revert: Switch back to tsc for compiling.

2026-03-12 07:20:45 +00:00 · 2026-01-31 18:31:49 +09:00
parent e25fedf932
commit 76361ae3ab
36 changed files with 527 additions and 843 deletions
--- a/docs/install/docker.md
+++ b/docs/install/docker.md
@@ -1,5 +1,5 @@
 ---
-summary: "Optional Docker-based setup and onboarding for OpenClaw"
+summary: 'Optional Docker-based setup and onboarding for OpenClaw'
 read_when:
  - You want a containerized gateway instead of local installs
  - You are validating the Docker flow
@@ -16,6 +16,7 @@ Docker is **optional**. Use it only if you want a containerized gateway or to va
 - **Sandboxing note**: agent sandboxing uses Docker too, but it does **not** require the full gateway to run in Docker. See [Sandboxing](/gateway/sandboxing).

 This guide covers:
+
 - Containerized Gateway (full OpenClaw in Docker)
 - Per-session Agent Sandbox (host gateway + Docker-isolated agent tools)

@@ -37,6 +38,7 @@ From repo root:
 ```

 This script:
+
 - builds the gateway image
 - runs the onboarding wizard
 - prints optional provider setup hints
@@ -44,15 +46,18 @@ This script:
 - generates a gateway token and writes it to `.env`

 Optional env vars:
+
 - `OPENCLAW_DOCKER_APT_PACKAGES` — install extra apt packages during build
 - `OPENCLAW_EXTRA_MOUNTS` — add extra host bind mounts
 - `OPENCLAW_HOME_VOLUME` — persist `/home/node` in a named volume

 After it finishes:
+
 - Open `http://127.0.0.1:18789/` in your browser.
 - Paste the token into the Control UI (Settings → token).

 It writes config/workspace on the host:
+
 - `~/.openclaw/`
 - `~/.openclaw/workspace`

@@ -81,6 +86,7 @@ export OPENCLAW_EXTRA_MOUNTS="$HOME/.codex:/home/node/.codex:ro,$HOME/github:/ho
 ```

 Notes:
+
 - Paths must be shared with Docker Desktop on macOS/Windows.
 - If you edit `OPENCLAW_EXTRA_MOUNTS`, rerun `docker-setup.sh` to regenerate the
  extra compose file.
@@ -110,6 +116,7 @@ export OPENCLAW_EXTRA_MOUNTS="$HOME/.codex:/home/node/.codex:ro,$HOME/github:/ho
 ```

 Notes:
+
 - If you change `OPENCLAW_HOME_VOLUME`, rerun `docker-setup.sh` to regenerate the
  extra compose file.
 - The named volume persists until removed with `docker volume rm <name>`.
@@ -129,6 +136,7 @@ export OPENCLAW_DOCKER_APT_PACKAGES="ffmpeg build-essential"
 ```

 Notes:
+
 - This accepts a space-separated list of apt package names.
 - If you change `OPENCLAW_DOCKER_APT_PACKAGES`, rerun `docker-setup.sh` to rebuild
  the image.
@@ -163,7 +171,7 @@ RUN pnpm ui:build

 ENV NODE_ENV=production

-CMD ["node","dist/index.mjs"]
+CMD ["node","dist/index.js"]
 ```

 ### Channel setup (optional)
@@ -171,16 +179,19 @@ CMD ["node","dist/index.mjs"]
 Use the CLI container to configure channels, then restart the gateway if needed.

 WhatsApp (QR):
+
 ```bash
 docker compose run --rm openclaw-cli channels login
 ```

 Telegram (bot token):
+
 ```bash
 docker compose run --rm openclaw-cli channels add --channel telegram --token "<token>"
 ```

 Discord (bot token):
+
 ```bash
 docker compose run --rm openclaw-cli channels add --channel discord --token "<token>"
 ```
@@ -190,7 +201,7 @@ Docs: [WhatsApp](/channels/whatsapp), [Telegram](/channels/telegram), [Discord](
 ### Health check

 ```bash
-docker compose exec openclaw-gateway node dist/index.mjs health --token "$OPENCLAW_GATEWAY_TOKEN"
+docker compose exec openclaw-gateway node dist/index.js health --token "$OPENCLAW_GATEWAY_TOKEN"
 ```

 ### E2E smoke test (Docker)
@@ -218,6 +229,7 @@ Deep dive: [Sandboxing](/gateway/sandboxing)

 When `agents.defaults.sandbox` is enabled, **non-main sessions** run tools inside a Docker
 container. The gateway stays on your host, but the tool execution is isolated:
+
 - scope: `"agent"` by default (one container + workspace per agent)
 - scope: `"session"` for per-session isolation
 - per-scope workspace folder mounted at `/workspace`
@@ -233,6 +245,7 @@ one container and one workspace.
 If you use multi-agent routing, each agent can override sandbox + tool settings:
 `agents.list[].sandbox` and `agents.list[].tools` (plus `agents.list[].tools.sandbox.tools`). This lets you run
 mixed access levels in one gateway:
+
 - Full access (personal agent)
 - Read-only tools + read-only workspace (family/work agent)
 - No filesystem/shell tools (public agent)
@@ -255,60 +268,72 @@ precedence, and troubleshooting.
 ### Enable sandboxing

 If you plan to install packages in `setupCommand`, note:
+
 - Default `docker.network` is `"none"` (no egress).
 - `readOnlyRoot: true` blocks package installs.
 - `user` must be root for `apt-get` (omit `user` or set `user: "0:0"`).
-OpenClaw auto-recreates containers when `setupCommand` (or docker config) changes
-unless the container was **recently used** (within ~5 minutes). Hot containers
-log a warning with the exact `openclaw sandbox recreate ...` command.
+  OpenClaw auto-recreates containers when `setupCommand` (or docker config) changes
+  unless the container was **recently used** (within ~5 minutes). Hot containers
+  log a warning with the exact `openclaw sandbox recreate ...` command.

 ```json5
 {
  agents: {
    defaults: {
      sandbox: {
-        mode: "non-main", // off | non-main | all
-        scope: "agent", // session | agent | shared (agent is default)
-        workspaceAccess: "none", // none | ro | rw
-        workspaceRoot: "~/.openclaw/sandboxes",
+        mode: 'non-main', // off | non-main | all
+        scope: 'agent', // session | agent | shared (agent is default)
+        workspaceAccess: 'none', // none | ro | rw
+        workspaceRoot: '~/.openclaw/sandboxes',
        docker: {
-          image: "openclaw-sandbox:bookworm-slim",
-          workdir: "/workspace",
+          image: 'openclaw-sandbox:bookworm-slim',
+          workdir: '/workspace',
          readOnlyRoot: true,
-          tmpfs: ["/tmp", "/var/tmp", "/run"],
-          network: "none",
-          user: "1000:1000",
-          capDrop: ["ALL"],
-          env: { LANG: "C.UTF-8" },
-          setupCommand: "apt-get update && apt-get install -y git curl jq",
+          tmpfs: ['/tmp', '/var/tmp', '/run'],
+          network: 'none',
+          user: '1000:1000',
+          capDrop: ['ALL'],
+          env: { LANG: 'C.UTF-8' },
+          setupCommand: 'apt-get update && apt-get install -y git curl jq',
          pidsLimit: 256,
-          memory: "1g",
-          memorySwap: "2g",
+          memory: '1g',
+          memorySwap: '2g',
          cpus: 1,
          ulimits: {
            nofile: { soft: 1024, hard: 2048 },
-            nproc: 256
+            nproc: 256,
          },
-          seccompProfile: "/path/to/seccomp.json",
-          apparmorProfile: "openclaw-sandbox",
-          dns: ["1.1.1.1", "8.8.8.8"],
-          extraHosts: ["internal.service:10.0.0.5"]
+          seccompProfile: '/path/to/seccomp.json',
+          apparmorProfile: 'openclaw-sandbox',
+          dns: ['1.1.1.1', '8.8.8.8'],
+          extraHosts: ['internal.service:10.0.0.5'],
        },
        prune: {
          idleHours: 24, // 0 disables idle pruning
-          maxAgeDays: 7  // 0 disables max-age pruning
-        }
-      }
-    }
+          maxAgeDays: 7, // 0 disables max-age pruning
+        },
+      },
+    },
  },
  tools: {
    sandbox: {
      tools: {
-        allow: ["exec", "process", "read", "write", "edit", "sessions_list", "sessions_history", "sessions_send", "sessions_spawn", "session_status"],
-        deny: ["browser", "canvas", "nodes", "cron", "discord", "gateway"]
-      }
-    }
-  }
+        allow: [
+          'exec',
+          'process',
+          'read',
+          'write',
+          'edit',
+          'sessions_list',
+          'sessions_history',
+          'sessions_send',
+          'sessions_spawn',
+          'session_status',
+        ],
+        deny: ['browser', 'canvas', 'nodes', 'cron', 'discord', 'gateway'],
+      },
+    },
+  },
 }
 ```

@@ -328,6 +353,7 @@ scripts/sandbox-setup.sh
 This builds `openclaw-sandbox:bookworm-slim` using `Dockerfile.sandbox`.

 ### Sandbox common image (optional)
+
 If you want a sandbox image with common build tooling (Node, Go, Rust, etc.), build the common image:

 ```bash
@@ -338,7 +364,11 @@ This builds `openclaw-sandbox-common:bookworm-slim`. To use it:

 ```json5
 {
-  agents: { defaults: { sandbox: { docker: { image: "openclaw-sandbox-common:bookworm-slim" } } } }
+  agents: {
+    defaults: {
+      sandbox: { docker: { image: 'openclaw-sandbox-common:bookworm-slim' } },
+    },
+  },
 }
 ```

@@ -355,6 +385,7 @@ This builds `openclaw-sandbox-browser:bookworm-slim` using
 an optional noVNC observer (headful via Xvfb).

 Notes:
+
 - Headful (Xvfb) reduces bot blocking vs headless.
 - Headless can still be used by setting `agents.defaults.sandbox.browser.headless=true`.
 - No full desktop environment (GNOME) is needed; Xvfb provides the display.
@@ -366,10 +397,10 @@ Use config:
  agents: {
    defaults: {
      sandbox: {
-        browser: { enabled: true }
-      }
-    }
-  }
+        browser: { enabled: true },
+      },
+    },
+  },
 }
 ```

@@ -379,13 +410,14 @@ Custom browser image:
 {
  agents: {
    defaults: {
-      sandbox: { browser: { image: "my-openclaw-browser" } }
-    }
-  }
+      sandbox: { browser: { image: 'my-openclaw-browser' } },
+    },
+  },
 }
 ```

 When enabled, the agent receives:
+
 - a sandbox browser control URL (for the `browser` tool)
 - a noVNC URL (if enabled and headless=false)

@@ -405,9 +437,9 @@ docker build -t my-openclaw-sbx -f Dockerfile.sandbox .
 {
  agents: {
    defaults: {
-      sandbox: { docker: { image: "my-openclaw-sbx" } }
-    }
-  }
+      sandbox: { docker: { image: 'my-openclaw-sbx' } },
+    },
+  },
 }
 ```

@@ -420,10 +452,12 @@ docker build -t my-openclaw-sbx -f Dockerfile.sandbox .
 ### Pruning strategy

 Two knobs:
+
 - `prune.idleHours`: remove containers not used in X hours (0 = disable)
 - `prune.maxAgeDays`: remove containers older than X days (0 = disable)

 Example:
+
 - Keep busy sessions but cap lifetime:
  `idleHours: 24`, `maxAgeDays: 7`
 - Never prune:
@@ -431,8 +465,8 @@ Example:

 ### Security notes

- Hard wall only applies to **tools** (exec/read/write/edit/apply_patch).  
- Host-only tools like browser/camera/canvas are blocked by default.  
+- Hard wall only applies to **tools** (exec/read/write/edit/apply_patch).
+- Host-only tools like browser/camera/canvas are blocked by default.
 - Allowing `browser` in sandbox **breaks isolation** (browser runs on host).

 ## Troubleshooting