@@ -90,6 +90,15 @@ async function createDockerSetupSandbox(): Promise<DockerSetupSandbox> {
90909191const sandboxRootTracker = createSuiteTempRootTracker({ prefix: "openclaw-docker-setup-" });
929293+const prestartContainerEnvFlags = [
94+"-e HOME=/home/node",
95+"-e OPENCLAW_HOME=/home/node",
96+"-e OPENCLAW_STATE_DIR=/home/node/.openclaw",
97+"-e OPENCLAW_CONFIG_PATH=/home/node/.openclaw/openclaw.json",
98+"-e OPENCLAW_CONFIG_DIR=/home/node/.openclaw",
99+"-e OPENCLAW_WORKSPACE_DIR=/home/node/.openclaw/workspace",
100+].join(" ");
101+93102function createEnv(
94103sandbox: DockerSetupSandbox,
95104overrides: Record<string, string | undefined> = {},
@@ -275,10 +284,10 @@ describe("scripts/docker/setup.sh", () => {
275284const log = await readDockerLog(activeSandbox);
276285expect(log).toContain("--build-arg OPENCLAW_DOCKER_APT_PACKAGES=ffmpeg build-essential");
277286expect(log).toContain(
278-"run --rm --no-deps --entrypoint node openclaw-gateway dist/index.js onboard --mode local --no-install-daemon",
287+`run --rm --no-deps ${prestartContainerEnvFlags} --entrypoint node openclaw-gateway dist/index.js onboard --mode local --no-install-daemon`,
279288);
280289expect(log).toContain(
281-'run --rm --no-deps --entrypoint node openclaw-gateway dist/index.js config set --batch-json [{"path":"gateway.mode","value":"local"},{"path":"gateway.bind","value":"lan"},{"path":"gateway.controlUi.allowedOrigins","value":["http://localhost:18789","http://127.0.0.1:18789"]}]',
290+`run --rm --no-deps ${prestartContainerEnvFlags} --entrypoint node openclaw-gateway dist/index.js config set --batch-json [{"path":"gateway.mode","value":"local"},{"path":"gateway.bind","value":"lan"},{"path":"gateway.controlUi.allowedOrigins","value":["http://localhost:18789","http://127.0.0.1:18789"]}]`,
282291);
283292expect(log).not.toContain("run --rm openclaw-cli onboard --mode local --no-install-daemon");
284293});
@@ -313,6 +322,32 @@ describe("scripts/docker/setup.sh", () => {
313322expect(prestartCliRunLines).toStrictEqual([]);
314323});
315324325+it("pins setup-time CLI state paths inside the container", async () => {
326+const activeSandbox = requireSandbox(sandbox);
327+328+await resetDockerLog(activeSandbox);
329+const result = runDockerSetup(activeSandbox, {
330+OPENCLAW_HOME: "/mnt/c/Users/Trevor",
331+OPENCLAW_STATE_DIR: "/mnt/c/Users/Trevor/.openclaw",
332+OPENCLAW_CONFIG_PATH: "/mnt/c/Users/Trevor/.openclaw/openclaw.json",
333+OPENCLAW_SKIP_ONBOARDING: "1",
334+});
335+expect(result.status).toBe(0);
336+337+const lines = await readDockerLogLines(activeSandbox);
338+const gatewayStartIdx = findGatewayStartLineIndex(lines);
339+expect(gatewayStartIdx).toBeGreaterThanOrEqual(0);
340+341+const prestartConfigLines = collectMatchingLines(lines.slice(0, gatewayStartIdx), (line) =>
342+line.includes(" dist/index.js config "),
343+);
344+expect(prestartConfigLines.length).toBeGreaterThan(0);
345+for (const line of prestartConfigLines) {
346+expect(line).toContain(prestartContainerEnvFlags);
347+expect(line).not.toContain("/mnt/c");
348+}
349+});
350+316351it("forces BuildKit for local and sandbox docker builds", async () => {
317352const activeSandbox = requireSandbox(sandbox);
318353await mkdir(join(activeSandbox.rootDir, "scripts", "docker", "sandbox"), { recursive: true });
@@ -692,12 +727,16 @@ describe("scripts/docker/setup.sh", () => {
692727expect(compose.match(/TZ: \$\{OPENCLAW_TZ:-UTC\}/g)).toHaveLength(2);
693728});
694729695-it("pins container-side workspace and config dirs on both services so host .env paths cannot leak (#77436)", async () => {
730+it("pins container-side state, workspace, and config dirs on both services so host .env paths cannot leak (#77436)", async () => {
696731const compose = await readFile(join(repoRoot, "docker-compose.yml"), "utf8");
697-// Both gateway and CLI services must override the env_file values with the
698-// canonical container paths so a host-style OPENCLAW_WORKSPACE_DIR like
699-// `/Users/<you>/.openclaw/workspace` written to `.env` by docker-setup.sh
700-// cannot reach runtime code inside Linux Docker.
732+// Both gateway and CLI services must override env_file values with the
733+// canonical container paths so host-style paths written to `.env` cannot
734+// reach runtime code inside Linux Docker.
735+expect(compose.match(/OPENCLAW_HOME: \/home\/node$/gm)).toHaveLength(2);
736+expect(compose.match(/OPENCLAW_STATE_DIR: \/home\/node\/\.openclaw$/gm)).toHaveLength(2);
737+expect(
738+compose.match(/OPENCLAW_CONFIG_PATH: \/home\/node\/\.openclaw\/openclaw\.json$/gm),
739+).toHaveLength(2);
701740expect(compose.match(/OPENCLAW_CONFIG_DIR: \/home\/node\/\.openclaw$/gm)).toHaveLength(2);
702741expect(
703742compose.match(/OPENCLAW_WORKSPACE_DIR: \/home\/node\/\.openclaw\/workspace$/gm),
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。