backend/docker-configs/host-mount-setup.sh

#!/bin/bash
# Host mount setup script for Atom OpenClaw integration
#
# This script configures Docker volumes for host filesystem access
# with security warnings and governance verification.

set -e

echo "=================================="
echo "Atom Host Filesystem Mount Setup"
echo "OpenClaw Integration"
echo "=================================="
echo ""

# Security warning
echo "⚠️  SECURITY WARNING ⚠️"
echo ""
echo "This configuration gives Atom containers WRITE access to host directories."
echo ""
echo "Governance protections in place:"
echo "  ✓ AUTONOMOUS maturity gate required"
echo "  ✓ Command whitelist (ls, cat, grep, git, npm, etc.)"
echo "  ✓ Blocked commands (rm, mv, chmod, kill, sudo, etc.)"
echo "  ✓ 5-minute timeout enforcement"
echo "  ✓ Full audit trail to ShellSession table"
echo ""
echo "However, this STILL carries risk:"
echo "  - Bugs in governance code could bypass protections"
echo "  - Compromised AUTONOMOUS agent has shell access"
echo "  - Docker escape vulnerabilities could be exploited"
echo ""

read -p "Do you understand the risks and want to continue? (yes/no): " confirm

if [ "$confirm" != "yes" ]; then
    echo "Setup cancelled."
    exit 1
fi

echo ""
echo "Configuring host mounts..."
echo ""

# Detect user
CURRENT_USER=${USER:-$(whoami)}
echo "Detected user: $CURRENT_USER"

# Create .env file for host mount configuration
cat > backend/.env.host-mount <<EOF
# Host filesystem mount configuration
# Generated by host-mount-setup.sh

ATOM_HOST_MOUNT_ENABLED=true
ATOM_HOST_MOUNT_DIRS=/tmp:/Users/$CURRENT_USER/projects:/Users/$CURRENT_USER/Desktop:/Users/$CURRENT_USER/Documents

# Security
ATOM_HOST_MOUNT_GATES=autonomous_only,command_whitelist,timeout_enforcement,audit_trail
EOF

echo "Created backend/.env.host-mount"
echo ""

# Test Docker volume access
echo "Testing Docker volume access..."
if docker run --rm -v /Users/$CURRENT_USER/Desktop:/host/desktop:ro alpine ls /host/desktop > /dev/null 2>&1; then
    echo "✓ Docker volume access working"
else
    echo "✗ Docker volume access failed"
    echo ""
    echo "Troubleshooting:"
    echo "  1. Check Docker Desktop: Settings > Resources > File Sharing"
    echo "  2. Add /Users/$CURRENT_USER to shared directories"
    echo "  3. Restart Docker"
    exit 1
fi

echo ""
echo "=================================="
echo "Setup Complete!"
echo "=================================="
echo ""
echo "To start Atom with host mount:"
echo ""
echo "  docker-compose -f docker-compose.yml -f docker-compose.host-mount.yml up"
echo ""
echo "To verify mount is active:"
echo ""
echo "  docker exec \$(docker ps -q -f 'name=atom') ls /host/projects"
echo ""
echo "To disable host mount:"
echo ""
echo "  docker-compose -f docker-compose.yml up  # (omit host-mount file)"
echo ""