How to Run OpenClaw as Non-Root in Docker

# Dockerfile.nonroot
FROM openclaw/openclaw:2.4.1

# Create openclaw user and group
RUN groupadd --system --gid 1000 openclaw && \
    useradd --system --uid 1000 --gid openclaw --shell /bin/bash openclaw

# Create directories and set ownership
RUN mkdir -p /app/data /app/logs /app/.cache && \
    chown -R openclaw:openclaw /app

# Switch to non-root user
USER openclaw

CMD ["npm", "start"]

docker build -f Dockerfile.nonroot -t openclaw-nonroot:latest .

# docker-compose.yml
services:
  openclaw:
    image: openclaw-nonroot:latest
    user: "1000:1000"
    volumes:
      - ./data:/app/data
      - ./logs:/app/logs
    environment:
      - NODE_ENV=production

# On the Docker host:
sudo chown -R 1000:1000 ./data ./logs

# Or let Docker create them with correct ownership:
mkdir -p data logs
sudo chown 1000:1000 data logs

docker-compose up -d

# Check that process runs as UID 1000:
docker-compose exec openclaw id
# Output: uid=1000(openclaw) gid=1000(openclaw)

# Verify logs are written:
ls -la logs/
# Should show files owned by 1000:1000

# In soul.md or gateway config:
skill_restrictions:
  disabled_skills:
    - system-package-installer  # Requires apt/yum
    - docker-in-docker          # Requires socket access
  allowed_skills:
    - web-search
    - file-analyzer
    - code-review