Skip to content

fix(docker): qualify base image refs for podman short-name mode#90058

Merged
sallyom merged 2 commits into
openclaw:mainfrom
mrunalp:fix/podman-qualify-base-images
Jun 4, 2026
Merged

fix(docker): qualify base image refs for podman short-name mode#90058
sallyom merged 2 commits into
openclaw:mainfrom
mrunalp:fix/podman-qualify-base-images

Conversation

@mrunalp

@mrunalp mrunalp commented Jun 3, 2026

Copy link
Copy Markdown

Summary

What problem does this PR solve?

On Podman hosts with short-name-mode = "enforcing" (the Fedora/RHEL default),
podman build -f Dockerfile appears to hang. FROM oven/bun:1.3.13@sha256:…
is an ambiguous short name with no registry alias, so Podman cannot choose
among the configured unqualified-search-registries. With a TTY it blocks on
an interactive "Please select an image:" prompt (the apparent hang); headless
it fails with short-name resolution enforced but cannot prompt without a TTY.
node:* resolves only because a node short-name alias ships in
registries.conf.d.

Why does this matter now?

Podman is a documented, supported install path (docs/install/podman.md), and
short-name-mode = enforcing is the out-of-the-box default on Fedora/RHEL, so
new Podman users hit this on their first build.

What is the intended outcome?

  • Fully-qualify the node and bun base images with docker.io/ so registry
    resolution is deterministic and no interactive prompt is possible.

What is intentionally out of scope?

  • pnpm fetch-timeout tuning for the runtime-assets store-seed step (a
    separate environmental/CDN issue) is deferred to its own change.
  • No change to scripts/podman/setup.sh; both root causes were in Dockerfile.

What does success look like?

podman build -t openclaw:local -f Dockerfile . resolves all base images with
no interactive prompt on a Fedora/RHEL host with short-name-mode = enforcing.
Docker/Buildx builds are unaffected (docker.io/ prefixes are valid there too).

What should reviewers focus on?

The docker.io/library/node and docker.io/oven/bun prefixes — pinned digests
are unchanged, so resolved image content is identical.

Linked context

Which issue does this close?

Closes #

Which issues, PRs, or discussions are related?

Related #

Was this requested by a maintainer or owner?

No — discovered while running the documented Podman setup locally.

Real behavior proof (required for external PRs)

  • Behavior or issue addressed: Podman build hang / interactive short-name prompt
    on FROM oven/bun:... under short-name-mode = enforcing.
  • Real environment tested: Fedora (Linux x86_64), rootless Podman 5.8.2,
    /etc/containers/registries.conf with short-name-mode = "enforcing" and
    unqualified-search-registries = ["registry.fedoraproject.org", "registry.access.redhat.com", "docker.io"].
  • Exact steps or command run after this patch:
    podman build -t openclaw:local -f Dockerfile .
  • Evidence after fix:
    • Before (headless reproduction of the hang at stage 2): 
      [2/6] STEP 1/1: FROM oven/bun:1.3.13@sha256:… AS bun-binary
Error: creating build container: short-name resolution enforced but cannot prompt without a TTY
    • After (fully-qualified ref resolves and pulls cleanly, --target bun-binary): 
      Trying to pull docker.io/oven/bun@sha256:87416c977a…
Successfully tagged localhost/openclaw-bun-probe:latest
rc=0
    • Full builds clear the bun stage and all 23 app-build steps
      (install, build:docker, ui:build, qa:lab:build) with no prompt.
  • Observed result after fix: deterministic resolution, no prompt, build proceeds.
  • What was not tested: Docker/Buildx path (unchanged; docker.io/ is valid
    there); ARM/Apple-Silicon cross-arch builds.
  • Proof limitations or environment constraints: none for this change.

Tests and validation

Which commands did you run?

  • podman build --target bun-binary --build-arg OPENCLAW_BUN_IMAGE=docker.io/oven/bun:… -f Dockerfile . → proved short-name fix (rc=0)
  • podman build -t openclaw:local -f Dockerfile . → cleared bun stage + all 23 app-build steps

What regression coverage was added or updated?

None — build-infra change in Dockerfile; verified by the build itself.

What failed before this fix, if known?

podman build blocked on an interactive registry prompt at stage 2 (or failed
headless with the short-name TTY error).

If no test was added, why not?

No unit-testable surface; the Dockerfile build is the test.

Risk checklist

Did user-visible behavior change? (Yes/No) No — build-infra only.

Did config, environment, or migration behavior change? (Yes/No) No — pinned
image digests and produced image contents are unchanged; only the registry
prefix differs.

Did security, auth, secrets, network, or tool execution behavior change?
(Yes/No) No. Fully-qualifying to docker.io/ removes registry ambiguity (a
mild supply-chain improvement); digests remain pinned.

What is the highest-risk area?

docker.io/library/node / docker.io/oven/bun resolving to the same pinned
digests on all builders.

How is that risk mitigated?

Digests are unchanged, so resolved image content is byte-identical; the change
only removes short-name ambiguity. Verified by a clean local build.

Current review state

What is the next action?

Open the PR against openclaw/openclaw:main.

What is still waiting on author, maintainer, CI, or external proof?

Nothing — fix is verified locally.

Which bot or reviewer comments were addressed?

None yet.

@openclaw-barnacle openclaw-barnacle Bot added docker Docker and sandbox tooling size: XS labels Jun 3, 2026
@mrunalp

mrunalp commented Jun 3, 2026

Copy link
Copy Markdown
Author

@sallyom ptal

@openclaw-barnacle openclaw-barnacle Bot added the proof: supplied External PR includes structured after-fix real behavior proof. label Jun 3, 2026
@clawsweeper

clawsweeper Bot commented Jun 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 4, 2026, 3:11 AM ET / 07:11 UTC.

Summary
The PR qualifies the root Dockerfile Node and Bun base-image ARG defaults with docker.io/ and updates the matching Dockerfile assertions.

PR surface: Tests +3, Other 0. Total +3 across 2 files.

Reproducibility: yes. Current main’s documented Podman setup builds the root Dockerfile with unqualified Node and Bun defaults, and the upstream registries.conf contract explains why enforcing short-name mode prompts or errors for ambiguous short names; I did not run Podman locally.

Review metrics: 1 noteworthy metric.

  • Dockerfile image defaults: 3 changed, 0 added, 0 removed. Changing default base-image ARG values is compatibility-sensitive even though the pinned digests remain unchanged.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P2] Maintainers should explicitly accept Docker Hub as the default logical registry or ask for a mirror/remap note before merge.

Risk before merge

  • [P1] The Dockerfile ARG defaults become explicit docker.io logical names; operators who relied on Podman unqualified-search registries as their default registry-selection policy may need build-arg overrides or registry remapping/mirroring instead.
  • [P1] The contributor did not rerun Docker/Buildx or ARM/Apple-Silicon builds after the change, although the unchanged pinned manifest-list digests make that residual risk low.

Maintainer options:

  1. Accept the Docker Hub default (recommended)
    Maintainers can accept the compatibility tradeoff because the PR preserves pinned digests, fixes the documented Podman setup, and leaves build-arg or registry-remap escape hatches.
  2. Document mirror-heavy deployments first
    If maintainers expect users to rely on unqualified-search registries for internal mirrors, ask for a short note showing the supported build-arg or registries.conf remap path before merge.

Next step before merge

  • [P2] No narrow automated repair is needed; the remaining action is maintainer acceptance of the Docker Hub default compatibility tradeoff.

Security
Cleared: The diff only qualifies pinned Dockerfile image references and updates tests/comments; it introduces no lockfile, workflow, permission, secret, or executable dependency-source change.

Review details

Best possible solution:

Land the digest-preserving qualification after maintainers explicitly accept Docker Hub as the default logical registry and keep build args or registry remapping as the override path.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main’s documented Podman setup builds the root Dockerfile with unqualified Node and Bun defaults, and the upstream registries.conf contract explains why enforcing short-name mode prompts or errors for ambiguous short names; I did not run Podman locally.

Is this the best way to solve the issue?

Yes, with maintainer acceptance of the compatibility tradeoff. Qualifying the actual Dockerfile FROM ARG defaults fixes the root cause more directly than changing Podman setup timeouts or adding Podman-only wrapper logic.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against dc3f2bd1d927.

Label changes

Label changes:

  • add proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes real Fedora rootless Podman terminal output showing the short-name failure before the patch and successful docker.io/oven/bun resolution plus full build progress after it.

Label justifications:

  • P2: This fixes a documented Podman build path with limited blast radius and no runtime user-data impact.
  • merge-risk: 🚨 compatibility: The PR changes default Dockerfile image registry resolution from unqualified short names to explicit Docker Hub references.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes real Fedora rootless Podman terminal output showing the short-name failure before the patch and successful docker.io/oven/bun resolution plus full build progress after it.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes real Fedora rootless Podman terminal output showing the short-name failure before the patch and successful docker.io/oven/bun resolution plus full build progress after it.
Evidence reviewed

PR surface:

Tests +3, Other 0. Total +3 across 2 files.

View PR surface stats
Area Files Added Removed Net
Source 0 0 0 0
Tests 1 5 2 +3
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 1 6 6 0
Total 2 11 8 +3

What I checked:

  • Repository policy read and applied: Root AGENTS.md was read fully; its dependency-contract and compatibility/default-surface review guidance applies to this Dockerfile default change. (AGENTS.md:1, dc3f2bd1d927)
  • Current main still uses unqualified defaults: Current main sets OPENCLAW_NODE_BOOKWORM_IMAGE, OPENCLAW_NODE_BOOKWORM_SLIM_IMAGE, and OPENCLAW_BUN_IMAGE to unqualified image names, so the PR is not obsolete on main. (Dockerfile:12, dc3f2bd1d927)
  • Documented Podman path builds the root Dockerfile: The Podman install docs describe scripts/podman/setup.sh building openclaw:local by default, which routes new Podman users through the root Dockerfile. Public docs: docs/install/podman.md. (docs/install/podman.md:46, dc3f2bd1d927)
  • Setup script invokes Podman build on the root Dockerfile: When the default local image is used, scripts/podman/setup.sh calls podman build -f "$REPO_PATH/Dockerfile", matching the reported build path. (scripts/podman/setup.sh:404, dc3f2bd1d927)
  • PR changes the implicated defaults without changing digests: The live PR diff qualifies the Node and Bun base-image ARG defaults and matching maintenance comments while preserving the pinned digest values. (Dockerfile:12, 7053ee25735c)
  • Regression assertion updated: The PR adds Dockerfile test coverage for the qualified Bun image and updates the existing Node image expectations. (src/dockerfile.test.ts:33, 7053ee25735c)

Likely related people:

  • Peter Steinberger: Current blame for the Dockerfile image ARG defaults points to Peter Steinberger, and commit 5759b93 introduced the pinned multi-arch Docker base ARG/test pattern that this PR updates. (role: introduced current base-image ARG pattern; confidence: medium; commits: 5a10f46c56a0, 5759b93dda5d; files: Dockerfile, src/dockerfile.test.ts)
  • Altay: Commit deada7e updated the same Dockerfile Node base-image defaults and matching Dockerfile tests for Node 24. (role: recent area contributor; confidence: medium; commits: deada7edd31d; files: Dockerfile, src/dockerfile.test.ts)
  • Ayaan Zaidi: Commit metadata for the Node 24 Dockerfile base-default update names Ayaan Zaidi as the committer, making them relevant for routing the Dockerfile default tradeoff. (role: committer for recent base-image update; confidence: medium; commits: deada7edd31d; files: Dockerfile, src/dockerfile.test.ts)
  • sallyom: The PR timeline shows sallyom was assigned after being requested for review and authored the latest test commit on the PR branch. (role: review assignee and branch test contributor; confidence: medium; commits: 7053ee25735c; files: src/dockerfile.test.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Jun 3, 2026
@sallyom sallyom assigned sallyom and unassigned steipete Jun 3, 2026
@byungskers

byungskers commented Jun 4, 2026

Copy link
Copy Markdown

This looks right and pleasantly low-risk — qualifying the registry while keeping the pinned digests unchanged is a nice clean fix.

Tiny follow-up nit: the bun maintenance comment still says docker buildx imagetools inspect oven/bun:<version>. It may be worth qualifying that example to docker.io/oven/bun:<version> too, just so the update path in the file matches the Dockerfile defaults and Podman users do not trip over the same short-name ambiguity again.

@mrunalp mrunalp force-pushed the fix/podman-qualify-base-images branch from b6b0604 to 32a4305 Compare June 4, 2026 05:05
@openclaw-barnacle openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 4, 2026
@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. labels Jun 4, 2026
@sallyom sallyom force-pushed the fix/podman-qualify-base-images branch from 32a4305 to 61adb90 Compare June 4, 2026 06:22
@openclaw-barnacle openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 4, 2026
@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. and removed rating: 🦞 diamond lobster Very strong PR readiness with only minor maintainer review expected. labels Jun 4, 2026
@sallyom sallyom force-pushed the fix/podman-qualify-base-images branch from 61adb90 to 384a830 Compare June 4, 2026 06:53
@openclaw-barnacle openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 4, 2026
@clawsweeper clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 4, 2026
mrunalp and others added 2 commits June 4, 2026 00:04
@mrunalp @claude @sallyom
fix(docker): qualify base image refs for podman short-name mode
4a9d802 
Podman with short-name-mode=enforcing (the Fedora/RHEL default) blocked
the build: `FROM oven/bun:1.3.13...` is an ambiguous short name with no
alias, so Podman prompted interactively for a registry (the apparent
"hang") or, headless, failed with "short-name resolution enforced but
cannot prompt without a TTY". `node:*` only resolved because a `node`
short-name alias ships in registries.conf.d.

Fully-qualify the node and bun base images with docker.io/ so registry
resolution is deterministic. Pinned digests are unchanged, so resolved
image content is identical, and Docker/Buildx builds are unaffected.

Also qualify the docker.io/ prefix in the digest-refresh maintenance
comments so the documented update path matches the defaults and does not
reintroduce the same short-name ambiguity for Podman users.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@sallyom
test(docker): expect qualified base image refs
7053ee2
@sallyom sallyom force-pushed the fix/podman-qualify-base-images branch from 384a830 to 7053ee2 Compare June 4, 2026 07:04
@openclaw-barnacle openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 4, 2026
@clawsweeper clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label Jun 4, 2026
@sallyom sallyom merged commit d522e02 into openclaw:main Jun 4, 2026
171 of 172 checks passed
@github-actions github-actions Bot mentioned this pull request Jun 4, 2026
Open
SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request Jun 4, 2026
@mrunalp @claude
@sallyom @SebTardif
fix(docker): qualify base image refs for podman short-name mode (open…
4517ff7 
…claw#90058)

* fix(docker): qualify base image refs for podman short-name mode

Podman with short-name-mode=enforcing (the Fedora/RHEL default) blocked
the build: `FROM oven/bun:1.3.13...` is an ambiguous short name with no
alias, so Podman prompted interactively for a registry (the apparent
"hang") or, headless, failed with "short-name resolution enforced but
cannot prompt without a TTY". `node:*` only resolved because a `node`
short-name alias ships in registries.conf.d.

Fully-qualify the node and bun base images with docker.io/ so registry
resolution is deterministic. Pinned digests are unchanged, so resolved
image content is identical, and Docker/Buildx builds are unaffected.

Also qualify the docker.io/ prefix in the digest-refresh maintenance
comments so the documented update path matches the defaults and does not
reintroduce the same short-name ambiguity for Podman users.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(docker): expect qualified base image refs

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: sallyom <somalley@redhat.com>
SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request Jun 4, 2026
@mrunalp @claude
@sallyom @SebTardif
fix(docker): qualify base image refs for podman short-name mode (open…
dfaedea 
…claw#90058)

* fix(docker): qualify base image refs for podman short-name mode

Podman with short-name-mode=enforcing (the Fedora/RHEL default) blocked
the build: `FROM oven/bun:1.3.13...` is an ambiguous short name with no
alias, so Podman prompted interactively for a registry (the apparent
"hang") or, headless, failed with "short-name resolution enforced but
cannot prompt without a TTY". `node:*` only resolved because a `node`
short-name alias ships in registries.conf.d.

Fully-qualify the node and bun base images with docker.io/ so registry
resolution is deterministic. Pinned digests are unchanged, so resolved
image content is identical, and Docker/Buildx builds are unaffected.

Also qualify the docker.io/ prefix in the digest-refresh maintenance
comments so the documented update path matches the defaults and does not
reintroduce the same short-name ambiguity for Podman users.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(docker): expect qualified base image refs

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: sallyom <somalley@redhat.com>
SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request Jun 4, 2026
@mrunalp @claude
@sallyom @SebTardif
fix(docker): qualify base image refs for podman short-name mode (open…
9dc343b 
…claw#90058)

* fix(docker): qualify base image refs for podman short-name mode

Podman with short-name-mode=enforcing (the Fedora/RHEL default) blocked
the build: `FROM oven/bun:1.3.13...` is an ambiguous short name with no
alias, so Podman prompted interactively for a registry (the apparent
"hang") or, headless, failed with "short-name resolution enforced but
cannot prompt without a TTY". `node:*` only resolved because a `node`
short-name alias ships in registries.conf.d.

Fully-qualify the node and bun base images with docker.io/ so registry
resolution is deterministic. Pinned digests are unchanged, so resolved
image content is identical, and Docker/Buildx builds are unaffected.

Also qualify the docker.io/ prefix in the digest-refresh maintenance
comments so the documented update path matches the defaults and does not
reintroduce the same short-name ambiguity for Podman users.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(docker): expect qualified base image refs

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: sallyom <somalley@redhat.com>
SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request Jun 4, 2026
@mrunalp @claude
@sallyom @SebTardif
fix(docker): qualify base image refs for podman short-name mode (open…
6e48a02 
…claw#90058)

* fix(docker): qualify base image refs for podman short-name mode

Podman with short-name-mode=enforcing (the Fedora/RHEL default) blocked
the build: `FROM oven/bun:1.3.13...` is an ambiguous short name with no
alias, so Podman prompted interactively for a registry (the apparent
"hang") or, headless, failed with "short-name resolution enforced but
cannot prompt without a TTY". `node:*` only resolved because a `node`
short-name alias ships in registries.conf.d.

Fully-qualify the node and bun base images with docker.io/ so registry
resolution is deterministic. Pinned digests are unchanged, so resolved
image content is identical, and Docker/Buildx builds are unaffected.

Also qualify the docker.io/ prefix in the digest-refresh maintenance
comments so the documented update path matches the defaults and does not
reintroduce the same short-name ambiguity for Podman users.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(docker): expect qualified base image refs

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: sallyom <somalley@redhat.com>
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 5, 2026
@mrunalp @claude @sallyom
fix(docker): qualify base image refs for podman short-name mode (open…
4f4cef0 
…claw#90058)

* fix(docker): qualify base image refs for podman short-name mode

Podman with short-name-mode=enforcing (the Fedora/RHEL default) blocked
the build: `FROM oven/bun:1.3.13...` is an ambiguous short name with no
alias, so Podman prompted interactively for a registry (the apparent
"hang") or, headless, failed with "short-name resolution enforced but
cannot prompt without a TTY". `node:*` only resolved because a `node`
short-name alias ships in registries.conf.d.

Fully-qualify the node and bun base images with docker.io/ so registry
resolution is deterministic. Pinned digests are unchanged, so resolved
image content is identical, and Docker/Buildx builds are unaffected.

Also qualify the docker.io/ prefix in the digest-refresh maintenance
comments so the documented update path matches the defaults and does not
reintroduce the same short-name ambiguity for Podman users.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(docker): expect qualified base image refs

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: sallyom <somalley@redhat.com>
traoremp pushed a commit to traoremp/openclaw that referenced this pull request Jun 5, 2026
@mrunalp @claude @sallyom
fix(docker): qualify base image refs for podman short-name mode (open…
c09f38c 
…claw#90058)

* fix(docker): qualify base image refs for podman short-name mode

Podman with short-name-mode=enforcing (the Fedora/RHEL default) blocked
the build: `FROM oven/bun:1.3.13...` is an ambiguous short name with no
alias, so Podman prompted interactively for a registry (the apparent
"hang") or, headless, failed with "short-name resolution enforced but
cannot prompt without a TTY". `node:*` only resolved because a `node`
short-name alias ships in registries.conf.d.

Fully-qualify the node and bun base images with docker.io/ so registry
resolution is deterministic. Pinned digests are unchanged, so resolved
image content is identical, and Docker/Buildx builds are unaffected.

Also qualify the docker.io/ prefix in the digest-refresh maintenance
comments so the documented update path matches the defaults and does not
reintroduce the same short-name ambiguity for Podman users.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(docker): expect qualified base image refs

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: sallyom <somalley@redhat.com>
849261680 pushed a commit to 849261680/openclaw that referenced this pull request Jun 7, 2026
@mrunalp @claude
@sallyom @849261680
fix(docker): qualify base image refs for podman short-name mode (open…
7114f3c 
…claw#90058)

* fix(docker): qualify base image refs for podman short-name mode

Podman with short-name-mode=enforcing (the Fedora/RHEL default) blocked
the build: `FROM oven/bun:1.3.13...` is an ambiguous short name with no
alias, so Podman prompted interactively for a registry (the apparent
"hang") or, headless, failed with "short-name resolution enforced but
cannot prompt without a TTY". `node:*` only resolved because a `node`
short-name alias ships in registries.conf.d.

Fully-qualify the node and bun base images with docker.io/ so registry
resolution is deterministic. Pinned digests are unchanged, so resolved
image content is identical, and Docker/Buildx builds are unaffected.

Also qualify the docker.io/ prefix in the digest-refresh maintenance
comments so the documented update path matches the defaults and does not
reintroduce the same short-name ambiguity for Podman users.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(docker): expect qualified base image refs

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: sallyom <somalley@redhat.com>
wangmiao0668000666 pushed a commit to wangmiao0668000666/openclaw that referenced this pull request Jun 9, 2026
@mrunalp @claude
@sallyom @wangmiao0668000666
fix(docker): qualify base image refs for podman short-name mode (open…
7624163 
…claw#90058)

* fix(docker): qualify base image refs for podman short-name mode

Podman with short-name-mode=enforcing (the Fedora/RHEL default) blocked
the build: `FROM oven/bun:1.3.13...` is an ambiguous short name with no
alias, so Podman prompted interactively for a registry (the apparent
"hang") or, headless, failed with "short-name resolution enforced but
cannot prompt without a TTY". `node:*` only resolved because a `node`
short-name alias ships in registries.conf.d.

Fully-qualify the node and bun base images with docker.io/ so registry
resolution is deterministic. Pinned digests are unchanged, so resolved
image content is identical, and Docker/Buildx builds are unaffected.

Also qualify the docker.io/ prefix in the digest-refresh maintenance
comments so the documented update path matches the defaults and does not
reintroduce the same short-name ambiguity for Podman users.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(docker): expect qualified base image refs

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: sallyom <somalley@redhat.com>
eleboucher pushed a commit to eleboucher/homelab that referenced this pull request Jun 9, 2026
@eleboucher
fix(container): update image ghcr.io/openclaw/openclaw (2026.6.1 ➔ 20…
e04fa1a 
…26.6.5) (#963)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.1` → `2026.6.5` |

---

### Release Notes

<details>
<summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary>

### [`v2026.6.5`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202665)

[Compare Source](openclaw/openclaw@v2026.6.1...v2026.6.5)

##### Highlights

- QQBot now strips model reasoning/thinking scaffolding before native delivery, preventing raw `<thinking>` content from leaking into channel replies. ([#&#8203;89913](openclaw/openclaw#89913), [#&#8203;90132](openclaw/openclaw#90132)) Thanks [@&#8203;openperf](https://github.com/openperf).
- MCP tool results now coerce `resource_link`, `resource`, `audio`, malformed image, and future non-text/image blocks at the materialize boundary, preventing Anthropic 400s and poisoned session history after a tool returns richer MCP content. ([#&#8203;90710](openclaw/openclaw#90710), [#&#8203;90728](openclaw/openclaw#90728)) Thanks [@&#8203;RanSHammer](https://github.com/RanSHammer) and [@&#8203;849261680](https://github.com/849261680).
- Anthropic extended-thinking sessions recover after prompt-cache expiry or Gateway restart because stream start events wait for `message_start`, letting pre-generation signature errors trigger the existing recovery retry. ([#&#8203;90667](openclaw/openclaw#90667), [#&#8203;90697](openclaw/openclaw#90697)) Thanks [@&#8203;openperf](https://github.com/openperf).
- Parallel is now a bundled `web_search` provider with `PARALLEL_API_KEY` discovery, guarded endpoint handling, cache-safe session ids, onboarding picker support, and docs. ([#&#8203;85158](openclaw/openclaw#85158)) Thanks [@&#8203;NormallyGaussian](https://github.com/NormallyGaussian).
- Google Vertex ADC users get static catalog rows and runtime model resolution again, while single-provider cooldown recovery and memory adapter status checks are more reliable. ([#&#8203;90506](openclaw/openclaw#90506), [#&#8203;90609](openclaw/openclaw#90609), [#&#8203;90717](openclaw/openclaw#90717), [#&#8203;90816](openclaw/openclaw#90816)) Thanks [@&#8203;849261680](https://github.com/849261680).
- Matrix can preflight voice notes before mention gating, preserve thread reads/replies through Matrix relations pagination, and carry QA coverage for voice and thread flows. ([#&#8203;78016](openclaw/openclaw#78016), [#&#8203;90415](openclaw/openclaw#90415))
- Auth and plugin install state is more durable: auth profiles now live in SQLite, official npm plugin install records keep their trusted pins, and prerelease fallback integrity checks avoid carrying stale integrity forward. ([#&#8203;89102](openclaw/openclaw#89102), [#&#8203;88585](openclaw/openclaw#88585))
- macOS node mode no longer silently self-reconnects away from a healthy direct Gateway session, reducing unexpected companion app session churn. ([#&#8203;90668](openclaw/openclaw#90668), [#&#8203;90815](openclaw/openclaw#90815)) Thanks [@&#8203;vrurg](https://github.com/vrurg).
- Upgrade and service paths are safer: cron legacy JSON stores migrate during doctor preflight, service env placeholders no longer mask state-dir secrets, WhatsApp startup waits are bounded, and disabled WhatsApp accounts tear down on config reload. ([#&#8203;90072](openclaw/openclaw#90072), [#&#8203;90208](openclaw/openclaw#90208), [#&#8203;90277](openclaw/openclaw#90277), [#&#8203;90488](openclaw/openclaw#90488), [#&#8203;90486](openclaw/openclaw#90486), [#&#8203;87951](openclaw/openclaw#87951), [#&#8203;87965](openclaw/openclaw#87965)) Thanks [@&#8203;MonkeyLeeT](https://github.com/MonkeyLeeT), [@&#8203;sallyom](https://github.com/sallyom), [@&#8203;mcaxtr](https://github.com/mcaxtr), and [@&#8203;MukundaKatta](https://github.com/MukundaKatta).

##### Changes

- Search/providers: add the Parallel bundled web-search plugin, live provider tests, registration contracts, onboarding/docs wiring, and guarded `api.parallel.ai/v1/search` support. ([#&#8203;85158](openclaw/openclaw#85158)) Thanks [@&#8203;NormallyGaussian](https://github.com/NormallyGaussian).
- Matrix/channels: add voice-message preflight and thread-aware read/reply behavior, including Matrix QA scenario wiring and docs for voice-message behavior. ([#&#8203;78016](openclaw/openclaw#78016), [#&#8203;90415](openclaw/openclaw#90415))
- Skills/ClawHub: install ClawHub skills backed by GitHub repositories through the resolved install API, download the pinned GitHub commit, keep install-policy checks, and report install telemetry after success. ([#&#8203;90478](openclaw/openclaw#90478)) Thanks [@&#8203;Patrick-Erichsen](https://github.com/Patrick-Erichsen).
- Google Chat/channels: add native approval card actions and click handling so Google Chat approvals use platform-native cards instead of generic message flow.
- Mobile: Android provider/model screens now surface expiring, unavailable, unresolved, and attention states more clearly, while iOS settings and Talk tabs keep diagnostics, gateway rows, attachment labels, and unavailable Talk controls reachable.
- Memory: QMD search can use the new rerank toggle, and memory adapter status uses the resolved default model identity when checking plain status. ([#&#8203;61834](openclaw/openclaw#61834))
- Docs/tooling: add Parallel search docs, refresh weather-skill guidance toward `web_fetch`, clarify legacy `openai-codex` auth, document release/test helper scripts, and tighten changed-test routing docs for CI/debugging work. ([#&#8203;90028](openclaw/openclaw#90028), [#&#8203;90250](openclaw/openclaw#90250)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev).
- Release/process: switch release trains to `YYYY.M.PATCH` monthly patch numbering, keep pre-transition tags compatible, and pin the June 2026 floor at `2026.6.5` after the published beta.
- Platform maintenance: refresh Android, Swift/macOS, Docker, CodeQL, Buildx, Docker build/push, and Codex Action dependencies for this release train. ([#&#8203;74980](openclaw/openclaw#74980), [#&#8203;81757](openclaw/openclaw#81757), [#&#8203;86481](openclaw/openclaw#86481), [#&#8203;86483](openclaw/openclaw#86483), [#&#8203;90601](openclaw/openclaw#90601))
- QQBot: add `/bot-group-allways on|off` slash command (with named-account and default-account support) to toggle whether group messages require an `@mention` before the bot replies, and clear the runtime config snapshot after the write so the new account-level `defaultRequireMention` takes effect immediately without restart. ([#&#8203;91423](openclaw/openclaw#91423)) Thanks [@&#8203;cxyhhhhh](https://github.com/cxyhhhhh).

##### Fixes

- Channel content boundaries: QQBot now strips reasoning/thinking tags before sending, preserving final answers while hiding internal model narration from users. ([#&#8203;89913](openclaw/openclaw#89913), [#&#8203;90132](openclaw/openclaw#90132)) Thanks [@&#8203;openperf](https://github.com/openperf).
- Agents/MCP/providers: coerce non-text/image MCP tool-result blocks before they reach provider converters, preserving valid images and turning richer MCP content into text instead of malformed image blocks. ([#&#8203;90710](openclaw/openclaw#90710), [#&#8203;90728](openclaw/openclaw#90728)) Thanks [@&#8203;RanSHammer](https://github.com/RanSHammer) and [@&#8203;849261680](https://github.com/849261680).
- Anthropic/Codex/ACP/agent recovery: defer Anthropic stream start events until `message_start`, strip stale compaction thinking signatures before Anthropic replay, detect unsigned thinking-only stalls, refresh prompt fences after compaction writes, reject empty completion handoffs, preserve parent streaming-off overrides/shared progress commentary, forward heartbeat metadata to context-engine hooks, and cover Codex session/thread migration edge cases. ([#&#8203;90667](openclaw/openclaw#90667), [#&#8203;90697](openclaw/openclaw#90697), [#&#8203;90163](openclaw/openclaw#90163), [#&#8203;90108](openclaw/openclaw#90108), [#&#8203;89874](openclaw/openclaw#89874), [#&#8203;89505](openclaw/openclaw#89505), [#&#8203;90632](openclaw/openclaw#90632), [#&#8203;89302](openclaw/openclaw#89302), [#&#8203;90729](openclaw/openclaw#90729), [#&#8203;90317](openclaw/openclaw#90317), [#&#8203;90319](openclaw/openclaw#90319)) Thanks [@&#8203;openperf](https://github.com/openperf), [@&#8203;100yenadmin](https://github.com/100yenadmin), and [@&#8203;ooiuuii](https://github.com/ooiuuii).
- Provider/model resolution: preserve Google Vertex ADC auth markers in generated catalogs, re-probe a single-provider primary after cooldown, share Codex model visibility, fail closed for unknown model auth, preserve Codex alias availability, keep unresolved profile refs unknown, and avoid resolving auth while listing models. ([#&#8203;90506](openclaw/openclaw#90506), [#&#8203;90609](openclaw/openclaw#90609), [#&#8203;90717](openclaw/openclaw#90717), [#&#8203;90702](openclaw/openclaw#90702)) Thanks [@&#8203;849261680](https://github.com/849261680).
- Gateway/macOS/mobile: avoid duplicate Gateway probe warnings by identity, rate-limit node pairing requests while preserving paired-node reconnects, keep macOS node mode on a healthy direct Gateway session, keep iOS diagnostics and gateway rows reachable, and avoid Linux ARM Gradle resource tasks during Android builds. ([#&#8203;85791](openclaw/openclaw#85791), [#&#8203;90147](openclaw/openclaw#90147), [#&#8203;90668](openclaw/openclaw#90668), [#&#8203;90815](openclaw/openclaw#90815)) Thanks [@&#8203;giodl73-repo](https://github.com/giodl73-repo) and [@&#8203;vrurg](https://github.com/vrurg).
- TUI/chat/Workboard/auto-reply: optimistic user messages stay stable across stale history reloads, runId reassignment, and abort windows instead of disappearing, jumping, or lingering as ghost rows; Workboard stale lifecycle bulk updates no longer overwrite newer status/provenance; message-tool sends now count as delivery. ([#&#8203;86205](openclaw/openclaw#86205), [#&#8203;89600](openclaw/openclaw#89600), [#&#8203;88592](openclaw/openclaw#88592), [#&#8203;90123](openclaw/openclaw#90123)) Thanks [@&#8203;RomneyDa](https://github.com/RomneyDa).
- Cron/update/service env: doctor config preflight now migrates legacy cron JSON stores into SQLite before runtime reads, service env planning skips unresolved placeholders that would mask state-dir `.env` values, and session transcript rewrites keep registry markers/discriminants consistent. ([#&#8203;90072](openclaw/openclaw#90072), [#&#8203;90208](openclaw/openclaw#90208), [#&#8203;90277](openclaw/openclaw#90277), [#&#8203;90488](openclaw/openclaw#90488)) Thanks [@&#8203;MonkeyLeeT](https://github.com/MonkeyLeeT) and [@&#8203;sallyom](https://github.com/sallyom).
- Security/config/tooling: guard MCP HTTP redirects, protect global agent config defaults, and keep release/test/tooling proof failures bounded and explicit. ([#&#8203;89732](openclaw/openclaw#89732), [#&#8203;90145](openclaw/openclaw#90145))
- Channels: WhatsApp restarts when per-account config changes, bounds background startup waits, closes failed sockets, and preserves reconnect behavior; Mattermost slash commands keep their state on `globalThis`; Feishu streaming cards preserve full merged content; voice-call tracks Twilio streams after connect; ClickClack reply tools respect `toolsAllow`. ([#&#8203;87951](openclaw/openclaw#87951), [#&#8203;87965](openclaw/openclaw#87965), [#&#8203;90486](openclaw/openclaw#90486), [#&#8203;68113](openclaw/openclaw#68113), [#&#8203;90534](openclaw/openclaw#90534), [#&#8203;90181](openclaw/openclaw#90181), [#&#8203;90607](openclaw/openclaw#90607), [#&#8203;89500](openclaw/openclaw#89500)) Thanks [@&#8203;MukundaKatta](https://github.com/MukundaKatta), [@&#8203;mcaxtr](https://github.com/mcaxtr), [@&#8203;infoanton](https://github.com/infoanton), [@&#8203;mushuiyu886](https://github.com/mushuiyu886), and [@&#8203;sahibzada-allahyar](https://github.com/sahibzada-allahyar).
- Feishu: retry transient send rate-limit errors (HTTP 429, per-chat code 230020, tenant-level code 11232) with linear backoff, including SDK responses that fulfill with rate-limit bodies instead of throwing, and route streaming-card sends through the retry wrapper. ([#&#8203;89659](openclaw/openclaw#89659)) Thanks [@&#8203;ladygege](https://github.com/ladygege).
- Release/CI/E2E: main CI guard drift, PR merge diff scoping, live Docker credential staging, base-image qualification, installer Docker classification, Playwright dependency install recovery, API-key auth for Codex live Docker lanes, Parallels option terminators, and JSON-mode progress handling are tighter so release proof fails cleaner. ([#&#8203;90532](openclaw/openclaw#90532), [#&#8203;90287](openclaw/openclaw#90287), [#&#8203;90058](openclaw/openclaw#90058)) Thanks [@&#8203;RomneyDa](https://github.com/RomneyDa), [@&#8203;hxy91819](https://github.com/hxy91819), and [@&#8203;mrunalp](https://github.com/mrunalp).
- Release/CI/E2E: Docker E2E and live Docker harness runs now apply default memory, CPU, and process ceilings while preserving explicit per-lane overrides.
- Release/CI/E2E: plugin lifecycle matrix resource sampling now fails phases that exceed RSS, wall-clock, or CPU ceilings instead of only logging the measurements.
- Release/CI/E2E: Codex npm plugin live assertions now cap transcript discovery and diagnostic log reads so failure proof stays bounded.
- Tests/state isolation: QA Lab valid-tool-call metrics now require runtime tool-call evidence when runtime parity data is available instead of counting tool-backed scenario pass status alone.
- Tests/state isolation: QA Lab runtime parity now fails planned-only tool-call rows without matching tool results instead of treating matching mock plans as real tool evidence.
- Tests/state isolation: provider, media, auth, cron, task, session, sandbox, Gateway, and Codex timeout fixtures now scope more home/state/env data per test, reducing cross-test leakage and making release validation failures less noisy. ([#&#8203;90027](openclaw/openclaw#90027), [#&#8203;89974](openclaw/openclaw#89974))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/963
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@sallyom sallyom

Labels

docker Docker and sandbox tooling merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P2 Normal backlog priority with limited blast radius. proof: sufficient ClawSweeper judged the real behavior proof convincing. proof: supplied External PR includes structured after-fix real behavior proof. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: XS status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@mrunalp @byungskers @steipete @sallyom