perf: node user build (-104s chown), merge RUN layers (-170s), plugin whitelist (-40s)

Dockerfile

@@ -1,85 +1,62 @@
-# OpenClaw on Hugging Face Spaces — 从源码构建（带计时）
-# 文档: https://huggingface.co/docs/hub/spaces-sdks-docker
-
+# OpenClaw on Hugging Face Spaces — 优化构建（v2）
+# 优化点：node 用户构建（消除 chown）、合并 RUN 层（减少层开销）
 FROM node:22-bookworm
 SHELL ["/bin/bash", "-c"]
 
-# ── Step 1: System dependencies ──────────────────────────────────────────────
-RUN echo "[build][step1] Installing system deps..." && START=$(date +%s) \
-  && apt-get update && apt-get install -y --no-install-recommends git ca-certificates curl python3 python3-pip \
+# ── Layer 1 (root): 系统依赖 + 工具（全部合并为一层）─────────────────────────
+RUN echo "[build][layer1] System deps + tools..." && START=$(date +%s) \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends git ca-certificates curl python3 python3-pip patch \
   && rm -rf /var/lib/apt/lists/* \
-  && echo "[build][step1] System deps: $(($(date +%s) - START))s"
-
-# ── Step 2: Python dependencies ──────────────────────────────────────────────
-RUN echo "[build][step2] Installing huggingface_hub..." && START=$(date +%s) \
   && pip3 install --no-cache-dir --break-system-packages huggingface_hub \
-  && echo "[build][step2] huggingface_hub: $(($(date +%s) - START))s"
-
-# ── Step 3: Node tooling ────────────────────────────────────────────────────
-RUN echo "[build][step3] Enabling corepack + bun..." && START=$(date +%s) \
   && corepack enable \
-  && curl -fsSL https://bun.sh/install | bash \
-  && echo "[build][step3] Corepack + Bun: $(($(date +%s) - START))s"
-ENV PATH="/root/.bun/bin:${PATH}"
+  && mkdir -p /app \
+  && chown node:node /app \
+  && mkdir -p /home/node/.openclaw/workspace /home/node/.openclaw/credentials \
+  && chown -R node:node /home/node \
+  && echo "[build][layer1] System deps + tools: $(($(date +%s) - START))s"
 
-# ── Step 4: Clone OpenClaw ───────────────────────────────────────────────────
+# ── 切换到 node 用户（后续所有操作都以 node 身份，无需 chown）───────────────
+USER node
+ENV HOME=/home/node
 WORKDIR /app
-RUN echo "[build][step4] Cloning OpenClaw..." && START=$(date +%s) \
-  && git clone --depth 1 https://github.com/openclaw/openclaw.git openclaw \
-  && echo "[build][step4] Git clone: $(($(date +%s) - START))s"
-WORKDIR /app/openclaw
 
-# ── Step 5: Apply patches ───────────────────────────────────────────────────
-COPY patches /app/patches
-RUN echo "[build][step5] Applying patches..." && START=$(date +%s) \
+# ── Layer 2 (node): Clone + Patch + Install + Build（合并为一层）─────────────
+COPY --chown=node:node patches /app/patches
+RUN echo "[build][layer2] Clone + install + build..." && START=$(date +%s) \
+  && git clone --depth 1 https://github.com/openclaw/openclaw.git openclaw \
+  && echo "[build] git clone: $(($(date +%s) - START))s" \
+  && cd openclaw \
   && if [ -f /app/patches/web-inbound-record-activity-after-body.patch ]; then \
-       patch -p1 < /app/patches/web-inbound-record-activity-after-body.patch; \
+       patch -p1 < /app/patches/web-inbound-record-activity-after-body.patch \
+       && echo "[build] patch applied"; \
      fi \
-  && echo "[build][step5] Patches: $(($(date +%s) - START))s"
-
-# ── Step 6: pnpm install ────────────────────────────────────────────────────
-RUN echo "[build][step6] pnpm install..." && START=$(date +%s) \
+  && T1=$(date +%s) \
   && pnpm install --frozen-lockfile \
-  && echo "[build][step6] pnpm install: $(($(date +%s) - START))s"
-
-# ── Step 7: pnpm build ──────────────────────────────────────────────────────
-RUN echo "[build][step7] pnpm build..." && START=$(date +%s) \
+  && echo "[build] pnpm install: $(($(date +%s) - T1))s" \
+  && T2=$(date +%s) \
   && pnpm build \
-  && echo "[build][step7] pnpm build: $(($(date +%s) - START))s"
-
-# ── Step 8: pnpm ui:build ───────────────────────────────────────────────────
-ENV OPENCLAW_PREFER_PNPM=1
-RUN echo "[build][step8] pnpm ui:build..." && START=$(date +%s) \
-  && pnpm ui:build \
-  && echo "[build][step8] pnpm ui:build: $(($(date +%s) - START))s"
-
-# ── Step 9: Verify build artifacts ──────────────────────────────────────────
-RUN echo "[build][step9] Verifying build artifacts..." \
-  && test -f dist/entry.js && echo "  OK dist/entry.js" \
-  && test -f dist/plugin-sdk/index.js && echo "  OK dist/plugin-sdk/index.js" \
-  && test -d extensions/telegram && echo "  OK extensions/telegram" \
-  && test -d extensions/whatsapp && echo "  OK extensions/whatsapp" \
-  && test -d dist/control-ui && echo "  OK dist/control-ui"
-
-# ── Step 10: Inject auto-token into Control UI ──────────────────────────────
+  && echo "[build] pnpm build: $(($(date +%s) - T2))s" \
+  && T3=$(date +%s) \
+  && OPENCLAW_PREFER_PNPM=1 pnpm ui:build \
+  && echo "[build] pnpm ui:build: $(($(date +%s) - T3))s" \
+  && test -f dist/entry.js && echo "[build] OK dist/entry.js" \
+  && test -f dist/plugin-sdk/index.js && echo "[build] OK dist/plugin-sdk/index.js" \
+  && test -d extensions/telegram && echo "[build] OK extensions/telegram" \
+  && test -d extensions/whatsapp && echo "[build] OK extensions/whatsapp" \
+  && test -d dist/control-ui && echo "[build] OK dist/control-ui" \
+  && mkdir -p /app/openclaw/empty-bundled-plugins \
+  && echo "[build][layer2] Total clone+install+build: $(($(date +%s) - START))s"
+
+# ── Layer 3 (node): Scripts + Config + Token 注入 ─────────────────────────────
 COPY --chown=node:node scripts /home/node/scripts
-RUN chmod +x /home/node/scripts/inject-token.sh && bash /home/node/scripts/inject-token.sh
+COPY --chown=node:node openclaw.json /home/node/scripts/openclaw.json.default
+RUN chmod +x /home/node/scripts/entrypoint.sh /home/node/scripts/sync_hf.py /home/node/scripts/inject-token.sh \
+  && OPENCLAW_APP_DIR=/app/openclaw bash /home/node/scripts/inject-token.sh
 
-# ── Step 11: Final setup ────────────────────────────────────────────────────
 ENV NODE_ENV=production
-RUN mkdir -p /app/openclaw/empty-bundled-plugins
 ENV OPENCLAW_BUNDLED_PLUGINS_DIR=/app/openclaw/empty-bundled-plugins
-RUN chown -R node:node /app
-
-RUN mkdir -p /home/node/.openclaw/workspace /home/node/.openclaw/credentials
-
-COPY --chown=node:node openclaw.json /home/node/scripts/openclaw.json.default
-RUN chmod +x /home/node/scripts/entrypoint.sh \
-  && chmod +x /home/node/scripts/sync_hf.py \
-  && chown -R node:node /home/node
-
-USER node
-ENV HOME=/home/node
+ENV OPENCLAW_PREFER_PNPM=1
 ENV PATH="/home/node/.local/bin:$PATH"
 WORKDIR /home/node
 

openclaw.json

@@ -38,6 +38,7 @@
     }
   },
   "plugins": {
+    "allow": ["telegram", "whatsapp"],
     "entries": {
       "telegram": {
         "enabled": true

scripts/sync_hf.py

@@ -351,8 +351,9 @@ class OpenClawFullSync:
             data["models"]["providers"].pop("gemini", None)
             data["agents"]["defaults"]["model"]["primary"] = "openrouter/stepfun/step-3.5-flash:free"
 
-            # Telegram plugin
+            # Plugin whitelist (only load telegram + whatsapp to speed up startup)
             data.setdefault("plugins", {}).setdefault("entries", {})
+            data["plugins"]["allow"] = ["telegram", "whatsapp"]
             if "telegram" not in data["plugins"]["entries"]:
                 data["plugins"]["entries"]["telegram"] = {"enabled": True}
             elif isinstance(data["plugins"]["entries"]["telegram"], dict):