fix(podman): time out setup image pulls

scripts/podman/setup.sh

@@ -28,6 +28,7 @@ OPENCLAW_CONTAINER_NAME="${OPENCLAW_PODMAN_CONTAINER:-openclaw}"
 PLATFORM_NAME="$(uname -s 2>/dev/null || echo unknown)"
 HOST_GATEWAY_PORT="${OPENCLAW_PODMAN_GATEWAY_HOST_PORT:-${OPENCLAW_GATEWAY_PORT:-18789}}"
 QUADLET_GATEWAY_PORT="18789"
+PODMAN_PULL_TIMEOUT="${OPENCLAW_PODMAN_SETUP_PULL_TIMEOUT:-600s}"
 
 require_cmd() {
   if ! command -v "$1" >/dev/null 2>&1; then
@@ -43,6 +44,15 @@ fail() {
   exit 1
 }
 
+run_podman_pull() {
+  local image="$1"
+  if command -v timeout >/dev/null 2>&1; then
+    timeout "$PODMAN_PULL_TIMEOUT" podman pull "$image"
+    return
+  fi
+  podman pull "$image"
+}
+
 validate_single_line_value() {
   local label="$1"
   local value="$2"
@@ -382,7 +392,7 @@ else
     echo "Using existing image $OPENCLAW_IMAGE"
   else
     echo "Pulling image $OPENCLAW_IMAGE ..."
-    podman pull "$OPENCLAW_IMAGE"
+    run_podman_pull "$OPENCLAW_IMAGE"
   fi
 fi
 

test/scripts/test-install-sh-docker.test.ts

@@ -130,6 +130,18 @@ describe("test-install-sh-docker", () => {
     expect(script).not.toContain('docker pull "$IMAGE_NAME"');
   });
 
+  it("bounds Podman setup image pulls", () => {
+    const script = readFileSync(PODMAN_SETUP_PATH, "utf8");
+
+    expect(script).toContain(
+      'PODMAN_PULL_TIMEOUT="${OPENCLAW_PODMAN_SETUP_PULL_TIMEOUT:-600s}"',
+    );
+    expect(script).toContain("run_podman_pull()");
+    expect(script).toContain('timeout "$PODMAN_PULL_TIMEOUT" podman pull "$image"');
+    expect(script).toContain('run_podman_pull "$OPENCLAW_IMAGE"');
+    expect(script).not.toContain('podman pull "$OPENCLAW_IMAGE"');
+  });
+
   it("passes image-scoped pip packages through Docker and Podman setup", () => {
     const dockerSetup = readFileSync(DOCKER_SETUP_PATH, "utf8");
     const podmanSetup = readFileSync(PODMAN_SETUP_PATH, "utf8");