Description

Description

The Dockerfile sets openclaw.json with root ownership and mode 0o600. This prevents the sandbox user from modifying the configuration post-onboard, blocking channel setup, model changes, and web search configuration.

Affected Area

• File(s): Dockerfile (lines 135-140)

Notes

Tracked at #719 (8 comments), #759, #915. This is a well-known recurring issue.

Related GitHub Issue Check

• Matching open issue: openclaw.json created as root with read-only permissions, making all config writes impossible from sandbox #719 (8 comments)
• Matching open issue: Sandbox config file (openclaw.json) is root-owned and unwritable — no supported path to change primary model #759
• Matching open issue: openclaw.json locked root:root 444 at build time blocks post-onboard channel configuration #915
• Duplicate status: Confirmed existing
• Reasoning: Our Dockerfile audit confirmed root ownership and restrictive permissions on openclaw.json. Tracked at openclaw.json created as root with read-only permissions, making all config writes impossible from sandbox #719, Sandbox config file (openclaw.json) is root-owned and unwritable — no supported path to change primary model #759, openclaw.json locked root:root 444 at build time blocks post-onboard channel configuration #915.

Reproduction Steps

1. After onboard, exec into the sandbox:

   openshell sandbox exec <sandbox-name> -- ls -la /sandbox/.openclaw/openclaw.json

2. Observe: file is owned by root:root with mode 444 (read-only)
3. Attempt to modify it as the sandbox user:

   openshell sandbox exec <sandbox-name> -- \
     echo '{}' > /sandbox/.openclaw/openclaw.json

4. Observe: write fails with Permission denied — this is correct security behavior

Environment

• OS: Linux (inside Docker sandbox)
• NemoClaw Version: v0.1.0
• Branch: main
• Runtime: Docker via OpenShell
• Container / Orchestration Info: Docker sandbox
• Network Setup: N/A
• https://github.com/NVIDIA/NemoClaw
• Branch: main

Debug Output

# Verify the intentional root ownership:
openshell sandbox exec <sandbox-name> -- stat /sandbox/.openclaw/openclaw.json
# Expected: Access: (0444/-r--r--r--)  Uid: (0/root)  Gid: (0/root)

# Verify config integrity hash:
openshell sandbox exec <sandbox-name> -- \
  sha256sum /sandbox/.openclaw/openclaw.json
openshell sandbox exec <sandbox-name> -- \
  cat /sandbox/.openclaw/.config-hash
# Both should match — proving config integrity is verified at startup

Logs

# nemoclaw-start.sh integrity check output:
[NemoClaw] Verifying config integrity...
[NemoClaw] Config hash: OK
# This confirms the root-owned, read-only config is intentional hardening.
# See GitHub issue #719 for context on why this design was chosen.

Checklist

• I confirmed this bug is reproducible
• I searched existing issues and this is not a duplicate