From cc17432975bda0b25742bf414dd5bbf056808421 Mon Sep 17 00:00:00 2001 From: Clawdbot Date: Thu, 30 Jul 2026 16:04:28 +1000 Subject: [PATCH] Supervise and persist ClawdBox node host --- README.md | 16 ++++++----- manifests/deployment.yaml | 54 ++++++++++++++++++++++++++++++++++++- scripts/clawdbox-entrypoint | 8 +++--- scripts/start-clawdbox-node | 9 +++++-- 4 files changed, 74 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index a7f5a71..570391d 100644 --- a/README.md +++ b/README.md @@ -103,9 +103,10 @@ The `/data` volume preserves data across container restarts: ## OpenClaw Node Host -On container startup, ClawdBox keeps SSH as the foreground service and -opportunistically starts an OpenClaw node host named `ClawdBox-CLI` in the -background. +ClawdBox runs SSH and the `ClawdBox-CLI` node host as separate containers in +the same pod. Kubernetes supervises the node container, while its identity, +runtime configuration, and exec approvals persist under +`/data/agents/clawd/node-home`. The helper scripts are copied into `/data/agents/clawd/bin/` on each startup: @@ -115,7 +116,7 @@ status-clawdbox-node stop-clawdbox-node ``` -The node host installs `openclaw@2026.6.1` under +The node host installs `openclaw@2026.7.2-beta.3` under `/data/agents/clawd/tools/openclaw-node` if it is missing or stale. It gets the Gateway token from `OPENCLAW_GATEWAY_TOKEN` when set, otherwise from the live `openclaw` deployment via the mounted kubeconfig. @@ -123,15 +124,16 @@ Gateway token from `OPENCLAW_GATEWAY_TOKEN` when set, otherwise from the live Useful overrides: ```bash -OPENCLAW_VERSION=2026.6.1 +OPENCLAW_VERSION=2026.7.2-beta.3 OPENCLAW_GATEWAY_HOST=openclaw.apps.lab.apilab.us OPENCLAW_GATEWAY_PORT=443 OPENCLAW_GATEWAY_TLS=true CLAWDBOX_NODE_DISPLAY_NAME=ClawdBox-CLI +CLAWDBOX_NODE_HOME=/data/agents/clawd/node-home ``` -If node startup fails, the pod still starts and SSH remains available. Check -`/data/agents/clawd/logs/node-host.log` for details. +If node startup fails, SSH remains available while Kubernetes restarts the +node container. Check `/data/agents/clawd/logs/node-host.log` for details. ## Common Tasks diff --git a/manifests/deployment.yaml b/manifests/deployment.yaml index c51aedc..ec58f47 100644 --- a/manifests/deployment.yaml +++ b/manifests/deployment.yaml @@ -58,8 +58,10 @@ spec: value: noninteractive - name: TZ value: UTC + - name: CLAWDBOX_START_NODE + value: "false" - name: OPENCLAW_VERSION - value: "2026.6.1" + value: "2026.7.2-beta.3" - name: OPENCLAW_GATEWAY_HOST value: openclaw.apps.lab.apilab.us - name: OPENCLAW_GATEWAY_PORT @@ -110,6 +112,56 @@ spec: capabilities: drop: ["ALL"] add: ["NET_BIND_SERVICE"] + - name: openclaw-node + image: default-route-openshift-image-registry.apps.lab.apilab.us/clawdbox/clawdbox:latest + imagePullPolicy: Always + command: + - /bin/bash + - -lc + - | + set -eu + /usr/local/bin/start-clawdbox-node + PID=$(cat /data/agents/clawd/logs/node-host.pid) + while kill -0 "$PID"; do + sleep 5 + done + exit 1 + env: + - name: HOME + value: /data/agents/clawd/node-home + - name: OPENCLAW_STATE_DIR + value: /data/agents/clawd/node-home/.openclaw + - name: KUBECONFIG + value: /home/claw/.kube/config + - name: OPENCLAW_VERSION + value: "2026.7.2-beta.3" + - name: OPENCLAW_GATEWAY_HOST + value: openclaw.apps.lab.apilab.us + - name: OPENCLAW_GATEWAY_PORT + value: "443" + - name: OPENCLAW_GATEWAY_TLS + value: "true" + - name: CLAWDBOX_NODE_DISPLAY_NAME + value: ClawdBox-CLI + volumeMounts: + - mountPath: /data + name: data-volume + - mountPath: /home/claw/.kube + name: kubeconfig-secret + readOnly: true + resources: + limits: + memory: "768Mi" + cpu: "500m" + requests: + memory: "128Mi" + cpu: "100m" + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] volumes: - name: data-volume persistentVolumeClaim: diff --git a/scripts/clawdbox-entrypoint b/scripts/clawdbox-entrypoint index 2fab600..c7cc187 100644 --- a/scripts/clawdbox-entrypoint +++ b/scripts/clawdbox-entrypoint @@ -37,8 +37,10 @@ done export PATH="$ROOT/bin:/usr/local/bin:$PATH" -start-clawdbox-node || { - echo "ClawdBox-CLI node host did not start; SSH will remain available." >&2 -} +if [ "${CLAWDBOX_START_NODE:-true}" = "true" ]; then + start-clawdbox-node || { + echo "ClawdBox-CLI node host did not start; SSH will remain available." >&2 + } +fi exec /usr/sbin/sshd -D -e -f /etc/ssh/sshd_config diff --git a/scripts/start-clawdbox-node b/scripts/start-clawdbox-node index 3a703f2..287c945 100644 --- a/scripts/start-clawdbox-node +++ b/scripts/start-clawdbox-node @@ -6,12 +6,17 @@ LOG_DIR="$ROOT/logs" PID_FILE="$LOG_DIR/node-host.pid" LOG_FILE="$LOG_DIR/node-host.log" OPENCLAW_DIR="$ROOT/tools/openclaw-node" -OPENCLAW_VERSION=${OPENCLAW_VERSION:-2026.6.1} +OPENCLAW_VERSION=${OPENCLAW_VERSION:-2026.7.2-beta.3} DISPLAY_NAME=${CLAWDBOX_NODE_DISPLAY_NAME:-ClawdBox-CLI} GATEWAY_HOST=${OPENCLAW_GATEWAY_HOST:-openclaw.apps.lab.apilab.us} GATEWAY_PORT=${OPENCLAW_GATEWAY_PORT:-443} +NODE_HOME=${CLAWDBOX_NODE_HOME:-$ROOT/node-home} -mkdir -p "$ROOT/bin" "$ROOT/tools" "$LOG_DIR" "$OPENCLAW_DIR" +export HOME="$NODE_HOME" +export OPENCLAW_STATE_DIR=${OPENCLAW_STATE_DIR:-$NODE_HOME/.openclaw} +export KUBECONFIG=${KUBECONFIG:-/home/claw/.kube/config} + +mkdir -p "$ROOT/bin" "$ROOT/tools" "$LOG_DIR" "$OPENCLAW_DIR" "$HOME" "$OPENCLAW_STATE_DIR" log() { printf '%s %s\n' "$(date -Iseconds)" "$*" | tee -a "$LOG_FILE"