Dockerfile

# ════════════════════════════════════════════════════════════════
# 🦞 HuggingClaw + 💻 JupyterLab Terminal
# ════════════════════════════════════════════════════════════════
# Port 7861 (exposed): Dashboard + reverse proxy
#   /          → HuggingClaw dashboard
#   /app/      → OpenClaw gateway (internal :7860)
#   /terminal/ → JupyterLab terminal (internal :8888)
# ════════════════════════════════════════════════════════════════

# ── Stage 1: Pull pre-built OpenClaw ──
ARG OPENCLAW_VERSION=latest
FROM ghcr.io/openclaw/openclaw:${OPENCLAW_VERSION} AS openclaw

# ── Stage 2: Runtime ──
FROM node:22-slim
ARG OPENCLAW_VERSION=latest
ARG DEV_MODE=false
ARG HUGGINGCLAW_FULL_SUDO=false
# DEV_MODE intentionally not baked into runtime ENV — defaults to unset so
# start.sh can auto-enable terminal when GATEWAY_TOKEN is present. Users can
# override by setting DEV_MODE=false as an HF Space Variable to opt out.

# Install system dependencies (+ optional JupyterLab deps in DEV_MODE)
RUN apt-get update && apt-get install -y --no-install-recommends \
    git \
    sudo \
    file \
    ca-certificates \
    jq \
    curl \
    dbus \
    dbus-x11 \
    dbus-daemon \
    libglib2.0-0 \
    procps \
    python3 \
    python3-pip \
    python3-venv \
    p7zip-full \
    chromium \
    libnss3 \
    libatk1.0-0 \
    libatk-bridge2.0-0 \
    libdrm2 \
    libgbm1 \
    libxcomposite1 \
    libxdamage1 \
    libxrandr2 \
    libxkbcommon0 \
    libx11-6 \
    libxext6 \
    libxfixes3 \
    libasound2 \
    fonts-dejavu-core \
    fonts-liberation \
    fonts-noto-color-emoji \
    fonts-freefont-ttf \
    fonts-ipafont-gothic \
    fonts-wqy-zenhei \
    xfonts-scalable \
    --no-install-recommends && \
    pip3 install --no-cache-dir --break-system-packages huggingface_hub hf_transfer && \
    rm -rf /var/lib/apt/lists/*

# Install JupyterLab at build time because start.sh can auto-enable the
# terminal at runtime when GATEWAY_TOKEN is present. If the dependency is only
# installed when the build arg DEV_MODE=true, the documented default path
# starts a terminal process that cannot import jupyterlab.
RUN pip3 install --no-cache-dir --break-system-packages \
      jupyterlab==4.5.7 \
      tornado==6.5.5 \
      ipywidgets==8.1.8

# Reuse existing node user (UID 1000). By default, allow passwordless
# package-manager commands only so runtime apt installs can be replayed after
# HF Space restarts without granting unrestricted root. Private Spaces can opt
# into full passwordless sudo either at build time (HUGGINGCLAW_FULL_SUDO=true
# build arg) OR at runtime (HUGGINGCLAW_FULL_SUDO=true env var), via the
# locked-down hc-apply-full-sudo helper below.
RUN mkdir -p /home/node/app /home/node/.openclaw && \
    chown -R 1000:1000 /home/node && \
    case "$(printf '%s' "${HUGGINGCLAW_FULL_SUDO}" | tr '[:upper:]' '[:lower:]')" in \
      1|true|yes|on) \
      printf '%s\n' \
        'node ALL=(root) NOPASSWD: ALL' \
        > /etc/sudoers.d/huggingclaw ;; \
      *) \
      printf '%s\n' \
        'Cmnd_Alias HUGGINGCLAW_APT = /usr/bin/apt, /usr/bin/apt-get, /usr/bin/dpkg' \
        'node ALL=(root) NOPASSWD: HUGGINGCLAW_APT, /usr/local/bin/hc-apply-full-sudo' \
        > /etc/sudoers.d/huggingclaw ;; \
    esac && \
    chmod 0440 /etc/sudoers.d/huggingclaw && \
    visudo -cf /etc/sudoers.d/huggingclaw

# Runtime full-sudo enablement helper.
# A non-root process cannot grant itself new privileges at runtime, so the image
# bakes in ONE root-owned, non-writable (by node) script that the sudoers rule
# above lets `node` invoke without a password. start.sh calls it when
# HUGGINGCLAW_FULL_SUDO=true is set as a runtime env var, so a single image can
# toggle full sudo per Space without rebuilding. The script is intentionally
# trivial and locked down: it only rewrites /etc/sudoers.d/huggingclaw to the
# unrestricted rule. Do NOT make it accept arguments or paths.
RUN printf '%s\n' \
      '#!/bin/sh' \
      'set -eu' \
      '# Locked full-sudo escalation hook (root-owned, not writable by node).' \
      '# Invoked only by start.sh when HUGGINGCLAW_FULL_SUDO=true.' \
      'umask 022' \
      'tmp="$(mktemp /etc/sudoers.d/huggingclaw.XXXXXX)"' \
      'printf "%s\n" "node ALL=(root) NOPASSWD: ALL" > "$tmp"' \
      'chmod 0440 "$tmp"' \
      '# Resolve visudo from the known locations (/usr/sbin on Debian/Ubuntu).' \
      'VISUDO=""; for c in /usr/sbin/visudo /sbin/visudo visudo; do' \
      '  command -v "$c" >/dev/null 2>&1 && { VISUDO="$c"; break; }' \
      'done' \
      'if [ -z "$VISUDO" ]; then' \
      '  rm -f "$tmp"' \
      '  echo "hc-apply-full-sudo: visudo not found; aborting." >&2' \
      '  exit 1' \
      'fi' \
      'if "$VISUDO" -cf "$tmp" >/dev/null 2>&1; then' \
      '  mv "$tmp" /etc/sudoers.d/huggingclaw' \
      'else' \
      '  rm -f "$tmp"' \
      '  echo "hc-apply-full-sudo: generated sudoers file failed validation; aborting." >&2' \
      '  exit 1' \
      'fi' \
      'echo "hc-apply-full-sudo: full passwordless sudo enabled." >&2' \
    > /usr/local/bin/hc-apply-full-sudo && \
    chmod 0755 /usr/local/bin/hc-apply-full-sudo && \
    chown root:root /usr/local/bin/hc-apply-full-sudo

# Copy pre-built OpenClaw (skips npm install entirely — much faster!)
COPY --from=openclaw --chown=1000:1000 /app /home/node/.openclaw/openclaw-app

# Add Playwright in an isolated sidecar node_modules
RUN mkdir -p /home/node/browser-deps && \
    cd /home/node/browser-deps && \
    npm init -y && \
    PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 npm install --omit=dev playwright@1.59.1

# Symlink openclaw CLI so it's available globally
RUN ln -s /home/node/.openclaw/openclaw-app/openclaw.mjs /usr/local/bin/openclaw 2>/dev/null || \
    npm install -g openclaw@${OPENCLAW_VERSION}

# Copy HuggingClaw files
COPY --chown=1000:1000 cloudflare-proxy.js /opt/cloudflare-proxy.js
COPY --chown=1000:1000 cloudflare-proxy-setup.py /home/node/app/cloudflare-proxy-setup.py
COPY --chown=1000:1000 health-server.js /home/node/app/health-server.js
COPY --chown=1000:1000 login.html /home/node/app/login.html
COPY --chown=1000:1000 iframe-fix.cjs /home/node/app/iframe-fix.cjs
COPY --chown=1000:1000 start.sh /home/node/app/start.sh
COPY --chown=1000:1000 wa-guardian.js /home/node/app/wa-guardian.js
COPY --chown=1000:1000 cloudflare-keepalive-setup.py /home/node/app/cloudflare-keepalive-setup.py
COPY --chown=1000:1000 openclaw-sync.py /home/node/app/openclaw-sync.py
COPY --chown=1000:1000 multi-provider-key-rotator.cjs /home/node/app/multi-provider-key-rotator.cjs
COPY --chown=1000:1000 env-builder.html /home/node/app/env-builder.html
COPY --chown=1000:1000 env-builder.js /home/node/app/env-builder.js
COPY --chown=1000:1000 key-rotator-manager.html /home/node/app/key-rotator-manager.html
COPY --chown=1000:1000 jupyter-devdata-sync.py /home/node/app/jupyter-devdata-sync.py
RUN python3 -c "from pathlib import Path; import shutil, jupyter_server; d=Path(jupyter_server.__file__).parent/'templates'; d.mkdir(parents=True,exist_ok=True); shutil.copyfile('/home/node/app/login.html', d/'login.html')"
RUN chmod +x /home/node/app/start.sh \
              /home/node/app/cloudflare-proxy-setup.py \
              /home/node/app/cloudflare-keepalive-setup.py \
              /home/node/app/openclaw-sync.py \
              /home/node/app/jupyter-devdata-sync.py \
              /home/node/app/multi-provider-key-rotator.cjs

USER node

ENV HOME=/home/node \
    OPENCLAW_VERSION=${OPENCLAW_VERSION} \
    HUGGINGCLAW_FULL_SUDO_BUILT=${HUGGINGCLAW_FULL_SUDO} \
    PIP_BREAK_SYSTEM_PACKAGES=1 \
    PYTHONUSERBASE=/home/node/.local \
    PATH=/home/node/.local/bin:/usr/local/bin:$PATH \
    NODE_PATH=/home/node/browser-deps/node_modules \
    NODE_OPTIONS="--require /opt/cloudflare-proxy.js"

WORKDIR /home/node/app

# 7861 = public entrypoint (dashboard + proxy for both OpenClaw and JupyterLab)
EXPOSE 7861

HEALTHCHECK --interval=30s --timeout=5s --start-period=90s \
  CMD curl -fsS http://localhost:7861/health || exit 1

CMD ["/home/node/app/start.sh"]