Sign inSign up

secretvm/openclaw-init

By secretvm

•Updated 8 months ago

docker setup/init for openclaw gateway

Image
Integration & delivery
0

209

secretvm/openclaw-init repository overview

⁠secretvm/openclaw-init

⁠Purpose:

secretvm/openclaw-init is a minimal one-shot initialization container used to prepare the filesystem for an OpenClaw gateway deployment in Docker.

It ensures that required directories exist and are correctly owned by the node user (UID 1000) before the OpenClaw gateway starts.

⁠This image is intended to be used as a pre-start init job in Docker Compose environments, especially in:
•	Confidential VMs
•	Immutable infrastructure
•	Automated portal deployments
•	Environments where host directories may not exist yet
•	Environments where volume permissions may be incorrect

⁠What It Does

⁠When executed, the container:
1.	Creates required OpenClaw directories:
•	/home/node/.openclaw
•	/home/node/.openclaw/workspace
2.	Recursively sets ownership to: 1000:1000

(the node user inside the OpenClaw container)

3.	Optionally tightens directory permissions (700).
4.	Exits successfully (exit 0) once setup is complete.
⁠It does not:
•	Start OpenClaw
•	Modify configuration files
•	Persist background processes
•	Run continuously

It is designed to complete and exit.

⁠Why This Exists

OpenClaw’s official image runs as a non-root user (node, UID 1000).

⁠If the mounted host directories:
•	do not exist, or
•	are owned by root, or
•	have incorrect permissions,

the gateway may fail at startup.

secretvm/openclaw-init eliminates these issues in a deterministic way.

⁠When To Use It

⁠Use this image when:
•	Deploying OpenClaw into a new VM
•	Using bind-mounted host directories
•	Running in automated portal environments
•	Deploying in Confidential VMs
•	You cannot manually mkdir and chown on the host
⁠You do not need it if:
•	You are using Docker named volumes
•	You manually created and chowned directories
•	You are running OpenClaw locally without strict permissions

⁠Example Docker Compose Usage

services:
  openclaw-init:
    image: secretvm/openclaw-init:v2026.2.19
    environment:
      OPENCLAW_CONFIG_DIR_IN_CONTAINER: /home/node/.openclaw
      OPENCLAW_WORKSPACE_DIR_IN_CONTAINER: /home/node/.openclaw/workspace
      OPENCLAW_UID_GID: "1000:1000"
    volumes:
      - /opt/openclaw/config:/home/node/.openclaw
      - /opt/openclaw/workspace:/home/node/.openclaw/workspace
    restart: "no"

  openclaw-gateway:
    image: secretvm/openclaw-tools:latest
    depends_on:
      openclaw-init:
        condition: service_completed_successfully
    volumes:
      - /opt/openclaw/config:/home/node/.openclaw
      - /opt/openclaw/workspace:/home/node/.openclaw/workspace
    command:
      [
        "node",
        "openclaw.mjs",
        "gateway",
        "--bind",
        "lan",
        "--port",
        "18789"
      ]

⁠Running Manually

If needed, you can run it directly:

docker run --rm \
  -v /opt/openclaw/config:/home/node/.openclaw \
  -v /opt/openclaw/workspace:/home/node/.openclaw/workspace \
  secretvm/openclaw-init:v2026.2.19

⁠Environment Variables

VariableDefault Description
OPENCLAW_CONFIG_DIR_IN_CONTAINER/home/node/.openclaw Target config directory inside container
OPENCLAW_WORKSPACE_DIR_IN_CONTAINER/home/node/.openclaw/workspace Target workspace directory inside container
OPENCLAW_UID_GID1000:1000 Ownership applied to directories
⁠Security Model
•	No network listeners
•	No exposed ports
•	No background processes
•	Runs as root inside container to fix permissions
•	Exits immediately after initialization

This makes it safe for use in automated production pipelines.

⁠Typical Lifecycle
1.	openclaw-init runs.
2.	Directories are created and fixed.
3.	Container exits successfully.
4.	openclaw-gateway starts.
5.	Gateway runs as non-root user.

⁠Summary

secretvm/openclaw-init is a minimal, deterministic, idempotent filesystem preparation container that ensures OpenClaw can start reliably in production VM deployments.

⁠It is strongly recommended for:
•	Confidential VM environments
•	Automated provisioning systems
•	Customer-facing portal deployments

Tag summary

Content type

Image

Digest

sha256:db7bdb752…

Size

5.1 MB

Last updated

8 months ago

docker pull secretvm/openclaw-init:v2026.2.19