perf(dockerfile): move token injection to late layer to preserve build cache by ericksoa · Pull Request #2483 · NVIDIA/NemoClaw

ericksoa · 2026-04-25T22:23:11Z

Summary

Fixes 4x build time regression on Spark (400s+ → ~100s) caused by NEMOCLAW_BUILD_ID cache-busting the config generation layer, which invalidated the expensive openclaw doctor --fix + openclaw plugins install layer on every build
Splits token generation into two steps: config layer writes a placeholder (cacheable), then a late layer injects secrets.token_hex(32) (cache-busted but trivially fast)
The doctor/plugins layer no longer rebuilds on every build

Depends on #2482

Test plan

npx vitest run --project cli — 1947 tests pass (ssrf-parity skip is pre-existing, needs plugin build)
All pre-commit and pre-push hooks pass
Verify build time improvement on Spark

Summary by CodeRabbit

Chores
- Optimized Docker image build layers to improve caching efficiency while ensuring unique credentials are generated for each build.

…d cache The NEMOCLAW_BUILD_ID cache-bust on the config generation layer invalidated the expensive openclaw doctor/plugins layer on every build, causing 400s+ builds on Spark (up from ~100s). Split token generation into two steps: 1. Config layer writes a placeholder token (fully cacheable) 2. New late layer injects secrets.token_hex(32) (cache-busted, trivially fast) The doctor/plugins layer no longer rebuilds on every build.

coderabbitai · 2026-04-25T22:23:23Z

📝 Walkthrough

Walkthrough

The Dockerfile was refactored to optimize Docker layer caching by decoupling configuration generation from token generation. The initial openclaw.json file is now written in a reusable cached layer with an empty token placeholder, while a subsequent build-ID-dependent layer overwrites the token with a unique value per build.

Changes

Cohort / File(s)	Summary
Dockerfile Build Optimization `Dockerfile`	Split `openclaw.json` generation into two layers: initial cached layer writes config with empty `gateway.auth.token`, then a separate cache-busting layer injects a unique per-build token. Removed `secrets` import from initial Python snippet.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 Layers stacked like carrot cakes, caching layers bake,
Tokens dance in Docker's land, unique with every make,
One build, one token, fresh and new each time,
The rabbit hops through registries—a caching paradigm! 🏗️

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: moving token injection to a late Docker layer to preserve build cache and improve performance.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/dockerfile-build-cache-perf

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

🧹 Nitpick comments (1)

Dockerfile (1)

359-370: Optional hardening: fail fast on default build ID in CI/onboard builds.

This prevents accidental token reuse when NEMOCLAW_BUILD_ID is left as default.

Suggested guard

-RUN NEMOCLAW_BUILD_ID="${NEMOCLAW_BUILD_ID}" python3 -c "\
+RUN test "${NEMOCLAW_BUILD_ID}" != "default" || { echo "ERROR: NEMOCLAW_BUILD_ID must be overridden"; exit 1; }; \
+    NEMOCLAW_BUILD_ID="${NEMOCLAW_BUILD_ID}" python3 -c "\
 import json, os, secrets; \
 path = os.path.expanduser('~/.openclaw/openclaw.json'); \
 cfg = json.load(open(path)); \
 cfg.setdefault('gateway', {}).setdefault('auth', {})['token'] = secrets.token_hex(32); \
 json.dump(cfg, open(path, 'w'), indent=2); \
 os.chmod(path, 0o600)"

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@Dockerfile` around lines 359 - 370, Add a fail-fast guard inside the existing
RUN python3 -c block that checks the NEMOCLAW_BUILD_ID value and aborts the
build if it is unset or equals "default"; specifically, in the RUN that
manipulates ~/.openclaw/openclaw.json (the block that uses NEMOCLAW_BUILD_ID and
secrets.token_hex), detect if os.environ.get("NEMOCLAW_BUILD_ID") in (None,
"default") and call sys.exit(1) after printing a clear error to stderr so
CI/onboard builds fail rather than reuse a default token.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@Dockerfile`:
- Around line 359-370: Add a fail-fast guard inside the existing RUN python3 -c
block that checks the NEMOCLAW_BUILD_ID value and aborts the build if it is
unset or equals "default"; specifically, in the RUN that manipulates
~/.openclaw/openclaw.json (the block that uses NEMOCLAW_BUILD_ID and
secrets.token_hex), detect if os.environ.get("NEMOCLAW_BUILD_ID") in (None,
"default") and call sys.exit(1) after printing a clear error to stderr so
CI/onboard builds fail rather than reuse a default token.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ee03c0f9-9325-4a83-af37-4e43d9631d3a

📥 Commits

Reviewing files that changed from the base of the PR and between 31c782c and 383807d.

📒 Files selected for processing (1)

Dockerfile

## Summary Refreshes user-facing docs for the last 24 hours of merged NemoClaw history and bumps the docs metadata to 0.0.29, the next version after v0.0.28. The updates are limited to behavior supported by merged PR descriptions and diffs. ## Changes - `docs/reference/commands.md`: documented `nemoclaw <name> policy-add --from-file` and `--from-dir`, including custom preset review guidance, from #2077 / commit `7720b175`. - `docs/deployment/deploy-to-remote-gpu.md`: clarified that non-loopback `CHAT_UI_URL` disables OpenClaw device pairing for remote browser-only deployments, from #2449 / commit `f5ee8a4d`. - `docs/inference/inference-options.md`: documented provider-aware credential retry validation and the NVIDIA-only `nvapi-` prefix check, from #2389 / commit `6f7f0c6d`. - `docs/inference/switch-inference-providers.md`: documented `NEMOCLAW_INFERENCE_INPUTS` for text/image-capable model metadata baked into `openclaw.json`, from #2441 / commit `f4391892`. - `docs/reference/troubleshooting.md`: added the Git certificate verification entry for proxy CA propagation through `GIT_SSL_CAINFO`, `GIT_SSL_CAPATH`, `CURL_CA_BUNDLE`, and `REQUESTS_CA_BUNDLE`, from #2345 / commit `fa0dc1ab`. - `docs/versions1.json` and `docs/project.json`: promoted docs version `0.0.29`; `docs/versions1.json` omits unpublished `0.0.26`, `0.0.27`, and `0.0.28` entries. - `.agents/skills/nemoclaw-user-*`: regenerated derived user skill references from the updated docs. - Reviewed with no extra doc changes: #2575 / `d392ec07`, #2565 / `a3231049`, #1965 / `db1ef3ca`, #1990 / `db665834`, #2495 / `7da86fa3`, #2496 / `3192f4f4`, #2490 / `8c209058`, #2487 / `1f615e2f`, #2483 / `5653d33a`, #2482 / `31c782c0`, #2464 / `23bb5703`, #2472 / `a54f9a34`, and #2437 / `6bc860d7`. - Skipped per docs policy: #2420 / `7b76df6b` touched the experimental sandbox config path listed in `docs/.docs-skip`; #2466 / `cc15689c` touched a skipped term and CI-only sandbox image files. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Verification  - [x] `npx prek run --all-files` passes - [ ] `npm test` passes — failed locally in installer-integration tests and one onboard helper timeout; the doc-scoped hook test projects passed under `prek`. - [ ] Tests added or updated for new or changed behavior - [x] No secrets, API keys, or credentials committed - [x] Docs updated for user-facing behavior changes - [ ] `make docs` builds without warnings (doc changes only) — build succeeded, but local Sphinx emitted the existing version-switcher file read message. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) ## AI Disclosure  - [x] AI-assisted — tool: Codex ---  Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>  ## Summary by CodeRabbit * **New Features** * Support for custom YAML presets in policy configuration via --from-file and --from-dir. * New build-time inference input option to declare accepted modalities (text or text,image). * **Improvements** * Credential validation now offers interactive recovery: re-enter key, retry, choose another provider, or exit. * Clarified provider-specific API key prefix handling (nvapi- only applies to NVIDIA keys). * **Documentation** * TLS certificate troubleshooting for inspected networks. * Clarified remote dashboard security/device-pairing behavior; command docs updated; docs version bumped.  --------- Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>

…d cache (NVIDIA#2483) ## Summary - Fixes 4x build time regression on Spark (400s+ → ~100s) caused by `NEMOCLAW_BUILD_ID` cache-busting the config generation layer, which invalidated the expensive `openclaw doctor --fix` + `openclaw plugins install` layer on every build - Splits token generation into two steps: config layer writes a placeholder (cacheable), then a late layer injects `secrets.token_hex(32)` (cache-busted but trivially fast) - The doctor/plugins layer no longer rebuilds on every build Depends on NVIDIA#2482 ## Test plan - [x] `npx vitest run --project cli` — 1947 tests pass (ssrf-parity skip is pre-existing, needs plugin build) - [x] All pre-commit and pre-push hooks pass - [ ] Verify build time improvement on Spark  ## Summary by CodeRabbit * **Chores** * Optimized Docker image build layers to improve caching efficiency while ensuring unique credentials are generated for each build.

## Summary Refreshes user-facing docs for the last 24 hours of merged NemoClaw history and bumps the docs metadata to 0.0.29, the next version after v0.0.28. The updates are limited to behavior supported by merged PR descriptions and diffs. ## Changes - `docs/reference/commands.md`: documented `nemoclaw <name> policy-add --from-file` and `--from-dir`, including custom preset review guidance, from NVIDIA#2077 / commit `7720b175`. - `docs/deployment/deploy-to-remote-gpu.md`: clarified that non-loopback `CHAT_UI_URL` disables OpenClaw device pairing for remote browser-only deployments, from NVIDIA#2449 / commit `f5ee8a4d`. - `docs/inference/inference-options.md`: documented provider-aware credential retry validation and the NVIDIA-only `nvapi-` prefix check, from NVIDIA#2389 / commit `6f7f0c6d`. - `docs/inference/switch-inference-providers.md`: documented `NEMOCLAW_INFERENCE_INPUTS` for text/image-capable model metadata baked into `openclaw.json`, from NVIDIA#2441 / commit `f4391892`. - `docs/reference/troubleshooting.md`: added the Git certificate verification entry for proxy CA propagation through `GIT_SSL_CAINFO`, `GIT_SSL_CAPATH`, `CURL_CA_BUNDLE`, and `REQUESTS_CA_BUNDLE`, from NVIDIA#2345 / commit `fa0dc1ab`. - `docs/versions1.json` and `docs/project.json`: promoted docs version `0.0.29`; `docs/versions1.json` omits unpublished `0.0.26`, `0.0.27`, and `0.0.28` entries. - `.agents/skills/nemoclaw-user-*`: regenerated derived user skill references from the updated docs. - Reviewed with no extra doc changes: NVIDIA#2575 / `d392ec07`, NVIDIA#2565 / `a3231049`, NVIDIA#1965 / `db1ef3ca`, NVIDIA#1990 / `db665834`, NVIDIA#2495 / `7da86fa3`, NVIDIA#2496 / `3192f4f4`, NVIDIA#2490 / `8c209058`, NVIDIA#2487 / `1f615e2f`, NVIDIA#2483 / `5653d33a`, NVIDIA#2482 / `31c782c0`, NVIDIA#2464 / `23bb5703`, NVIDIA#2472 / `a54f9a34`, and NVIDIA#2437 / `6bc860d7`. - Skipped per docs policy: NVIDIA#2420 / `7b76df6b` touched the experimental sandbox config path listed in `docs/.docs-skip`; NVIDIA#2466 / `cc15689c` touched a skipped term and CI-only sandbox image files. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Verification  - [x] `npx prek run --all-files` passes - [ ] `npm test` passes — failed locally in installer-integration tests and one onboard helper timeout; the doc-scoped hook test projects passed under `prek`. - [ ] Tests added or updated for new or changed behavior - [x] No secrets, API keys, or credentials committed - [x] Docs updated for user-facing behavior changes - [ ] `make docs` builds without warnings (doc changes only) — build succeeded, but local Sphinx emitted the existing version-switcher file read message. - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) ## AI Disclosure  - [x] AI-assisted — tool: Codex ---  Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>  ## Summary by CodeRabbit * **New Features** * Support for custom YAML presets in policy configuration via --from-file and --from-dir. * New build-time inference input option to declare accepted modalities (text or text,image). * **Improvements** * Credential validation now offers interactive recovery: re-enter key, retry, choose another provider, or exit. * Clarified provider-specific API key prefix handling (nvapi- only applies to NVIDIA keys). * **Documentation** * TLS certificate troubleshooting for inspected networks. * Clarified remote dashboard security/device-pairing behavior; command docs updated; docs version bumped.  --------- Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>

coderabbitai Bot reviewed Apr 25, 2026

View reviewed changes

ericksoa merged commit 5653d33 into main Apr 25, 2026
52 of 53 checks passed

miyoungc mentioned this pull request Apr 28, 2026

docs: refresh daily docs for 0.0.29 #2576

Merged

13 tasks

wscurran added the refactor PR restructures code without intended behavior change label Jun 9, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

perf(dockerfile): move token injection to late layer to preserve build cache#2483

perf(dockerfile): move token injection to late layer to preserve build cache#2483
ericksoa merged 1 commit into
mainfrom
fix/dockerfile-build-cache-perf

ericksoa commented Apr 25, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Apr 25, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ericksoa commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ericksoa commented Apr 25, 2026 •

edited

Loading

coderabbitai Bot commented Apr 25, 2026 •

edited

Loading