fix: add curl/node/python3 to local-inference binary allowlist

[BenediktSchackenberg]

Two unrelated fixes in one PR.

1. local-inference preset — missing binaries (fixes #2199)

The preset only listed openclaw and claude as allowed binaries for the Ollama endpoints. curl, node, and python3 were blocked — causing HTTP 403 when users test with curl http://host.openshell.internal:11434/api/tags or use Python/Node inference clients directly.

Added: /usr/local/bin/node, /usr/bin/curl, /usr/local/bin/python3, /usr/bin/python3.

2. Dockerfile — missing extensions symlink and data dir (fixes #2203)

openclaw plugins install fails with Invalid extensions directory: base directory must be a real directory because ~/.openclaw/extensions is a broken symlink. The /sandbox/.openclaw-data/extensions target directory is never created and the symlink is never established.

Added extensions to the existing RUN block that creates .openclaw-data subdirs and sets up symlinks under ~/.openclaw/, matching the pattern used for logs, credentials, sandbox, and media.

Signed-off-by: Benedikt Schackenberg 6381261+BenediktSchackenberg@users.noreply.github.com

Summary by CodeRabbit

• Configuration Updates
  • Expanded local inference configuration allowlist to permit additional host binaries (additional Node, curl, and Python interpreter locations), improving compatibility for locally executed inference workflows.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9f3ab3fb-3156-47ff-a501-e7cf2524b6b3

📥 Commits

Reviewing files that changed from the base of the PR and between b0a6eac and 1ad758b.

📒 Files selected for processing (1)

• nemoclaw-blueprint/policies/presets/local-inference.yaml

---

📝 Walkthrough

Walkthrough

The local-inference policy preset’s host binary allowlist was extended to include additional executable paths for Node.js, curl, and Python, adding entries for /usr/local/bin/node, /usr/bin/node, /usr/bin/curl, and /usr/bin/python3. No other policy sections were modified.

Changes

Cohort / File(s)	Summary
Local-inference policy preset nemoclaw-blueprint/policies/presets/local-inference.yaml	Added four binary allowlist entries under network_policies.local_inference.binaries: /usr/local/bin/node, /usr/bin/node, /usr/bin/curl, /usr/bin/python3. Review sandbox host binary execution rules and any comments about alternate apt locations.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• fix: add curl/node/python3 to local-inference binary allowlist #2295 — Makes the same file-level change to policies/presets/local-inference.yaml, expanding the binaries allowlist to include Node, curl, and python3 paths.

Poem

🐰 Soft paws tap on keys tonight,

Paths extended, binaries in sight.
Node, curl, and Python stride,
Through sandbox walls they now can glide.
A happy hop — inference takes flight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: adding curl, node, and python3 binaries to the local-inference policy preset's allowlist.
Linked Issues check	✅ Passed	The PR fully addresses issue #2199 by adding required client binaries (curl, node, python3) to the local-inference binary allowlist, allowing sandboxed processes to reach Ollama endpoints.
Out of Scope Changes check	✅ Passed	All changes are in-scope: only the local-inference.yaml binary allowlist was modified; the Dockerfile extensions change was reverted per reviewer feedback, keeping the PR focused on #2199.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Fixes two sandbox usability issues: (1) allow common client binaries to reach local inference endpoints under the local-inference preset, and (2) ensure the sandbox image creates the extensions state directory and wiring so plugin installs don’t fail due to missing paths.

Changes:

• Extend local-inference preset binary allowlist to include node, curl, and python3.
• Ensure /sandbox/.openclaw-data/extensions exists and is included in the .openclaw state symlink setup in the Docker image.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
nemoclaw-blueprint/policies/presets/local-inference.yaml	Adds additional allowed binaries for the local inference network policy preset.
Dockerfile	Creates/chowns the extensions state dir and includes it in the symlink migration/creation loop.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The preset adds /usr/local/bin/node but not /usr/bin/node (or a node* glob). Other presets (e.g., nemoclaw-blueprint/policies/presets/npm.yaml:27-33) allow both locations, and Debian/alternative Node installs may place node under /usr/bin. To avoid the local-inference preset still returning 403 for node-based clients in those environments, include /usr/bin/node (or /usr/bin/node*).

Suggested change

	- { path: /usr/local/bin/node }
	- { path: /usr/local/bin/node }
	- { path: /usr/bin/node }

[Copilot]

This change makes sure /sandbox/.openclaw-data/extensions exists and then symlinks /sandbox/.openclaw/extensions to it (via the for-loop). If OpenClaw’s plugin installer requires the extensions base directory to be a non-symlink (as reported in #2203 / OpenClaw’s safe-path checks), this layout will still fail even after the target directory exists. Consider switching extensions to a real directory under /sandbox/.openclaw (and handling persistence another way), or updating the OpenClaw config/runtime to use a real directory path for extensions so openclaw plugins install succeeds.

[wscurran]

✨ Thanks for submitting this PR that proposes fixes for the local-inference binaries and extensions symlinks issues — these could help improve the overall functionality of NemoClaw.

---

Related open issues:

• #2203 [NemoClaw][All Platforms] openclaw plugins install fails inside sandbox: "Invalid extensions directory: base directory must be a real directory"
• #2199 [NemoClaw][All Platforms] local-inference policy preset missing Ollama ports 11434/11435 (403 from sandbox)

[prekshivyas]

Hey @BenediktSchackenberg, thanks for the work here — I want to flag a concern with the extensions part and suggest a path forward.

The extensions change doesn't fix #2203. Two reasons:

1. The symlink already exists. Dockerfile.base line 97 creates /sandbox/.openclaw-data/extensions and Dockerfile.base line 113 establishes ~/.openclaw/extensions -> .openclaw-data/extensions. The issue reporter's own ls output in #2203 confirms it:

   lrwxrwxrwx 1 root root 34 Apr 14 01:21 extensions -> /sandbox/.openclaw-data/extensions
   

   So when the for-loop runs on a current base image, the [ -L ... ] branch fires first and the change is a no-op.

2. Even if the symlink were missing, creating one doesn't help. #2203's root cause is OpenClaw's install-safe-path validator rejecting symlinks:

   const baseLstat = await fs.lstat(baseDir);
   if (!baseLstat.isDirectory() || baseLstat.isSymbolicLink()) {
     throw new Error(`Invalid ${params.boundaryLabel}: base directory must be a real directory`);
   }

   lstat reports on the link itself, so any symlink (valid or dangling) trips the isSymbolicLink() branch. Creating another symlink via the for-loop's else branch wouldn't pass the validator either.

The real fix likely needs a bind mount of .openclaw-data/extensions onto ~/.openclaw/extensions — passes the validator (isDirectory()=true, isSymbolicLink()=false) and preserves persistence. Alternative: patch the compiled install-safe-path.js locally, same pattern NemoClaw already uses for fetch-guard and exec-approvals. Untested — happy to dig in separately.

Proposal: drop the Dockerfile changes from this PR and keep it focused on #2199 (local-inference binary allowlist). That half is clean and can land immediately.

---

Review of the local-inference part:

• /usr/local/bin/node, /usr/bin/curl, /usr/bin/python3 — paths are correct for the base image (node:22-slim + apt-installed curl/python3). ✅
• /usr/local/bin/python3 — I don't see anything in Dockerfile.base or Dockerfile that installs python3 at this path. Is it intentional for a variant image or can it be dropped? A short comment either way would help future readers.
• No new trust surface — endpoints are already allow-listed in the same policy file, and this just aligns the binary allowlist with them.

---

Possible I'm missing context on the extensions side — if you've tested this branch and openclaw plugins install @openclaw/diagnostics-otel succeeds where main fails, please share the repro state and I'll re-check. Otherwise I'd suggest descoping this PR to just the yaml change.

[prekshivyas]

Long-term fix tracked in NVIDIA/OpenShell#925 — proposes provisioning ~/.openclaw/extensions as a pod-spec-level persistent volume so it's a real directory inside the container (passes OpenClaw's validator, preserves plugin persistence, no in-container CAP_SYS_ADMIN needed). Suggest keeping this PR scoped to the #2199 local-inference fix and handling the extensions symlink problem on the OpenShell side.

[BenediktSchackenberg]

Thanks for the analysis @prekshivyas — you're right that the extensions change was wrong. I've reverted the Dockerfile change in this PR. The OpenShell#925 approach (pod-spec-level persistent volume) is the correct fix for #2203.

PR #2295 is now scoped to just the local-inference binary fix (#2199).

[prekshivyas]

Review — scoped to current state (YAML-only, Dockerfile reverted)

Scope reduction was the right call. The local-inference binary fix is on the right track but has two open items before it can land.

1. Missing /usr/bin/node (blocking)

Every other preset in this repo that allows node includes both paths:

Preset	Paths
slack.yaml	/usr/local/bin/node, /usr/bin/node
discord.yaml	/usr/local/bin/node, /usr/bin/node
telegram.yaml	/usr/local/bin/node, /usr/bin/node
this PR	/usr/local/bin/node only

Copilot's inline comment flagged this too — it hasn't been addressed. Please add /usr/bin/node for consistency and to cover alternative Node install locations.

2. /usr/local/bin/python3 — dead path in current image (blocking)

Dockerfile.base installs python3 via apt (python3=3.11.2-1+b1) → goes to /usr/bin/python3. Nothing in the build chain puts a python3 at /usr/local/bin/python3. This entry is currently a no-op.

@prekshivyas already asked about this — if it's intentional for a variant image or user-installed venv scenario, a short inline comment in the YAML would help future readers. Otherwise drop it.

3. PR title is stale (non-blocking)

Title still references "extensions symlink" which was reverted. Suggest updating to something like:
fix: add curl/node/python3 to local-inference binary allowlist (#2199)

---

Once /usr/bin/node is added and the python3 path is clarified/dropped, this is good to go — the endpoint side of the policy was already correct, and the binary additions align with the paths in Dockerfile.base.

[BenediktSchackenberg]

Addressed all three points:

1. Added /usr/bin/node alongside /usr/local/bin/node — matches slack/discord/telegram preset pattern ✅
2. Replaced /usr/local/bin/python3 with /usr/bin/python3 (apt path from Dockerfile.base) and added inline comment explaining the origin ✅
3. Updated PR title to remove the stale 'extensions symlink' reference ✅

[prekshivyas]

Thanks for addressing the earlier feedback — /usr/bin/node added, /usr/local/bin/python3 → /usr/bin/python3, title fixed. One small bug in the latest push:

/usr/bin/python3 is duplicated. The last two lines of the diff:

- { path: /usr/bin/python3 }     # apt-installed python3 (Dockerfile.base: python3=3.11.2)
- { path: /usr/bin/python3 }

Same path twice. The uncommented second one should be removed.

Minor (non-blocking): the /usr/bin/node comment says "apt-installed", but node isn't apt-installed in this image — base is node:22-slim and the apt install list has no nodejs. The real reason to list /usr/bin/node is variant-image coverage. Suggested rewording:

- { path: /usr/bin/node }  # variant image fallback (default base uses /usr/local/bin/node)

Drop the duplicate and this is good to go.

[prekshivyas]

CI failure (checks job) is from a stale unit test, not a real regression:

FAIL  test/policies.test.ts > policies > loadPreset > local-inference preset restricts binaries to openclaw and claude
AssertionError: expected '# SPDX-FileCopyrightText...' not to contain '/usr/local/bin/node'

The test pins the old "openclaw + claude only" allowlist, but this PR's whole purpose is to add node/curl/python3 to that preset. The assertion and the test name both need updating — the name itself ("restricts binaries to openclaw and claude") is now a lie.

Quick fix: swap the not to contain → to contain for the three new binaries, rename the test to reflect the expanded allowlist.

Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

[ericksoa]

Almost there — one bug in the diff.

Blocking: duplicate /usr/bin/python3 entry

The last two lines are identical:

      - { path: /usr/bin/python3 }     # apt-installed python3 (Dockerfile.base: python3=3.11.2)
      - { path: /usr/bin/python3 }

Drop the duplicate.

Otherwise looks good

The 4 new binary paths (node x2, curl, python3) are the right additions for users testing Ollama with curl or Python/Node inference clients. The Dockerfile extensions symlink fix was correctly reverted in commit 2.

One line fix and this is ready.