- "Dockerfile"

- "Dockerfile.*"

- "docker-compose.yml"

- "docker-setup.sh"

- "setup-podman.sh"

- ".dockerignore"

- "deploy/fly.private.toml"

- "scripts/docker/setup.sh"

- "scripts/docker/sandbox/Dockerfile*"

- "scripts/podman/setup.sh"

python -m pip install pytest ruff pyyaml

- name: Lint Python skill scripts

run: python -m ruff check skills

run: python -m ruff check --config skills/pyproject.toml skills

- name: Test skill Python scripts

run: python -m pytest -q skills

run: python -m pytest -q -c skills/pyproject.toml skills

checks-windows:

permissions:

rev: v1.22.0

hooks:

- id: zizmor

args: [--persona=regular, --min-severity=medium, --min-confidence=medium]

args:

[

--config,

.github/zizmor.yml,

--persona=regular,

--min-severity=medium,

--min-confidence=medium,

]

exclude: "^(vendor/|apps/swabble/)"

# Python checks for skills scripts

hooks:

- id: ruff

files: "^skills/.*\\.py$"

args: [--config, pyproject.toml]

args: [--config, skills/pyproject.toml]

- repo: local

hooks:

- id: skills-python-tests

name: skills python tests

entry: pytest -q skills

entry: pytest -q -c skills/pyproject.toml skills

language: python

additional_dependencies: [pytest>=8, <9]

pass_filenames: false

<Step title="Configure fly.toml">

Edit `fly.toml` to match your app name and requirements.

**Security note:** The default config exposes a public URL. For a hardened deployment with no public IP, see [Private Deployment](#private-deployment-hardened) or use `fly.private.toml`.

**Security note:** The default config exposes a public URL. For a hardened deployment with no public IP, see [Private Deployment](#private-deployment-hardened) or use `deploy/fly.private.toml`.

```toml

app = "my-openclaw" # Your app name

### Setup

Use `fly.private.toml` instead of the standard config:

Use `deploy/fly.private.toml` instead of the standard config:

```bash

# Deploy with private config

fly deploy -c fly.private.toml

fly deploy -c deploy/fly.private.toml

```

Or convert an existing deployment:

# Switch to private config so future deploys don't re-allocate public IPs

# (remove [http_service] or deploy with the private template)

fly deploy -c fly.private.toml

fly deploy -c deploy/fly.private.toml

# Allocate private-only IPv6

fly ips allocate-v6 --private -a my-openclaw

const EXTENSION_PATH_RE = /^extensions\/[^/]+(?:\/|$)/u;

const CORE_PATH_RE = /^(?:src\/|ui\/|packages\/)/u;

const TOOLING_PATH_RE =

/^(?:scripts\/|test\/vitest\/|\.github\/|\.vscode\/|git-hooks\/|Dockerfile\.sandbox(?:-(?:browser|common))?$|Makefile$|openclaw\.podman\.env$|vitest(?:\..+)?\.config\.ts$|tsconfig.*\.json$|\.dockerignore$|\.gitignore$|\.jscpd\.json$|\.npmignore$|\.pre-commit-config\.yaml$|\.swiftformat$|\.oxlint.*|\.oxfmt.*)/u;

/^(?:scripts\/|test\/vitest\/|\.github\/|\.vscode\/|deploy\/|git-hooks\/|Dockerfile\.sandbox(?:-(?:browser|common))?$|Makefile$|docker-setup\.sh$|setup-podman\.sh$|openclaw\.podman\.env$|skills\/pyproject\.toml$|vitest(?:\..+)?\.config\.ts$|tsconfig.*\.json$|\.dockerignore$|\.gitignore$|\.jscpd\.json$|\.npmignore$|\.pre-commit-config\.yaml$|\.swiftformat$|\.oxlint.*|\.oxfmt.*)/u;

const ROOT_GLOBAL_PATH_RE =

/^(?:package\.json$|pnpm-lock\.yaml$|pnpm-workspace\.yaml$|tsdown\.config\.ts$|vitest\.config\.ts$)/u;

const LEGACY_ROOT_ASSET_PATH_RE = /^assets\//u;

};

const DOCS_PATH_RE = /^(docs\/|.*\.mdx?$)/;

const SKILLS_PYTHON_SCOPE_RE = /^(skills\/|pyproject\.toml$)/;

const SKILLS_PYTHON_SCOPE_RE = /^(skills\/|skills\/pyproject\.toml$)/;

const INSTALL_SMOKE_WORKFLOW_SCOPE_RE = /^\.github\/workflows\/install-smoke\.yml$/;

const MACOS_PROTOCOL_GEN_RE =

/^(apps\/macos\/Sources\/OpenClawProtocol\/|apps\/shared\/OpenClawKit\/Sources\/OpenClawProtocol\/)/;

| -------------------------- | -------------------------------------------------------------------------- |

| `Dockerfile` | Builds the `openclaw:local` image (Node 22, pnpm, non-root `node` user) |

| `docker-compose.yml` | Defines `openclaw-gateway` and `openclaw-cli` services, bind-mounts, ports |

| `docker-setup.sh` | First-time setup — builds image, creates `.env` from `.env.example` |

| `scripts/docker/setup.sh` | First-time setup — builds image, creates `.env` from `.env.example` |

| `.env.example` | Template for `<project>/.env` with all supported vars and docs |

| `docker-compose.extra.yml` | Optional overrides — auto-loaded by ClawDock helpers if present |

### Initial Setup

`./docker-setup.sh` (in the project root) handles first-time Docker configuration:

`./scripts/docker/setup.sh` handles first-time Docker configuration:

- Builds the `openclaw:local` image from `Dockerfile`

- Creates `<project>/.env` from `.env.example` with a generated gateway token

- Sets up `~/.openclaw` directories if they don't exist

```bash

./docker-setup.sh

./scripts/docker/setup.sh

```

After setup, add your API keys: