts/run-openclaw-podman.sh b/scripts/run-openclaw-podman.sh index 9f0cd0bb6d5..33e9f6d7d94 100755 --- a/scripts/run-openclaw-podman.sh +++ b/scripts/run-openclaw-podman.sh @@ -75,9 +75,6 @@ OPENCLAW_IMAGE="${OPENCLAW_PODMAN_IMAGE:-openclaw:local}" PODMAN_PULL="${OPENCLAW_PODMAN_PULL:-never}" HOST_GATEWAY_PORT="${OPENCLAW_PODMAN_GATEWAY_HOST_PORT:-${OPENCLAW_GATEWAY_PORT:-18789}}" HOST_BRIDGE_PORT="${OPENCLAW_PODMAN_BRIDGE_HOST_PORT:-${OPENCLAW_BRIDGE_PORT:-18790}}" -# Keep Podman default local-only unless explicitly overridden. -# Non-loopback binds require gateway.controlUi.allowedOrigins (security hardening). -GATEWAY_BIND="${OPENCLAW_GATEWAY_BIND:-loopback}" # Safe cwd for podman (openclaw is nologin; avoid inherited cwd from sudo) cd "$EFFECTIVE_HOME" 2>/dev/null || cd /tmp 2>/dev/null || true @@ -100,6 +97,11 @@ if [[ -f "$ENV_FILE" ]]; then set +a fi +# Keep Podman default local-only unless explicitly overridden. +# Non-loopback binds require gateway.controlUi.allowedOrigins (security hardening). +# NOTE: must be evaluated after sourcing ENV_FILE so OPENCLAW_GATEWAY_BIND set in .env takes effect. +GATEWAY_BIND="${OPENCLAW_GATEWAY_BIND:-loopback}" + upsert_env_var() { local file="$1" local key="$2"