docker: add DEBIAN_FRONTEND and --no-install-recommends to apt-get upgrade

Prevents debconf hangs during Docker builds and avoids pulling in
recommended packages that silently grow the image.

Co-Authored-By: Claude <noreply@anthropic.com>

scripts/docker/cleanup-smoke/Dockerfile

@@ -5,11 +5,11 @@ FROM node:24-bookworm-slim@sha256:b4687aef2571c632a1953695ce4d61d6462a7eda471fe6
 RUN --mount=type=cache,id=openclaw-cleanup-smoke-apt-cache,target=/var/cache/apt,sharing=locked \
   --mount=type=cache,id=openclaw-cleanup-smoke-apt-lists,target=/var/lib/apt,sharing=locked \
   apt-get update \
-  && apt-get upgrade -y \
+  && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y --no-install-recommends \
   && apt-get install -y --no-install-recommends \
-    bash \
-    ca-certificates \
-    git
+  bash \
+  ca-certificates \
+  git
 
 WORKDIR /repo
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./

scripts/docker/install-sh-e2e/Dockerfile

@@ -5,12 +5,12 @@ FROM node:24-bookworm-slim@sha256:b4687aef2571c632a1953695ce4d61d6462a7eda471fe6
 RUN --mount=type=cache,id=openclaw-install-sh-e2e-apt-cache,target=/var/cache/apt,sharing=locked \
   --mount=type=cache,id=openclaw-install-sh-e2e-apt-lists,target=/var/lib/apt,sharing=locked \
   apt-get update \
-  && apt-get upgrade -y \
+  && DEBIAN_FRONTEND=noninteractive apt-get upgrade -y --no-install-recommends \
   && apt-get install -y --no-install-recommends \
-    bash \
-    ca-certificates \
-    curl \
-    git
+  bash \
+  ca-certificates \
+  curl \
+  git
 
 COPY install-sh-common/version-parse.sh /usr/local/install-sh-common/version-parse.sh
 COPY --chmod=755 run.sh /usr/local/bin/openclaw-install-e2e

scripts/docker/install-sh-nonroot/Dockerfile

@@ -6,20 +6,20 @@ RUN --mount=type=cache,id=openclaw-install-sh-nonroot-apt-cache,target=/var/cach
   --mount=type=cache,id=openclaw-install-sh-nonroot-apt-lists,target=/var/lib/apt,sharing=locked \
   set -eux; \
   for attempt in 1 2 3; do \
-    if apt-get update -o Acquire::Retries=3; then break; fi; \
-    echo "apt-get update failed (attempt ${attempt})" >&2; \
-    if [ "${attempt}" -eq 3 ]; then exit 1; fi; \
-    sleep 3; \
+  if apt-get update -o Acquire::Retries=3; then break; fi; \
+  echo "apt-get update failed (attempt ${attempt})" >&2; \
+  if [ "${attempt}" -eq 3 ]; then exit 1; fi; \
+  sleep 3; \
   done; \
-  apt-get -o Acquire::Retries=3 upgrade -y; \
+  DEBIAN_FRONTEND=noninteractive apt-get -o Acquire::Retries=3 upgrade -y --no-install-recommends; \
   apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
-    bash \
-    ca-certificates \
-    curl \
-    g++ \
-    make \
-    python3 \
-    sudo
+  bash \
+  ca-certificates \
+  curl \
+  g++ \
+  make \
+  python3 \
+  sudo
 
 RUN useradd -m -s /bin/bash app \
   && echo "app ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/app

scripts/docker/install-sh-smoke/Dockerfile

@@ -6,21 +6,21 @@ RUN --mount=type=cache,id=openclaw-install-sh-smoke-apt-cache,target=/var/cache/
   --mount=type=cache,id=openclaw-install-sh-smoke-apt-lists,target=/var/lib/apt,sharing=locked \
   set -eux; \
   for attempt in 1 2 3; do \
-    if apt-get update -o Acquire::Retries=3; then break; fi; \
-    echo "apt-get update failed (attempt ${attempt})" >&2; \
-    if [ "${attempt}" -eq 3 ]; then exit 1; fi; \
-    sleep 3; \
+  if apt-get update -o Acquire::Retries=3; then break; fi; \
+  echo "apt-get update failed (attempt ${attempt})" >&2; \
+  if [ "${attempt}" -eq 3 ]; then exit 1; fi; \
+  sleep 3; \
   done; \
-  apt-get -o Acquire::Retries=3 upgrade -y; \
+  DEBIAN_FRONTEND=noninteractive apt-get -o Acquire::Retries=3 upgrade -y --no-install-recommends; \
   apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
-    bash \
-    ca-certificates \
-    curl \
-    git \
-    g++ \
-    make \
-    python3 \
-    sudo
+  bash \
+  ca-certificates \
+  curl \
+  git \
+  g++ \
+  make \
+  python3 \
+  sudo
 
 COPY install-sh-common/cli-verify.sh /usr/local/install-sh-common/cli-verify.sh
 COPY install-sh-common/version-parse.sh /usr/local/install-sh-common/version-parse.sh