Supervise and persist ClawdBox node host

README.md

@@ -103,9 +103,10 @@ The `/data` volume preserves data across container restarts:
 
 ## OpenClaw Node Host
 
-On container startup, ClawdBox keeps SSH as the foreground service and
+ClawdBox runs SSH and the `ClawdBox-CLI` node host as separate containers in
-opportunistically starts an OpenClaw node host named `ClawdBox-CLI` in the
+the same pod. Kubernetes supervises the node container, while its identity,
-background.
+runtime configuration, and exec approvals persist under
+`/data/agents/clawd/node-home`.
 
 The helper scripts are copied into `/data/agents/clawd/bin/` on each startup:
 
@@ -115,7 +116,7 @@ status-clawdbox-node
 stop-clawdbox-node
 ```
 
-The node host installs `openclaw@2026.6.1` under
+The node host installs `openclaw@2026.7.2-beta.3` under
 `/data/agents/clawd/tools/openclaw-node` if it is missing or stale. It gets the
 Gateway token from `OPENCLAW_GATEWAY_TOKEN` when set, otherwise from the live
 `openclaw` deployment via the mounted kubeconfig.
@@ -123,15 +124,16 @@ Gateway token from `OPENCLAW_GATEWAY_TOKEN` when set, otherwise from the live
 Useful overrides:
 
 ```bash
-OPENCLAW_VERSION=2026.6.1
+OPENCLAW_VERSION=2026.7.2-beta.3
 OPENCLAW_GATEWAY_HOST=openclaw.apps.lab.apilab.us
 OPENCLAW_GATEWAY_PORT=443
 OPENCLAW_GATEWAY_TLS=true
 CLAWDBOX_NODE_DISPLAY_NAME=ClawdBox-CLI
+CLAWDBOX_NODE_HOME=/data/agents/clawd/node-home
 ```
 
-If node startup fails, the pod still starts and SSH remains available. Check
+If node startup fails, SSH remains available while Kubernetes restarts the
-`/data/agents/clawd/logs/node-host.log` for details.
+node container. Check `/data/agents/clawd/logs/node-host.log` for details.
 
 ## Common Tasks
 

manifests/deployment.yaml

@@ -58,8 +58,10 @@ spec:
               value: noninteractive
             - name: TZ
               value: UTC
+            - name: CLAWDBOX_START_NODE
+              value: "false"
             - name: OPENCLAW_VERSION
-              value: "2026.6.1"
+              value: "2026.7.2-beta.3"
             - name: OPENCLAW_GATEWAY_HOST
               value: openclaw.apps.lab.apilab.us
             - name: OPENCLAW_GATEWAY_PORT
@@ -110,6 +112,56 @@ spec:
             capabilities:
               drop: ["ALL"]
               add: ["NET_BIND_SERVICE"]
+        - name: openclaw-node
+          image: default-route-openshift-image-registry.apps.lab.apilab.us/clawdbox/clawdbox:latest
+          imagePullPolicy: Always
+          command:
+            - /bin/bash
+            - -lc
+            - |
+              set -eu
+              /usr/local/bin/start-clawdbox-node
+              PID=$(cat /data/agents/clawd/logs/node-host.pid)
+              while kill -0 "$PID"; do
+                sleep 5
+              done
+              exit 1
+          env:
+            - name: HOME
+              value: /data/agents/clawd/node-home
+            - name: OPENCLAW_STATE_DIR
+              value: /data/agents/clawd/node-home/.openclaw
+            - name: KUBECONFIG
+              value: /home/claw/.kube/config
+            - name: OPENCLAW_VERSION
+              value: "2026.7.2-beta.3"
+            - name: OPENCLAW_GATEWAY_HOST
+              value: openclaw.apps.lab.apilab.us
+            - name: OPENCLAW_GATEWAY_PORT
+              value: "443"
+            - name: OPENCLAW_GATEWAY_TLS
+              value: "true"
+            - name: CLAWDBOX_NODE_DISPLAY_NAME
+              value: ClawdBox-CLI
+          volumeMounts:
+            - mountPath: /data
+              name: data-volume
+            - mountPath: /home/claw/.kube
+              name: kubeconfig-secret
+              readOnly: true
+          resources:
+            limits:
+              memory: "768Mi"
+              cpu: "500m"
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
       volumes:
         - name: data-volume
           persistentVolumeClaim:

scripts/clawdbox-entrypoint

@@ -37,8 +37,10 @@ done
 
 export PATH="$ROOT/bin:/usr/local/bin:$PATH"
 
-start-clawdbox-node || {
+if [ "${CLAWDBOX_START_NODE:-true}" = "true" ]; then
+    start-clawdbox-node || {
         echo "ClawdBox-CLI node host did not start; SSH will remain available." >&2
-}
+    }
+fi
 
 exec /usr/sbin/sshd -D -e -f /etc/ssh/sshd_config

scripts/start-clawdbox-node

@@ -6,12 +6,17 @@ LOG_DIR="$ROOT/logs"
 PID_FILE="$LOG_DIR/node-host.pid"
 LOG_FILE="$LOG_DIR/node-host.log"
 OPENCLAW_DIR="$ROOT/tools/openclaw-node"
-OPENCLAW_VERSION=${OPENCLAW_VERSION:-2026.6.1}
+OPENCLAW_VERSION=${OPENCLAW_VERSION:-2026.7.2-beta.3}
 DISPLAY_NAME=${CLAWDBOX_NODE_DISPLAY_NAME:-ClawdBox-CLI}
 GATEWAY_HOST=${OPENCLAW_GATEWAY_HOST:-openclaw.apps.lab.apilab.us}
 GATEWAY_PORT=${OPENCLAW_GATEWAY_PORT:-443}
+NODE_HOME=${CLAWDBOX_NODE_HOME:-$ROOT/node-home}
 
-mkdir -p "$ROOT/bin" "$ROOT/tools" "$LOG_DIR" "$OPENCLAW_DIR"
+export HOME="$NODE_HOME"
+export OPENCLAW_STATE_DIR=${OPENCLAW_STATE_DIR:-$NODE_HOME/.openclaw}
+export KUBECONFIG=${KUBECONFIG:-/home/claw/.kube/config}
+
+mkdir -p "$ROOT/bin" "$ROOT/tools" "$LOG_DIR" "$OPENCLAW_DIR" "$HOME" "$OPENCLAW_STATE_DIR"
 
 log() {
   printf '%s %s\n' "$(date -Iseconds)" "$*" | tee -a "$LOG_FILE"