feat: add OpenClaw AI assistant stack - #695
Conversation
📝 WalkthroughWalkthroughAdds the OpenClaw stack with version metadata, an OpenShift-compatible gateway Devfile, persistent storage, Control UI configuration, operator commands, ownership rules, and an ODOV3 test exclusion. ChangesOpenClaw stack
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant GatewayContainer
participant PersistentVolume
participant ControlUI
GatewayContainer->>PersistentVolume: Read or write gateway token and state
GatewayContainer->>GatewayContainer: Configure and start OpenClaw gateway
ControlUI->>GatewayContainer: Request HTTPS Control UI on port 18789
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@stacks/openclaw/1.0.0/devfile.yaml`:
- Around line 136-141: Update the restart-gateway command so it signals the
running node process rather than PID 1, preventing the openclaw container from
terminating. Ensure the startup flow keeps node under a while-true restart loop
so the process restarts in place while the container remains running.
- Line 75: Update the TOKEN generation command to read at least 48 bytes from
/dev/urandom before base64 encoding and filtering, so the final head -c 48
operation can produce the requested 48-character alphanumeric token.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 088de722-d9a2-4bfc-8a1f-b7de97dfab60
📒 Files selected for processing (4)
.github/CODEOWNERSstacks/openclaw/1.0.0/devfile.yamlstacks/openclaw/stack.yamltests/check_odov3.sh
23567a4 to
cd77f7f
Compare
michael-valdron
left a comment
michael-valdron
left a comment
There was a problem hiding this comment.
/lgtm
Was able to launch the OpenClaw AI stack from my devfile registry build/deployment into DevSpaces.
|
/needs-rebase |
Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>
Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>
Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>
Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>
Co-authored-by: Ilya Buziuk <ibuziuk@redhat.com> Signed-off-by: Oleksii Kurinnyi <okurinny@redhat.com>
cd77f7f to
f65d47a
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
stacks/openclaw/1.0.0/devfile.yaml (1)
136-140: 🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy liftUse a container-aware gateway restart.
The Gateway is launched as a foreground process at Line 89, not an installed OpenClaw service.
gateway stoptherefore cannot reliably stop it; its error is suppressed, thenopenclaw gatewaycan collide with the existing listener on port 18789. Use a supervisor-managed restart mechanism, or remove this command and instruct users to restart the workspace. OpenClaw documentsgateway stopfor managed services and foreground shutdown via process interruption. (docs.openclaw.ai)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@stacks/openclaw/1.0.0/devfile.yaml` around lines 136 - 140, Update the restart-gateway exec command to use a container-aware, supervisor-managed restart for the foreground Gateway process instead of invoking openclaw gateway stop; alternatively remove this command and direct users to restart the workspace. Do not suppress shutdown failures or launch a second gateway that could conflict on port 18789.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@stacks/openclaw/1.0.0/devfile.yaml`:
- Around line 75-81: Remove the gateway token output from the token-generation
block after writing it to TOKEN_FILE, including the echo that prints ${TOKEN}
and any surrounding banner intended only to display it. Preserve secure file
creation and the existing show-token retrieval path.
- Line 86: Update the OpenClaw Control UI configuration command to replace the
wildcard allowedOrigins value with the deployment’s concrete HTTPS origin or an
explicitly workspace-supplied allowlist, preserving the existing configuration
flow and fallback behavior.
---
Duplicate comments:
In `@stacks/openclaw/1.0.0/devfile.yaml`:
- Around line 136-140: Update the restart-gateway exec command to use a
container-aware, supervisor-managed restart for the foreground Gateway process
instead of invoking openclaw gateway stop; alternatively remove this command and
direct users to restart the workspace. Do not suppress shutdown failures or
launch a second gateway that could conflict on port 18789.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: f4c91d99-a176-4914-9233-ab55dfe5cf47
📒 Files selected for processing (4)
.github/CODEOWNERSstacks/openclaw/1.0.0/devfile.yamlstacks/openclaw/stack.yamltests/check_odov3.sh
🚧 Files skipped from review as they are similar to previous changes (2)
- stacks/openclaw/stack.yaml
- .github/CODEOWNERS
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: akurinnoy, ibuziuk, michael-valdron The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
3 participants
Description of Changes
Adds an OpenClaw AI assistant stack to the devfile registry.
OpenClaw is a personal AI assistant that runs a Gateway service with a web Control UI and connects to 25+ messaging channels (WhatsApp, Telegram, Slack, Discord, etc.). TypeScript/Node.js, MIT license, 383K+ GitHub stars.
The stack follows the same two-container pattern as the existing AI agent stacks (
hermes,picoclaw,zeroclaw):toolscontainer - universal developer image for editor/terminalopenclawcontainer - runs the Gateway service on port 18789Key design decisions:
/opt/dataviaOPENCLAW_CONFIG_DIRto handle OpenShift arbitrary UIDs (the official image uses uid 1000 with 700-permission dirs)gateway.trustedProxiesset to RFC 1918 ranges so connections through the cluster network are treated as localcookiesAuthEnabled: trueon the Control UI endpointFirst boot flow:
show-tokencommand in the terminal to get the gateway tokensetupcommand to configure API keys and model providerRelated Issue(s)
None
Acceptance Criteria
Read the contributing guide and followed the stack structure conventions.
Schema validation passes. Stack skipped in odo v3 tests - the gateway requires onboarding before it can serve health checks within the 3-minute timeout.
No documentation updates needed.
Tested on CRC cluster with Dev Spaces. Gateway boots, Control UI accessible, WebSocket connection works after token + device pairing.
Tests Performed
bash tests/validate_devfile_schemas.sh- all stacks pass includingopenclawopenclawstackopenclawDevWorkspace from the custom registryreadystateHow To Test
openclawstackshow-tokencommand to get the gateway tokenNotes To Reviewer
docker.io/openclaw/openclaw:2026.7.1is the latest stable release, verified viaskopeogateway.auth.mode=noneapproach was tested but OpenClaw refuses to bind to non-loopback without auth - this is by designquay.iois deferred to a follow-up (same ashermes,picoclaw,zeroclaw)Summary by CodeRabbit