ARG OPENCLAW_EXTENSIONS=""

ARG OPENCLAW_VARIANT=default

ARG OPENCLAW_BUNDLED_PLUGIN_DIR=extensions

ARG OPENCLAW_DOCKER_APT_UPGRADE=1

ARG OPENCLAW_NODE_BOOKWORM_IMAGE="node:24-bookworm@sha256:3a09aa6354567619221ef6c45a5051b671f953f0a1924d1f819ffb236e520e6b"

ARG OPENCLAW_NODE_BOOKWORM_DIGEST="sha256:3a09aa6354567619221ef6c45a5051b671f953f0a1924d1f819ffb236e520e6b"

ARG OPENCLAW_NODE_BOOKWORM_SLIM_IMAGE="node:24-bookworm-slim@sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb"

ARG OPENCLAW_NODE_BOOKWORM_SLIM_DIGEST="sha256:e8e2e91b1378f83c5b2dd15f0247f34110e2fe895f6ca7719dbb780f929368eb"

# Base images are pinned to SHA256 digests for reproducible builds.

# Trade-off: digests must be updated manually when upstream tags move.

# Dependabot refreshes these blessed digests; release builds consume the

# reviewed base snapshot instead of mutating distro state on every build.

# To update, run: docker buildx imagetools inspect node:24-bookworm (or podman)

# and replace the digest below with the current multi-arch manifest list entry.

FROM base-${OPENCLAW_VARIANT}

ARG OPENCLAW_VARIANT

ARG OPENCLAW_BUNDLED_PLUGIN_DIR

ARG OPENCLAW_DOCKER_APT_UPGRADE

# OCI base-image metadata for downstream image consumers.

# If you change these annotations, also update:

# Install system utilities present in bookworm but missing in bookworm-slim.

# On the full bookworm image these are already installed (apt-get is a no-op).

# Smoke workflows can opt out of distro upgrades to cut repeated CI time while

# keeping the default runtime image behavior unchanged.

RUN --mount=type=cache,id=openclaw-bookworm-apt-cache,target=/var/cache/apt,sharing=locked \

--mount=type=cache,id=openclaw-bookworm-apt-lists,target=/var/lib/apt,sharing=locked \

apt-get update && \

if [ "${OPENCLAW_DOCKER_APT_UPGRADE}" != "0" ]; then \

DEBIAN_FRONTEND=noninteractive apt-get upgrade -y --no-install-recommends; \

fi && \

DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \

procps hostname curl git lsof openssl