fix(openclaw): disable EC2 metadata discovery

[ericksoa]

Summary

Force AWS_EC2_METADATA_DISABLED=true throughout OpenClaw image builds, gateway startup, child processes, and connected shells. OpenShell denies EC2 Instance Metadata Service access, so this durable sandbox invariant prevents an impossible credential-discovery path without disabling other AWS credential providers.

Changes

• Set the metadata-disable environment invariant before the first runtime-stage RUN in both OpenClaw Dockerfiles. The early stage-wide placement is intentional so every image-build command inherits it.
• Override inherited or wrapper-supplied false values during OpenClaw startup and persist the fixed export in the runtime shell environment.
• Add behavior and contract coverage for startup override, connected shells, idempotent root-mode generation, image ordering, and the unchanged Hermes boundary.
• Define cross-agent credential-discovery semantics: host-brokered providers own host credentials, while sandbox-direct providers admit only deliberate, reachable sources and disable impossible metadata probes.
• Document the OpenClaw provider scope and rebuild steps, plus why managed Hermes remains unaffected and how future direct providers must be reviewed and tested. Hermes code stays unchanged because the shipped image omits native Bedrock and its supported provider is host-brokered through inference.local.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent implementation, security, and docs reviews passed. Live OpenShell acceptance covered fresh startup, restart, gateway and connected-shell AWS_EC2_METADATA_DISABLED=true, no logged 169.254.169.254 probes, explicit IMDS denial, shared-profile resolution, and a successful inference turn. Rebuild uses the same tested image and entrypoint contract; the exact-head ubuntu-repo-cloud-openclaw target also passed.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Verification

• PR description includes the DCO sign-off declaration and every commit appears as Verified in GitHub
• Git hooks passed during commit and push, or npx prek run --from-ref main --to-ref HEAD passes
• Targeted tests pass for changed behavior
• Full npm test passes (broad runtime changes only)
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

---

Signed-off-by: Aaron Erickson aerickson@nvidia.com

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR sets AWS_EC2_METADATA_DISABLED=true in OpenClaw runtime images and startup paths, documents the invariant, and expands tests to verify the setting, its ordering, and the Hermes exclusions.

Changes

EC2 metadata disable enforcement

Layer / File(s)	Summary
Dockerfile ENV settings Dockerfile.base, Dockerfile	Adds ENV AWS_EC2_METADATA_DISABLED=true to both base and runtime images with explanatory comments.
Startup script exports scripts/nemoclaw-start.sh	Exports AWS_EC2_METADATA_DISABLED=true during entrypoint bootstrap after wrapper normalization, and includes it in generated /tmp/nemoclaw-proxy-env.sh for connect sessions.
Documentation of the invariant docs/reference/troubleshooting.mdx, docs/security/best-practices.mdx	Adds a troubleshooting subsection with upgrade/verification steps and security guidance describing the forced invariant, scope, and related credential-discovery rules.
Runner and hermes test coverage test/runner.test.ts, test/hermes-start.test.ts	Renames the test suite, asserts AWS_EC2_METADATA_DISABLED=true across Dockerfiles and start script ordering, and confirms Hermes images/env files exclude it.
Service-env test coverage test/service-env.test.ts	Adds bootstrap-snippet extraction and override test, extends proxy-env.sh assertions for the new export, and expands idempotency checks for chown calls, file permissions, and export counts.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• NVIDIA/NemoClaw#1121: Both PRs modify the shared sandbox entrypoint and proxy-environment script generation in scripts/nemoclaw-start.sh.
• NVIDIA/NemoClaw#2110: Both PRs update /tmp/nemoclaw-proxy-env.sh generation for openshell sandbox connect sessions.

Suggested reviewers: cv, jyaunches

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the main change: disabling EC2 metadata discovery for OpenClaw.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/openclaw-disable-imds

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in the fix/openclaw-disable... branch is 96%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	fix/openclaw-disable... c8368a0	+/-
nemoclaw/src/se...cret-scanner.ts	—	100%	—
nemoclaw/src/commands/slash.ts	—	100%	—
nemoclaw/src/li...bprocess-env.ts	—	100%	—
nemoclaw/src/bl...eprint/state.ts	—	98%	—
nemoclaw/src/onboard/config.ts	—	98%	—
nemoclaw/src/bl...int/snapshot.ts	—	97%	—
nemoclaw/src/bl...print/runner.ts	—	95%	—
nemoclaw/src/co...ration-state.ts	—	94%	—
nemoclaw/src/bl...ate-networks.ts	—	94%	—
nemoclaw/src/index.ts	—	94%	—

TypeScript / code-coverage/cli

The overall coverage in the fix/openclaw-disable... branch is 68%. Coverage data for the main branch is not yet available.

Show a code coverage summary of the most covered files.

File	main	fix/openclaw-disable... c8368a0	+/-
src/lib/shields...nsition-lock.ts	—	86%	—
src/lib/actions...dbox/rebuild.ts	—	80%	—
src/lib/actions...all/run-plan.ts	—	80%	—
src/lib/state/o...oard-session.ts	—	79%	—
src/lib/state/sandbox.ts	—	72%	—
src/lib/onboard/preflight.ts	—	69%	—
src/lib/shields/index.ts	—	67%	—
src/lib/onboard...er-gpu-patch.ts	—	59%	—
src/lib/actions...licy-channel.ts	—	58%	—
src/lib/onboard.ts	—	20%	—

---

_{Updated July 01, 2026 05:51 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-6096.docs.buildwithfern.com/nemoclaw

[github-actions]

E2E Advisor Recommendation

Required E2E: runtime-overrides, cloud-onboard, test-e2e-gateway-isolation
Optional E2E: full-e2e, sandbox-rlimits-connect, test-non-root-sandbox-smoke

Dispatch hint: runtime-overrides,cloud-onboard

Workflow run

Full advisor summary

E2E Recommendation Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E

• runtime-overrides (medium): Builds the current production Dockerfile and starts short-lived containers through the real NemoClaw ENTRYPOINT. This is the closest existing live job for catching Dockerfile/startup regressions caused by the new environment invariant.
• cloud-onboard (medium): Runs real hosted OpenClaw onboarding and sandbox readiness. The change affects the environment inherited by OpenClaw processes in the created sandbox, so a real onboarding flow should be merge-blocking.
• test-e2e-gateway-isolation (medium): Builds the production sandbox image and exercises gateway/sandbox isolation and entrypoint hardening. This PR changes a credential-discovery security boundary in the image/startup path, so the image hardening E2E should run.

Optional E2E

• full-e2e (medium): Useful broader confidence for the full install/onboard/sandbox/inference/CLI user flow, including connected assistant behavior, after changing OpenClaw sandbox runtime environment.
• sandbox-rlimits-connect (high): Explicit-only connect-session job that can provide adjacent confidence for the runtime shell environment path touched by write_runtime_shell_env, although it does not appear to assert the AWS metadata variable directly.
• test-non-root-sandbox-smoke (low): Good adjacent coverage for entrypoint setup under no-new-privileges/non-root execution after editing the startup script. Useful if the self-hosted PR workflow is available.

New E2E recommendations

• OpenClaw sandbox credential-discovery boundary (high): Existing E2E coverage builds and boots the image but does not appear to assert that AWS_EC2_METADATA_DISABLED=true is present in PID 1/gateway/agent child processes, cron or spawned subprocesses, and openshell/nemoclaw connect shells, nor that an AWS SDK IMDS probe to 169.254.169.254 is not attempted.
  • Suggested test: Add a focused live OpenClaw E2E that onboards a sandbox, runs printenv AWS_EC2_METADATA_DISABLED via sandbox exec and connect-session shell, launches a representative OpenClaw/Node child process, and verifies the value is true while no IMDS network request is attempted.

Dispatch hint

• Workflow: .github/workflows/e2e.yaml
• jobs input: runtime-overrides,cloud-onboard

[github-actions]

E2E Target Recommendation

Required E2E targets: ubuntu-repo-cloud-openclaw
Optional E2E targets: ubuntu-repo-docker-post-reboot-recovery

Dispatch required E2E targets:

• gh workflow run e2e.yaml --ref <pr-head-ref> --field targets=ubuntu-repo-cloud-openclaw

Workflow run

Full E2E target advisor summary

E2E Target Advisor

Base: origin/main
Head: HEAD
Confidence: high

Required E2E targets

• ubuntu-repo-cloud-openclaw: The PR changes the OpenClaw sandbox runtime image and entrypoint environment boundary by forcing AWS_EC2_METADATA_DISABLED in Dockerfile, Dockerfile.base, and scripts/nemoclaw-start.sh. The Ubuntu cloud OpenClaw typed target is the smallest live-supported registry target that builds/uses the repo OpenClaw sandbox image, runs onboarding, starts the sandbox, and validates core runtime behavior.
  • Dispatch: gh workflow run e2e.yaml --ref <pr-head-ref> --field targets=ubuntu-repo-cloud-openclaw

Optional E2E targets

• ubuntu-repo-docker-post-reboot-recovery: Optional adjacent OpenClaw coverage for the same repo Docker runtime after a lifecycle interruption. Useful if reviewers want extra confidence that the startup/runtime environment invariant remains intact across recovery-style container state changes.
  • Dispatch: gh workflow run e2e.yaml --ref <pr-head-ref> --field targets=ubuntu-repo-docker-post-reboot-recovery

Relevant changed files

• Dockerfile
• Dockerfile.base
• scripts/nemoclaw-start.sh

[github-actions]

PR Review Advisor — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Add or justify PRA-T1 and any related test follow-ups.
Open items: 0 required · 0 warnings · 0 suggestions · 4 test follow-ups
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Action checklist

• PRA-T1 Add or justify test follow-up: Runtime validation
• PRA-T2 Add or justify test follow-up: Runtime validation
• PRA-T3 Add or justify test follow-up: Runtime validation
• PRA-T4 Add or justify test follow-up: Runtime validation

Test follow-ups to resolve or justify

If these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.

• PRA-T1 Runtime validation — Validate in a real OpenClaw sandbox that `printenv AWS_EC2_METADATA_DISABLED` returns `true` from the startup child process environment.. The local static and shell-snippet tests are focused and cover the changed invariant, but Dockerfile/startup/sandbox behavior is ultimately runtime infrastructure. A live sandbox check would increase confidence that real OpenClaw gateway, child, cron, and connect-shell processes all inherit the value.
• PRA-T2 Runtime validation — Validate in a real `openshell sandbox connect` shell that sourcing `/tmp/nemoclaw-proxy-env.sh` overrides a pre-set `AWS_EC2_METADATA_DISABLED=false` to `true`.. The local static and shell-snippet tests are focused and cover the changed invariant, but Dockerfile/startup/sandbox behavior is ultimately runtime infrastructure. A live sandbox check would increase confidence that real OpenClaw gateway, child, cron, and connect-shell processes all inherit the value.
• PRA-T3 Runtime validation — Validate an OpenClaw gateway-spawned cron or subprocess observes `AWS_EC2_METADATA_DISABLED=true`.. The local static and shell-snippet tests are focused and cover the changed invariant, but Dockerfile/startup/sandbox behavior is ultimately runtime infrastructure. A live sandbox check would increase confidence that real OpenClaw gateway, child, cron, and connect-shell processes all inherit the value.
• PRA-T4 Runtime validation — Validate AWS shared-profile or static credential resolution still works while no sandbox log records a `169.254.169.254` IMDS probe during an inference turn.. The local static and shell-snippet tests are focused and cover the changed invariant, but Dockerfile/startup/sandbox behavior is ultimately runtime infrastructure. A live sandbox check would increase confidence that real OpenClaw gateway, child, cron, and connect-shell processes all inherit the value.

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

[github-actions]

PR Review Advisor (Nemotron Ultra) — No blocking findings

Merge posture: No blocking advisor findings
Primary next action: Consider PRA-1: Base image ENV AWS_EC2_METADATA_DISABLED=true placed before first RUN.
Open items: 0 required · 0 warnings · 7 suggestions · 0 test follow-ups
Since last review: 0 prior items resolved · 0 still apply · 0 new items found

Action checklist

• PRA-1 In-scope improvement: Base image ENV AWS_EC2_METADATA_DISABLED=true placed before first RUN in Dockerfile.base:54
• PRA-2 In-scope improvement: Runtime image Stage 3 ENV AWS_EC2_METADATA_DISABLED=true before hardening RUN in Dockerfile:44
• PRA-3 In-scope improvement: Early export AWS_EC2_METADATA_DISABLED=true after self-wrapper normalization in scripts/nemoclaw-start.sh:237
• PRA-4 In-scope improvement: proxy-env.sh generation includes export AWS_EC2_METADATA_DISABLED="true" for connect shells in scripts/nemoclaw-start.sh:2894
• PRA-5 In-scope improvement: Tests verify Hermes agent correctly excluded from IMDS disable in test/runner.test.ts:955
• PRA-6 In-scope improvement: Troubleshooting section documents IMDS invariant and verification steps in docs/reference/troubleshooting.mdx:845
• PRA-7 In-scope improvement: Credential Discovery Boundaries section defines cross-agent security principle in docs/security/best-practices.mdx:112

Findings index

ID	Severity	Category	Location	Required action
PRA-1	Improvement	security	Dockerfile.base:54	No change needed — correct placement verified by test/runner.test.ts:937-948
PRA-2	Improvement	security	Dockerfile:44	No change needed — correct placement verified by test/runner.test.ts:937-948
PRA-3	Improvement	security	scripts/nemoclaw-start.sh:237	No change needed — placement verified by test/service-env.test.ts:72-90
PRA-4	Improvement	security	scripts/nemoclaw-start.sh:2894	No change needed — verified by test/service-env.test.ts:620 and 662
PRA-5	Improvement	security	test/runner.test.ts:955	No change needed — correct boundary enforcement
PRA-6	Improvement	docs	docs/reference/troubleshooting.mdx:845	No change needed — accurate and complete
PRA-7	Improvement	docs	docs/security/best-practices.mdx:112	No change needed — comprehensive and accurate

Review findings by urgency: 0 required fixes, 0 items to resolve/justify, 7 in-scope improvements

⚠️ Resolve or justify before merge

Investigate these in the current review; either fix them, explain why they are not applicable, or document the accepted risk.

• None.

💡 In-scope improvements

These are lower-risk, not throwaway. Prefer fixing them in this PR when they are local to changed code; defer only with rationale or a linked follow-up.

PRA-1 Improvement — Base image ENV AWS_EC2_METADATA_DISABLED=true placed before first RUN

• Location: Dockerfile.base:54
• Category: security
• Problem: ENV appears immediately after FROM and before apt-get install, ensuring all build layers and final image inherit the IMDS-disabled invariant
• Impact: Prevents EC2 instance-role credential discovery during image build and in all derived runtime processes
• Suggested action: No change needed — correct placement verified by test/runner.test.ts:937-948
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check Dockerfile.base line 54 — ENV appears before RUN apt-get update
• Missing regression test: Covered by test/runner.test.ts:937-948 which verifies ENV appears after FROM and before first RUN in both base and runtime stages
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: Dockerfile.base:54 ENV AWS_EC2_METADATA_DISABLED=true; runner.test.ts:937-948 index position checks

PRA-2 Improvement — Runtime image Stage 3 ENV AWS_EC2_METADATA_DISABLED=true before hardening RUN

• Location: Dockerfile:44
• Category: security
• Problem: ENV placed after ARG declarations and before the first RUN in Stage 3, ensuring the invariant holds for the runtime image build and all downstream layers
• Impact: Ensures stale GHCR base images that lack the ENV still converge with the invariant before any runtime commands execute
• Suggested action: No change needed — correct placement verified by test/runner.test.ts:937-948
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check Dockerfile line 44 — ENV appears before the hardening RUN block
• Missing regression test: Covered by test/runner.test.ts:937-948 which checks index positions in Stage 3
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: Dockerfile:44 ENV AWS_EC2_METADATA_DISABLED=true; runner.test.ts:937-948 runtime stage index checks

PRA-3 Improvement — Early export AWS_EC2_METADATA_DISABLED=true after self-wrapper normalization

• Location: scripts/nemoclaw-start.sh:237
• Category: security
• Problem: Export occurs after the sandbox-create bootstrap wrapper normalization, overriding any injected or inherited false values before any OpenClaw process launches
• Impact: Defeats the bootstrap wrapper injection path (which passes env AWS_EC2_METADATA_DISABLED=false) that onboard uses to launch the sandbox
• Suggested action: No change needed — placement verified by test/service-env.test.ts:72-90
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check scripts/nemoclaw-start.sh line 237 — export appears after self-wrapper handling and before any OpenClaw process launch
• Missing regression test: Covered by test/service-env.test.ts:72-90 which simulates the bootstrap wrapper with false value and verifies override to true
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: nemoclaw-start.sh:237 export AWS_EC2_METADATA_DISABLED=true; service-env.test.ts:72-90 bootstrap override test

PRA-4 Improvement — proxy-env.sh generation includes export AWS_EC2_METADATA_DISABLED="true" for connect shells

• Location: scripts/nemoclaw-start.sh:2894
• Category: security
• Problem: The write_runtime_shell_env function emits the export in the heredoc, ensuring every `openshell sandbox connect` session sources the invariant
• Impact: Protects interactive connect-shell sessions from ambient or inherited false values
• Suggested action: No change needed — verified by test/service-env.test.ts:620 and 662
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check scripts/nemoclaw-start.sh write_runtime_shell_env() function — AWS_EC2_METADATA_DISABLED appears in the heredoc
• Missing regression test: Covered by test/service-env.test.ts:620 (content check) and 662 (connect-shell override test)
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: nemoclaw-start.sh:2894 export AWS_EC2_METADATA_DISABLED="true"; service-env.test.ts:620,662

PRA-5 Improvement — Tests verify Hermes agent correctly excluded from IMDS disable

• Location: test/runner.test.ts:955
• Category: security
• Problem: Test asserts Hermes Dockerfile.base, Dockerfile, and start.sh do not contain AWS_EC2_METADATA_DISABLED, confirming architectural separation
• Impact: Ensures Hermes (which uses host-brokered Bedrock via inference.local) is not affected by the OpenClaw-specific invariant
• Suggested action: No change needed — correct boundary enforcement
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check test/runner.test.ts lines 955-957 and test/hermes-start.test.ts:808
• Missing regression test: Covered by test/runner.test.ts:955-957 and test/hermes-start.test.ts:808
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: runner.test.ts:955-957 expect(...).not.toContain; hermes-start.test.ts:808

PRA-6 Improvement — Troubleshooting section documents IMDS invariant and verification steps

• Location: docs/reference/troubleshooting.mdx:845
• Category: docs
• Problem: User-facing guidance explains the invariant, shows printenv verification command, and clarifies which credential types remain available
• Impact: Operators can verify the sandbox invariant and understand what is/isn't affected
• Suggested action: No change needed — accurate and complete
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Read docs/reference/troubleshooting.mdx lines 845-865
• Missing regression test: Documentation review — no automated test needed
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: troubleshooting.mdx:845-865 AgentOnly variant openclaw section

PRA-7 Improvement — Credential Discovery Boundaries section defines cross-agent security principle

• Location: docs/security/best-practices.mdx:112
• Category: docs
• Problem: Decision table and execution path rules establish that credential probes are active network behavior; impossible metadata sources must be disabled at SDK level, not papered over with network policy
• Impact: Provides authoritative reference for future provider integrations and security reviews
• Suggested action: No change needed — comprehensive and accurate
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Read docs/security/best-practices.mdx lines 112-160
• Missing regression test: Documentation review — no automated test needed
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: best-practices.mdx:112-160 Credential Discovery Boundaries + OpenClaw/Hermes variants

Since last review details

Current findings, using the urgency labels above:

PRA-1 Improvement — Base image ENV AWS_EC2_METADATA_DISABLED=true placed before first RUN

• Location: Dockerfile.base:54
• Category: security
• Problem: ENV appears immediately after FROM and before apt-get install, ensuring all build layers and final image inherit the IMDS-disabled invariant
• Impact: Prevents EC2 instance-role credential discovery during image build and in all derived runtime processes
• Suggested action: No change needed — correct placement verified by test/runner.test.ts:937-948
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check Dockerfile.base line 54 — ENV appears before RUN apt-get update
• Missing regression test: Covered by test/runner.test.ts:937-948 which verifies ENV appears after FROM and before first RUN in both base and runtime stages
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: Dockerfile.base:54 ENV AWS_EC2_METADATA_DISABLED=true; runner.test.ts:937-948 index position checks

PRA-2 Improvement — Runtime image Stage 3 ENV AWS_EC2_METADATA_DISABLED=true before hardening RUN

• Location: Dockerfile:44
• Category: security
• Problem: ENV placed after ARG declarations and before the first RUN in Stage 3, ensuring the invariant holds for the runtime image build and all downstream layers
• Impact: Ensures stale GHCR base images that lack the ENV still converge with the invariant before any runtime commands execute
• Suggested action: No change needed — correct placement verified by test/runner.test.ts:937-948
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check Dockerfile line 44 — ENV appears before the hardening RUN block
• Missing regression test: Covered by test/runner.test.ts:937-948 which checks index positions in Stage 3
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: Dockerfile:44 ENV AWS_EC2_METADATA_DISABLED=true; runner.test.ts:937-948 runtime stage index checks

PRA-3 Improvement — Early export AWS_EC2_METADATA_DISABLED=true after self-wrapper normalization

• Location: scripts/nemoclaw-start.sh:237
• Category: security
• Problem: Export occurs after the sandbox-create bootstrap wrapper normalization, overriding any injected or inherited false values before any OpenClaw process launches
• Impact: Defeats the bootstrap wrapper injection path (which passes env AWS_EC2_METADATA_DISABLED=false) that onboard uses to launch the sandbox
• Suggested action: No change needed — placement verified by test/service-env.test.ts:72-90
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check scripts/nemoclaw-start.sh line 237 — export appears after self-wrapper handling and before any OpenClaw process launch
• Missing regression test: Covered by test/service-env.test.ts:72-90 which simulates the bootstrap wrapper with false value and verifies override to true
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: nemoclaw-start.sh:237 export AWS_EC2_METADATA_DISABLED=true; service-env.test.ts:72-90 bootstrap override test

PRA-4 Improvement — proxy-env.sh generation includes export AWS_EC2_METADATA_DISABLED="true" for connect shells

• Location: scripts/nemoclaw-start.sh:2894
• Category: security
• Problem: The write_runtime_shell_env function emits the export in the heredoc, ensuring every `openshell sandbox connect` session sources the invariant
• Impact: Protects interactive connect-shell sessions from ambient or inherited false values
• Suggested action: No change needed — verified by test/service-env.test.ts:620 and 662
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check scripts/nemoclaw-start.sh write_runtime_shell_env() function — AWS_EC2_METADATA_DISABLED appears in the heredoc
• Missing regression test: Covered by test/service-env.test.ts:620 (content check) and 662 (connect-shell override test)
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: nemoclaw-start.sh:2894 export AWS_EC2_METADATA_DISABLED="true"; service-env.test.ts:620,662

PRA-5 Improvement — Tests verify Hermes agent correctly excluded from IMDS disable

• Location: test/runner.test.ts:955
• Category: security
• Problem: Test asserts Hermes Dockerfile.base, Dockerfile, and start.sh do not contain AWS_EC2_METADATA_DISABLED, confirming architectural separation
• Impact: Ensures Hermes (which uses host-brokered Bedrock via inference.local) is not affected by the OpenClaw-specific invariant
• Suggested action: No change needed — correct boundary enforcement
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Check test/runner.test.ts lines 955-957 and test/hermes-start.test.ts:808
• Missing regression test: Covered by test/runner.test.ts:955-957 and test/hermes-start.test.ts:808
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: runner.test.ts:955-957 expect(...).not.toContain; hermes-start.test.ts:808

PRA-6 Improvement — Troubleshooting section documents IMDS invariant and verification steps

• Location: docs/reference/troubleshooting.mdx:845
• Category: docs
• Problem: User-facing guidance explains the invariant, shows printenv verification command, and clarifies which credential types remain available
• Impact: Operators can verify the sandbox invariant and understand what is/isn't affected
• Suggested action: No change needed — accurate and complete
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Read docs/reference/troubleshooting.mdx lines 845-865
• Missing regression test: Documentation review — no automated test needed
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: troubleshooting.mdx:845-865 AgentOnly variant openclaw section

PRA-7 Improvement — Credential Discovery Boundaries section defines cross-agent security principle

• Location: docs/security/best-practices.mdx:112
• Category: docs
• Problem: Decision table and execution path rules establish that credential probes are active network behavior; impossible metadata sources must be disabled at SDK level, not papered over with network policy
• Impact: Provides authoritative reference for future provider integrations and security reviews
• Suggested action: No change needed — comprehensive and accurate
• Expected follow-up: Prefer a current-PR fix when local to changed code; defer only with rationale or linked follow-up.
• Verification: Read docs/security/best-practices.mdx lines 112-160
• Missing regression test: Documentation review — no automated test needed
• Done when: The local improvement is applied, or the PR notes why it should be deferred.
• Evidence: best-practices.mdx:112-160 Credential Discovery Boundaries + OpenClaw/Hermes variants

Workflow run details

This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

test/runner.test.ts (1)

949-956: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Ordering check relies on source-text/position lock-in rather than observed behavior.

This check verifies relative string positions in nemoclaw-start.sh rather than executing the script and observing the resulting environment value. test/service-env.test.ts (lines 69-96) already proves the override behavior end-to-end by executing an extracted snippet and asserting on stdout. Consider whether the positional check here adds enough value over that behavioral test to justify the source-text coupling, since any future reformatting of the script (even if behavior is unchanged) could break this assertion.

As per path instructions for test files, prefer observable outcomes through the public boundary over source-text assertions.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/runner.test.ts` around lines 949 - 956, The assertion in runner.test.ts
is coupled to the literal ordering of strings in the start script instead of
verifying behavior. Update the test around the AWS_EC2_METADATA_DISABLED checks
to validate the observed environment outcome through the same executable/public
boundary used in test/service-env.test.ts, and remove the index-based
source-position assertions tied to NEMOCLAW_CMD and OPENCLAW.

Source: Path instructions

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@test/runner.test.ts`:
- Around line 939-948: The test in runner.test.ts currently uses
runtimeSrc.indexOf("# Stage 3: Runtime image") as the stage anchor, which can
silently fall back to the start of the file if the marker is missing. Add an
explicit assertion that the runtime stage marker exists before computing
fromIndex, and use the same marker in the loop that checks the ordering of FROM,
RUN, and ENV AWS_EC2_METADATA_DISABLED=true so the assertion fails loudly
instead of validating the wrong stage.

---

Nitpick comments:
In `@test/runner.test.ts`:
- Around line 949-956: The assertion in runner.test.ts is coupled to the literal
ordering of strings in the start script instead of verifying behavior. Update
the test around the AWS_EC2_METADATA_DISABLED checks to validate the observed
environment outcome through the same executable/public boundary used in
test/service-env.test.ts, and remove the index-based source-position assertions
tied to NEMOCLAW_CMD and OPENCLAW.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 7de3317d-2e27-4dad-a039-7a007c1dd37d

📥 Commits

Reviewing files that changed from the base of the PR and between e4b9111 and 6488b70.

📒 Files selected for processing (8)

• Dockerfile
• Dockerfile.base
• docs/reference/troubleshooting.mdx
• docs/security/best-practices.mdx
• scripts/nemoclaw-start.sh
• test/hermes-start.test.ts
• test/runner.test.ts
• test/service-env.test.ts

[github-actions]

Vitest E2E Target Results — ✅ All selected jobs passed

Run: 28496607030
Workflow ref: fix/openclaw-disable-imds
Requested targets: ubuntu-repo-cloud-openclaw
Requested jobs: (default — all default-enabled free-standing jobs; explicit-only jobs openshell-gateway-auth-contract, jetson-nvmap-gpu, and sandbox-rlimits-connect are skipped unless selected)
Summary: 1 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
live	✅ success

[github-actions]

Vitest E2E Target Results — ✅ All requested jobs passed

Run: 28550876803
Workflow ref: fix/openclaw-disable-imds
Requested targets: (default — all supported)
Requested jobs: runtime-overrides,cloud-onboard
Summary: 2 passed, 0 failed, 0 cancelled, 0 skipped

Job	Result
cloud-onboard	✅ success
runtime-overrides	✅ success