fix(sandbox): select gosu binary by target architecture

[cr7258]

Summary

The sandbox Dockerfile currently hardcodes the gosu-amd64 release asset.
That works on x86_64, but it can break arm64 sandbox builds with Exec format error when the image validates gosu --version.

This change selects the matching gosu binary from the container architecture reported by dpkg --print-architecture, while keeping the pinned 1.19 release and SHA256 verification.

Related Issue

Fixes #850

Changes

Type of Change

• Code change for a new feature, bug fix, or refactor.
• Code change with doc updates.
• Doc only. Prose changes without code sample modifications.
• Doc only. Includes code sample changes.

Testing

• npx prek run --all-files passes (or equivalently make check).
• npm test passes.
• make docs builds without warnings. (for doc-only changes)

docker build --no-cache --platform=linux/arm64 -t nemoclaw-gosu-fix-test .

.....
 => [stage-1  3/20] RUN arch="$(dpkg --print-architecture)"     && case "$arch" in         amd64) gosu_asset="gosu-amd64"; gosu_sha256="52c8749d0142edd234e9d6bd5237dff2d8  1.6s
 => [stage-1  4/20] RUN groupadd -r gateway && useradd -r -g gateway -d /sandbox -s /usr/sbin/nologin gateway     && groupadd -r sandbox && useradd -r -g sandbox -d /sand  0.4s
 => [stage-1  5/20] RUN mkdir -p /sandbox/.openclaw-data/agents/main/agent         /sandbox/.openclaw-data/extensions         /sandbox/.openclaw-data/workspace         /s  0.3s
 => [stage-1  6/20] RUN npm install -g openclaw@2026.3.11     && pip3 install --no-cache-dir --break-system-packages "pyyaml==6.0.3"                                       43.8s
 => [stage-1  7/20] COPY --from=builder /opt/nemoclaw/dist/ /opt/nemoclaw/dist/                                                                                             0.2s
 => [stage-1  8/20] COPY nemoclaw/openclaw.plugin.json /opt/nemoclaw/                                                                                                       0.2s
 => [stage-1  9/20] COPY nemoclaw/package.json /opt/nemoclaw/                                                                                                               0.1s
 => [stage-1 10/20] COPY nemoclaw-blueprint/ /opt/nemoclaw-blueprint/                                                                                                       0.2s
 => [stage-1 11/20] WORKDIR /opt/nemoclaw                                                                                                                                   0.1s
 => [stage-1 12/20] RUN npm install --omit=dev                                                                                                                             12.6s
 => [stage-1 13/20] RUN mkdir -p /sandbox/.nemoclaw/blueprints/0.1.0     && cp -r /opt/nemoclaw-blueprint/* /sandbox/.nemoclaw/blueprints/0.1.0/                            0.3s
 => [stage-1 14/20] COPY scripts/nemoclaw-start.sh /usr/local/bin/nemoclaw-start                                                                                            0.2s
 => [stage-1 15/20] RUN chmod +x /usr/local/bin/nemoclaw-start                                                                                                              0.3s
 => [stage-1 16/20] WORKDIR /sandbox                                                                                                                                        0.1s
 => [stage-1 17/20] RUN python3 -c "import base64, json, os, secrets; from urllib.parse import urlparse; model = os.environ['NEMOCLAW_MODEL']; chat_ui_url = os.environ['C  0.4s
 => [stage-1 18/20] RUN openclaw doctor --fix > /dev/null 2>&1 || true     && openclaw plugins install /opt/nemoclaw > /dev/null 2>&1 || true                               5.6s
 => [stage-1 19/20] RUN chown root:root /sandbox/.openclaw     && find /sandbox/.openclaw -mindepth 1 -maxdepth 1 -exec chown -h root:root {} +     && chmod 755 /sandbox/  2.8s
 => [stage-1 20/20] RUN sha256sum /sandbox/.openclaw/openclaw.json > /sandbox/.openclaw/.config-hash     && chmod 444 /sandbox/.openclaw/.config-hash     && chown root:ro  0.4s
 => exporting to image                                                                                                                                                      5.1s
 => => exporting layers                                                                                                                                                     5.0s
 => => writing image sha256:fdab73fe3324bd192450ae8bf2a4549b8b3c87812ff57d9da3d0c1829da15bba                                                                                0.0s
 => => naming to docker.io/library/nemoclaw-gosu-fix-test                                                                                                                   0.0s

Checklist

General

• I have read and followed the contributing guide.
• I have read and followed the style guide. (for doc-only changes)

Code Changes

• Formatters applied — npx prek run --all-files auto-fixes formatting (or make format for targeted runs).
• Tests added or updated for new or changed behavior.
• No secrets, API keys, or credentials committed.
• Doc pages updated for any user-facing behavior changes (new commands, changed defaults, new features, bug fixes that contradict existing docs).

Doc Changes

• Follows the style guide. Try running the update-docs agent skill to draft changes while complying with the style guide. For example, prompt your agent with "/update-docs catch up the docs for the new changes I made in this PR."
• New pages include SPDX license header and frontmatter, if creating a new page.
• Cross-references and links verified.

Summary by CodeRabbit

• Chores
  • Docker image build now selects and installs the correct gosu binary for amd64 and arm64, with matching checksum verification.
  • Build fails on unsupported CPU architectures to prevent incorrect binaries.
  • Added a CI job to build and tag arm64 production and sandbox images to ensure arm64 artifacts are produced.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: bbde72ae-b6ad-449b-a3de-48b6b661f65c

📥 Commits

Reviewing files that changed from the base of the PR and between 72e9f82 and 3e72b1d.

📒 Files selected for processing (1)

• .github/workflows/pr.yaml

---

📝 Walkthrough

Walkthrough

The Dockerfile's gosu installation now detects the container CPU architecture and downloads the matching gosu binary and SHA-256 checksum (amd64 or arm64), verifies and installs it to /usr/local/bin/gosu, and fails the build on unsupported architectures. A new GitHub Actions job builds arm64 images.

Changes

Cohort / File(s)	Summary
Architecture-Aware Binary Installation Dockerfile	Replaced hardcoded gosu-amd64 download with architecture detection (dpkg --print-architecture), conditional selection of gosu-amd64 or gosu-arm64 and matching SHA-256 checksums, explicit unsupported-arch error, preserved checksum verification, install path, permissions, and gosu --version check.
CI: arm64 image builds .github/workflows/pr.yaml	Added new job build-sandbox-images-arm64 running on ubuntu-24.04-arm that builds and tags production and sandbox Docker images for arm64 (nemoclaw-production-arm64, nemoclaw-sandbox-test-arm64). Not wired into downstream jobs or artifact flows.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Poem

🐰 I hopped into builds with a curious nose,
Picked amd or arm where the pipeline goes,
I fetched the right gosu, checked the sum,
Made sure the bits danced — not glum —
Now images sleep sound where each arch grows 🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	❓ Inconclusive	The Dockerfile change is squarely within scope for issue #850. However, the new GitHub Actions job build-sandbox-images-arm64 is not referenced in the linked issue and lacks integration with test jobs, making it potentially out of scope.	Clarify whether the new GitHub Actions job build-sandbox-images-arm64 is required for issue #850. If out of scope, consider removing it; if in scope, integrate it with test jobs via needs and artifact steps.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title directly and concisely describes the main change: selecting the gosu binary based on target architecture, which is the core fix addressing issue #850.
Linked Issues check	✅ Passed	The code changes in the Dockerfile implement the required fix by dynamically selecting gosu binary (amd64 or arm64) based on dpkg --print-architecture, directly addressing issue #850's objective to avoid Exec format errors on aarch64.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@Dockerfile`:
- Around line 29-36: The Dockerfile adds an arm64 case for gosu (arch="$(dpkg
--print-architecture)" and the case branch setting gosu_asset/gosu_sha256 for
arm64) but CI never builds an arm64 image; update the CI to exercise the arm64
path by adding an explicit arm64 build step (use docker buildx with QEMU
emulation or add an arm64 runner) that builds the image with --platform
linux/arm64 so the arm64 branch (the arm64 case and corresponding checksum) is
validated during PR builds.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4b43c420-c3eb-4e79-8547-0fc57f2f3885

📥 Commits

Reviewing files that changed from the base of the PR and between d23c4e2 and 72e9f82.

📒 Files selected for processing (1)

• Dockerfile