From 28ebd2018f6eabf10487bfe6e6ce8c140356fa19 Mon Sep 17 00:00:00 2001 From: Benedikt Schackenberg <6381261+BenediktSchackenberg@users.noreply.github.com> Date: Wed, 22 Apr 2026 19:20:24 +0000 Subject: [PATCH 1/4] fix: add curl/node/python3 to local-inference binaries and extensions symlink MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two fixes: 1. local-inference preset (fixes #2199): The local-inference policy preset only allowed openclaw and claude binaries to reach the Ollama endpoints. curl, node, and python3 were blocked, causing 403 when testing with curl or using Python/Node inference clients. Added common inference client binaries. 2. Dockerfile extensions symlink (fixes #2203): openclaw plugins install fails with 'Invalid extensions directory: base directory must be a real directory' because ~/.openclaw/extensions is a broken symlink — the /sandbox/.openclaw-data/extensions target directory is never created and the symlink is never added. Added extensions to the RUN block that creates .openclaw-data subdirectories and establishes the ~/.openclaw/extensions symlink, matching how logs/credentials/sandbox/media are handled. Signed-off-by: Benedikt Schackenberg <6381261+BenediktSchackenberg@users.noreply.github.com> --- Dockerfile | 4 +++- nemoclaw-blueprint/policies/presets/local-inference.yaml | 4 ++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 413b4ec852c..8a87228ad5b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -328,11 +328,13 @@ RUN mkdir -p /sandbox/.openclaw-data/logs \ /sandbox/.openclaw-data/credentials \ /sandbox/.openclaw-data/sandbox \ /sandbox/.openclaw-data/media \ + /sandbox/.openclaw-data/extensions \ && chown sandbox:sandbox /sandbox/.openclaw-data/logs \ /sandbox/.openclaw-data/credentials \ /sandbox/.openclaw-data/sandbox \ /sandbox/.openclaw-data/media \ - && for dir in logs credentials sandbox media; do \ + /sandbox/.openclaw-data/extensions \ + && for dir in logs credentials sandbox media extensions; do \ if [ -L "/sandbox/.openclaw/$dir" ]; then true; \ elif [ -e "/sandbox/.openclaw/$dir" ]; then \ cp -a "/sandbox/.openclaw/$dir/." "/sandbox/.openclaw-data/$dir/" 2>/dev/null || true; \ diff --git a/nemoclaw-blueprint/policies/presets/local-inference.yaml b/nemoclaw-blueprint/policies/presets/local-inference.yaml index f24cc44642b..51082650b45 100644 --- a/nemoclaw-blueprint/policies/presets/local-inference.yaml +++ b/nemoclaw-blueprint/policies/presets/local-inference.yaml @@ -33,3 +33,7 @@ network_policies: binaries: - { path: /usr/local/bin/openclaw } - { path: /usr/local/bin/claude } + - { path: /usr/local/bin/node } + - { path: /usr/bin/curl } + - { path: /usr/local/bin/python3 } + - { path: /usr/bin/python3 } From 7f0e8cf91568c5955a3b00855ed949cedbe1bd3c Mon Sep 17 00:00:00 2001 From: Benedikt Schackenberg <6381261+BenediktSchackenberg@users.noreply.github.com> Date: Thu, 23 Apr 2026 11:45:06 +0000 Subject: [PATCH 2/4] fix: remove incorrect extensions symlink from Dockerfile MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Dockerfile.base already creates /sandbox/.openclaw-data/extensions and the symlink ~/.openclaw/extensions. The fix in the previous commit was redundant and does not address the root cause of #2203 — which is that OpenClaw's validator expects a real directory, not a symlink. The extensions issue is being tracked in NVIDIA/OpenShell#925 for a pod-spec-level fix on the OpenShell side. PR #2295 is now scoped to the local-inference binary fix only (#2199). Signed-off-by: Benedikt Schackenberg <6381261+BenediktSchackenberg@users.noreply.github.com> --- Dockerfile | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index 8a87228ad5b..413b4ec852c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -328,13 +328,11 @@ RUN mkdir -p /sandbox/.openclaw-data/logs \ /sandbox/.openclaw-data/credentials \ /sandbox/.openclaw-data/sandbox \ /sandbox/.openclaw-data/media \ - /sandbox/.openclaw-data/extensions \ && chown sandbox:sandbox /sandbox/.openclaw-data/logs \ /sandbox/.openclaw-data/credentials \ /sandbox/.openclaw-data/sandbox \ /sandbox/.openclaw-data/media \ - /sandbox/.openclaw-data/extensions \ - && for dir in logs credentials sandbox media extensions; do \ + && for dir in logs credentials sandbox media; do \ if [ -L "/sandbox/.openclaw/$dir" ]; then true; \ elif [ -e "/sandbox/.openclaw/$dir" ]; then \ cp -a "/sandbox/.openclaw/$dir/." "/sandbox/.openclaw-data/$dir/" 2>/dev/null || true; \ From 4f169ab5044b7c8b55af31071ac51ad8abc6a741 Mon Sep 17 00:00:00 2001 From: Benedikt Schackenberg <6381261+BenediktSchackenberg@users.noreply.github.com> Date: Thu, 23 Apr 2026 16:58:39 +0000 Subject: [PATCH 3/4] fix(local-inference): add /usr/bin/node, use correct python3 path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add /usr/bin/node alongside /usr/local/bin/node for consistency with all other presets (slack, discord, telegram all include both paths) - Replace /usr/local/bin/python3 with /usr/bin/python3 — Dockerfile.base installs python3 via apt (python3=3.11.2-1+b1) which goes to /usr/bin/python3. /usr/local/bin/python3 is not present in the base image. - Added inline comments explaining each binary path's origin. Per @prekshivyas review on #2295. Signed-off-by: Benedikt Schackenberg <6381261+BenediktSchackenberg@users.noreply.github.com> --- nemoclaw-blueprint/policies/presets/local-inference.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nemoclaw-blueprint/policies/presets/local-inference.yaml b/nemoclaw-blueprint/policies/presets/local-inference.yaml index 51082650b45..0d1d64631fe 100644 --- a/nemoclaw-blueprint/policies/presets/local-inference.yaml +++ b/nemoclaw-blueprint/policies/presets/local-inference.yaml @@ -34,6 +34,7 @@ network_policies: - { path: /usr/local/bin/openclaw } - { path: /usr/local/bin/claude } - { path: /usr/local/bin/node } + - { path: /usr/bin/node } # alternative Node install path (apt-installed) - { path: /usr/bin/curl } - - { path: /usr/local/bin/python3 } + - { path: /usr/bin/python3 } # apt-installed python3 (Dockerfile.base: python3=3.11.2) - { path: /usr/bin/python3 } From 1ad758b3d72776ceb6f19340dcedd0742ec6fcd6 Mon Sep 17 00:00:00 2001 From: Aaron Erickson Date: Thu, 23 Apr 2026 20:31:02 -0700 Subject: [PATCH 4/4] fix: remove duplicate python3 binary entry Co-Authored-By: Claude Opus 4.6 (1M context) --- nemoclaw-blueprint/policies/presets/local-inference.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/nemoclaw-blueprint/policies/presets/local-inference.yaml b/nemoclaw-blueprint/policies/presets/local-inference.yaml index 0d1d64631fe..b3dedb32fe7 100644 --- a/nemoclaw-blueprint/policies/presets/local-inference.yaml +++ b/nemoclaw-blueprint/policies/presets/local-inference.yaml @@ -37,4 +37,3 @@ network_policies: - { path: /usr/bin/node } # alternative Node install path (apt-installed) - { path: /usr/bin/curl } - { path: /usr/bin/python3 } # apt-installed python3 (Dockerfile.base: python3=3.11.2) - - { path: /usr/bin/python3 }