Summary

openclaw gateway restart (and systemctl --user restart) fails to kill the previous gateway process, causing the new instance to crash-loop on port conflict. The orphaned process continues serving with stale config, so changes to agents.defaults.sandbox.docker.image never take effect.

Steps to reproduce

1. Configure a custom sandbox image in openclaw.json: agents.defaults.sandbox.docker.image: "my-custom-image:latest"
2. Run openclaw gateway restart or systemctl --user restart openclaw-gateway.service
3. Trigger an agent session (openclaw agent --agent main --message "which gh")
4. Inspect the sandbox container: docker ps --filter label=openclaw.sandbox=1 --format '{{.Image}}'

Expected behavior

The old gateway process is terminated, the new process binds to the port, and the sandbox container is created from the configured custom image.

Actual behavior

The old gateway process ignores SIGTERM and keeps the port. The new process crash-loops (restart counter climbs to 100+). The sandbox container is created from the default openclaw-sandbox:bookworm-slim base image, ignoring the configured custom image. Additionally, when the container is manually removed and a new gateway finally starts, the "recently used" guard in ensureSandboxContainer prevents auto-recreation even when the configHash mismatches, and openclaw sandbox recreate --all reports "No containers found" despite Docker showing the container with openclaw.sandbox=1 label.

OpenClaw version

2026.2.12

Operating system

Ubuntu 24.04.4 LTS

Install method

DigitalOcean 1-click app

Logs, screenshots, and evidence

# Orphaned process holds port
$ ss -tlnp | grep 18789
LISTEN 127.0.0.1:18789 users:(("openclaw-gatewa",pid=149502))

# New process crash-loops
$ journalctl --user -u openclaw-gateway.service
Gateway failed to start: another gateway instance is already listening on ws://127.0.0.1:18789
Scheduled restart job, restart counter is at 119.

# Container uses wrong image despite config
$ docker ps --filter label=openclaw.sandbox=1 --format '{{.Image}}'
openclaw-sandbox:bookworm-slim

# sandbox recreate doesn't see it
$ openclaw sandbox recreate --all
No containers found matching the criteria.

# But Docker does
$ docker ps -a --filter "label=openclaw.sandbox=1"
802463eb752e openclaw-sandbox:bookworm-slim openclaw-sbx-agent-main-0d71ad7a Up 23 minutes

Impact and severity

Affects anyone customizing the sandbox Docker image.

Severity: medium — workaround exists (kill -9 + docker rm + restart) but is non-obvious.

The openclaw sandbox recreate command being unable to see gateway-created containers makes self-service recovery impossible.

Additional information

Workaround: kill -9 <old_pid> && docker stop <container> && docker rm <container> && systemctl --user restart openclaw-gateway.service.

The issue may be related to the systemd service unit not using KillMode=control-group or the gateway not writing its PID for clean shutdown.