mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-24 19:35:28 -06:00
Peter Steinberger
3fa3276381
* feat(nodes): opt-in container isolation for node-hosted worker sessions nodeHost.workerRuns.isolation=container runs each worker session inside a Docker-compatible container (docker/OrbStack/podman): stdio launch transport, exactly two bind mounts (bundle read-only, workspace read-write), allowlisted env, and the container itself as the durable launch identity — created stopped and journaled before the descriptor is delivered, killed/removed on cancel, fence, shutdown, and recovery, with an owned-orphan sweep at startup. Missing or changed engines disable hosting with an explicit diagnostic instead of falling back to bare processes. Additive nullable worker_container_json column on node_worker_launches (schema version unchanged). * fix(test): base-shape fixture skips additive columns of stripped tables node_worker_launches is excluded from claw-scoped state schemas, so the read-only compat fixture cannot drop its additive column there; drop only columns whose owning table exists. * fix(test): guard split destructuring in base-shape fixture * test(state): record worker_container_json in the canonical additive-column list * fix(nodes): harden container isolation per review findings - Revalidate the engine daemon target immediately before container creation; a replaced daemon receives zero create/start requests (regression proves it). - A pending launch keeps its worker slot until the journaled container is killed/removed; cancellation cannot free capacity over a live container. - Windows node hosts fail closed at startup for isolation=container with an actionable diagnostic (native paths cannot be container mount targets). - Container identity moves from an additive column to the same-version companion table node_worker_launch_containers (bare STRICT, lazily ensured on first container write, pruned with the launch journal): the launch table is contract-optional and shipped readers reject additive columns there. An exact v9 predecessor now provably opens and uses the journal after the candidate populated container rows.