mirror of
https://github.com/openclaw/openclaw.git
synced 2026-05-31 14:28:35 +00:00
6f1d627eae
The plugin defaults webhook.port to 3978 (the Bot Framework standard used in
Microsoft samples) and listens on whatever the operator sets there. The
docker-compose.yml port mapping was exposing ${OPENCLAW_MSTEAMS_PORT:-3000}:3000
which only works for operators who explicitly set webhook.port to 3000.
Default-config users would have the plugin listening on 3978 inside the
container while compose forwarded 3000, causing connection refused.
Realign to ${OPENCLAW_MSTEAMS_PORT:-3978}:3978 so a default-config docker
compose up Just Works with Teams. Operators wanting a custom port override
both webhook.port in openclaw.json and OPENCLAW_MSTEAMS_PORT env var.
122 lines
4.9 KiB
YAML
122 lines
4.9 KiB
YAML
services:
|
|
openclaw-gateway:
|
|
image: ${OPENCLAW_IMAGE:-openclaw:local}
|
|
build: .
|
|
env_file:
|
|
- path: .env
|
|
required: false
|
|
environment:
|
|
HOME: /home/node
|
|
TERM: xterm-256color
|
|
# Pin container-side workspace and config paths so host values written to
|
|
# `.env` (used by Compose for the bind-mount source below) cannot leak
|
|
# into runtime code that resolves these env vars inside the container.
|
|
# Without this override, a macOS host path like /Users/<you>/.openclaw/...
|
|
# imported from .env caused first-reply `mkdir '/Users'` EACCES failures
|
|
# in Linux Docker (#77436).
|
|
OPENCLAW_CONFIG_DIR: /home/node/.openclaw
|
|
OPENCLAW_WORKSPACE_DIR: /home/node/.openclaw/workspace
|
|
OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN:-}
|
|
OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: ${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}
|
|
# Empty means auto: Bonjour disables itself in detected containers.
|
|
# Set 0 only on host/macvlan/mDNS-capable networks; set 1 to force off.
|
|
OPENCLAW_DISABLE_BONJOUR: ${OPENCLAW_DISABLE_BONJOUR:-}
|
|
# OpenTelemetry export is outbound OTLP/HTTP from the Gateway. Prometheus
|
|
# uses the existing authenticated Gateway route; it does not need a port.
|
|
OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
|
|
OTEL_EXPORTER_OTLP_TRACES_ENDPOINT: ${OTEL_EXPORTER_OTLP_TRACES_ENDPOINT:-}
|
|
OTEL_EXPORTER_OTLP_METRICS_ENDPOINT: ${OTEL_EXPORTER_OTLP_METRICS_ENDPOINT:-}
|
|
OTEL_EXPORTER_OTLP_LOGS_ENDPOINT: ${OTEL_EXPORTER_OTLP_LOGS_ENDPOINT:-}
|
|
OTEL_EXPORTER_OTLP_PROTOCOL: ${OTEL_EXPORTER_OTLP_PROTOCOL:-http/protobuf}
|
|
OTEL_SERVICE_NAME: ${OTEL_SERVICE_NAME:-}
|
|
OTEL_SEMCONV_STABILITY_OPT_IN: ${OTEL_SEMCONV_STABILITY_OPT_IN:-}
|
|
OPENCLAW_OTEL_PRELOADED: ${OPENCLAW_OTEL_PRELOADED:-}
|
|
CLAUDE_AI_SESSION_KEY: ${CLAUDE_AI_SESSION_KEY:-}
|
|
CLAUDE_WEB_SESSION_KEY: ${CLAUDE_WEB_SESSION_KEY:-}
|
|
CLAUDE_WEB_COOKIE: ${CLAUDE_WEB_COOKIE:-}
|
|
TZ: ${OPENCLAW_TZ:-UTC}
|
|
volumes:
|
|
- ${OPENCLAW_CONFIG_DIR:-${HOME:-/tmp}/.openclaw}:/home/node/.openclaw
|
|
- ${OPENCLAW_WORKSPACE_DIR:-${HOME:-/tmp}/.openclaw/workspace}:/home/node/.openclaw/workspace
|
|
## Uncomment the lines below to enable sandbox isolation
|
|
## (agents.defaults.sandbox). Requires Docker CLI in the image
|
|
## (build with --build-arg OPENCLAW_INSTALL_DOCKER_CLI=1) or use
|
|
## scripts/docker/setup.sh with OPENCLAW_SANDBOX=1 for automated setup.
|
|
## Set DOCKER_GID to the host's docker group GID (run: stat -c '%g' /var/run/docker.sock).
|
|
# - /var/run/docker.sock:/var/run/docker.sock
|
|
# group_add:
|
|
# - "${DOCKER_GID:-999}"
|
|
# Let bundled local-model providers reach host-side LM Studio/Ollama via
|
|
# http://host.docker.internal:<port>. Docker Desktop usually provides this
|
|
# alias; the host-gateway mapping makes it work on Linux Docker Engine too.
|
|
cap_drop:
|
|
- NET_RAW
|
|
- NET_ADMIN
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
ports:
|
|
- "${OPENCLAW_GATEWAY_PORT:-18789}:18789"
|
|
- "${OPENCLAW_BRIDGE_PORT:-18790}:18790"
|
|
- "${OPENCLAW_MSTEAMS_PORT:-3978}:3978"
|
|
init: true
|
|
restart: unless-stopped
|
|
command:
|
|
[
|
|
"node",
|
|
"dist/index.js",
|
|
"gateway",
|
|
"--bind",
|
|
"${OPENCLAW_GATEWAY_BIND:-lan}",
|
|
"--port",
|
|
"18789",
|
|
]
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD",
|
|
"node",
|
|
"-e",
|
|
"fetch('http://127.0.0.1:18789/healthz').then((r)=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))",
|
|
]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 20s
|
|
|
|
openclaw-cli:
|
|
image: ${OPENCLAW_IMAGE:-openclaw:local}
|
|
network_mode: "service:openclaw-gateway"
|
|
env_file:
|
|
- path: .env
|
|
required: false
|
|
cap_drop:
|
|
- NET_RAW
|
|
- NET_ADMIN
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
environment:
|
|
HOME: /home/node
|
|
TERM: xterm-256color
|
|
# Pin container-side workspace and config paths so host values written to
|
|
# `.env` cannot leak into runtime code via the env_file import (#77436).
|
|
OPENCLAW_CONFIG_DIR: /home/node/.openclaw
|
|
OPENCLAW_WORKSPACE_DIR: /home/node/.openclaw/workspace
|
|
OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN:-}
|
|
OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: ${OPENCLAW_ALLOW_INSECURE_PRIVATE_WS:-}
|
|
BROWSER: echo
|
|
CLAUDE_AI_SESSION_KEY: ${CLAUDE_AI_SESSION_KEY:-}
|
|
CLAUDE_WEB_SESSION_KEY: ${CLAUDE_WEB_SESSION_KEY:-}
|
|
CLAUDE_WEB_COOKIE: ${CLAUDE_WEB_COOKIE:-}
|
|
TZ: ${OPENCLAW_TZ:-UTC}
|
|
volumes:
|
|
- ${OPENCLAW_CONFIG_DIR:-${HOME:-/tmp}/.openclaw}:/home/node/.openclaw
|
|
- ${OPENCLAW_WORKSPACE_DIR:-${HOME:-/tmp}/.openclaw/workspace}:/home/node/.openclaw/workspace
|
|
stdin_open: true
|
|
tty: true
|
|
init: true
|
|
entrypoint: ["node", "dist/index.js"]
|
|
depends_on:
|
|
- openclaw-gateway
|