From 79853b2fe8ff56a7d0199eb4d1517c7b01fe280a Mon Sep 17 00:00:00 2001 From: sallyom Date: Thu, 7 May 2026 23:12:05 -0400 Subject: [PATCH] docs: align digitalocean root setup --- CHANGELOG.md | 1 + docs/install/digitalocean.md | 13 +++++++++++-- 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index bbd28d3a99d..8ba526a745f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -165,6 +165,7 @@ Docs: https://docs.openclaw.ai ### Fixes - Control UI/chat: hide retired and non-public Google Gemini model IDs from chat model catalogs and route the bare `gemini-3-pro` alias to Gemini 3.1 Pro Preview instead of the shut-down Gemini 3 Pro Preview. Thanks @BunsDev. +- CLI/install: refuse state-mutating OpenClaw CLI runs as root by default, keep an explicit `OPENCLAW_ALLOW_ROOT=1` escape hatch for intentional root/container use, and update DigitalOcean setup guidance to run OpenClaw as a non-root user. Fixes #67478. Thanks @Jerry-Xin and @natechicago. - Gateway/watch: leave `OPENCLAW_TRACE_SYNC_IO` disabled by default in `pnpm gateway:watch:raw` so watch mode avoids noisy Node sync-I/O stack traces unless explicitly requested. - Codex app-server: close stdio stdin before force-killing the managed app-server, matching Codex single-client shutdown behavior and avoiding unsettled CLI exits after successful runs. - CLI/Codex: dispose registered agent harnesses during short-lived CLI shutdown so successful Codex-backed `agent --local` runs do not leave app-server child processes alive. diff --git a/docs/install/digitalocean.md b/docs/install/digitalocean.md index f42bb0c4c39..b4be127b3d2 100644 --- a/docs/install/digitalocean.md +++ b/docs/install/digitalocean.md @@ -50,9 +50,18 @@ DigitalOcean is the simplest paid VPS path. If you prefer cheaper or free option # Install OpenClaw curl -fsSL https://openclaw.ai/install.sh | bash + + # Create the non-root user that will own OpenClaw state and services. + adduser openclaw + usermod -aG sudo openclaw + loginctl enable-linger openclaw + + su - openclaw openclaw --version ``` + Use the root shell only for system bootstrap. Run OpenClaw commands as the non-root `openclaw` user so state lives under `/home/openclaw/.openclaw/` and the Gateway installs as that user's systemd service. + @@ -97,8 +106,8 @@ DigitalOcean is the simplest paid VPS path. If you prefer cheaper or free option **Option B: Tailscale Serve** ```bash - curl -fsSL https://tailscale.com/install.sh | sh - tailscale up + curl -fsSL https://tailscale.com/install.sh | sudo sh + sudo tailscale up openclaw config set gateway.tailscale.mode serve openclaw gateway restart ```