# ============================================
# OpenClaw Dockerfile - 基礎版本
# 適用于開發(fā)環(huán)境和快速驗證
# ============================================

FROM node:20-alpine

# 設置工作目錄
WORKDIR /app

# 安裝系統(tǒng)依賴
RUN apk add --no-cache \
    python3 \
    py3-pip \
    git \
    curl \
    bash

# 安裝 OpenClaw
RUN npm install -g openclaw

# 創(chuàng)建數(shù)據(jù)目錄
RUN mkdir -p /data/openclaw /etc/openclaw

# 復制配置文件
COPY openclaw.yaml /etc/openclaw/openclaw.yaml

# 聲明端口
EXPOSE 18789

# 健康檢查
HEALTHCHECK --interval=30s --timeout=10s --retries=3 \
    CMD curl -f http://localhost:18789/health || exit 1

# 啟動 Gateway
CMD ["openclaw", "gateway", "start"]

# 構建鏡像
docker build -t openclaw:latest .

# 運行容器
docker run -d \
  --name openclaw-gateway \
  -p 18789:18789 \
  -v /data/openclaw:/data/openclaw \
  -v /etc/openclaw:/etc/openclaw \
  -e OPENAI_API_KEY="sk-xxx" \
  openclaw:latest

# 查看日志
docker logs -f openclaw-gateway

# 查看狀態(tài)
docker ps | grep openclaw

# ============================================
# OpenClaw Dockerfile - 多階段構建（生產(chǎn)級）
# 優(yōu)化點：減小鏡像體積、分離構建和運行環(huán)境
# ============================================

# ===== 階段1：構建階段 =====
FROM node:20-alpine AS builder

WORKDIR /build

# 安裝構建工具
RUN apk add --no-cache python3 py3-pip git make g++

# 安裝 OpenClaw（含編譯依賴）
RUN npm install -g openclaw@latest

# 安裝 Python 依賴
RUN pip3 install --no-cache-dir \
    requests \
    aiohttp \
    websockets

# ===== 階段2：運行階段 =====
FROM node:20-alpine AS runner

# 安裝運行時依賴（不含編譯工具）
RUN apk add --no-cache \
    python3 \
    py3-pip \
    curl \
    tini \
    su-exec

# 創(chuàng)建非 root 用戶
RUN addgroup -g 1000 openclaw && \
    adduser -u 1000 -G openclaw -s /bin/sh -D openclaw

# 從構建階段復制 OpenClaw
COPY --from=builder /usr/local/lib/node_modules /usr/local/lib/node_modules
COPY --from=builder /usr/local/bin/openclaw /usr/local/bin/openclaw

# 復制 Python 包
COPY --from=builder /usr/lib/python3* /usr/lib/python3*
COPY --from=builder /usr/local/lib/python3* /usr/local/lib/python3*

# 創(chuàng)建工作目錄
WORKDIR /app
RUN mkdir -p /data/openclaw /etc/openclaw /app/workspace && \
    chown -R openclaw:openclaw /data/openclaw /app/workspace

# 復制配置
COPY --chown=openclaw:openclaw openclaw.yaml /etc/openclaw/openclaw.yaml

# 切換到非 root 用戶
USER openclaw

# 健康檢查
HEALTHCHECK --interval=30s --timeout=10s --start-period=15s --retries=3 \
    CMD curl -sf http://localhost:18789/health || exit 1

# 暴露端口
EXPOSE 18789

# 使用 tini 作為 init 進程（處理僵尸進程和信號轉發(fā)）
ENTRYPOINT ["/sbin/tini", "--"]
CMD ["openclaw", "gateway", "start"]

# openclaw.yaml - 使用環(huán)境變量占位符
gateway:
  port: ${GATEWAY_PORT:-18789}
  auth_token: ${GATEWAY_AUTH_TOKEN}
model:
  default: ${DEFAULT_MODEL:-gpt-4o-mini}
  providers:
    openai:
      api_key: ${OPENAI_API_KEY}
      base_url: ${OPENAI_BASE_URL:-https://api.openai.com/v1}
channels:
  feishu:
    app_id: ${FEISHU_APP_ID}
    app_secret: ${FEISHU_APP_SECRET}
  telegram:
    bot_token: ${TELEGRAM_BOT_TOKEN}
logging:
  level: ${LOG_LEVEL:-info}
  file: /data/openclaw/logs/gateway.log

# 使用 env 文件啟動
docker run -d \
  --name openclaw-prod \
  --env-file .env.production \
  -p 18789:18789 \
  -v openclaw-data:/data/openclaw \
  openclaw:latest

# .env.production 示例
GATEWAY_PORT=18789
GATEWAY_AUTH_TOKEN=your-secure-token-here
DEFAULT_MODEL=gpt-4o
OPENAI_API_KEY=sk-prod-xxx
FEISHU_APP_ID=cli_xxx
FEISHU_APP_SECRET=xxx
TELEGRAM_BOT_TOKEN=123:abc
LOG_LEVEL=warn

# docker-compose.yml
# OpenClaw 生產(chǎn)環(huán)境多服務編排
version: "3.8"
services:
  # ===== OpenClaw Gateway =====
  gateway:
    build:
      context: .
      dockerfile: Dockerfile
    image: openclaw:latest
    container_name: openclaw-gateway
    restart: unless-stopped
    ports:
      - "${GATEWAY_PORT:-18789}:18789"
    volumes:
      # 數(shù)據(jù)持久化
      - openclaw_data:/data/openclaw
      # 配置文件
      - ./config/openclaw.yaml:/etc/openclaw/openclaw.yaml:ro
      # 工作空間（Skills、插件等）
      - ./workspace:/app/workspace
      # 日志目錄
      - openclaw_logs:/data/openclaw/logs
    env_file:
      - .env.production
    environment:
      - NODE_ENV=production
      - TZ=Asia/Shanghai
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:18789/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s
    networks:
      - openclaw-net
    # 資源限制
    deploy:
      resources:
        limits:
          cpus: "2"
          memory: "2G"
        reservations:
          cpus: "0.5"
          memory: "512M"
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "5"
  # ===== Redis（可選：會話緩存） =====
  redis:
    image: redis:7-alpine
    container_name: openclaw-redis
    restart: unless-stopped
    volumes:
      - redis_data:/data
    command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 3
    networks:
      - openclaw-net
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: "512M"
  # ===== Nginx（可選：反向代理） =====
  nginx:
    image: nginx:alpine
    container_name: openclaw-nginx
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/ssl:/etc/nginx/ssl:ro
    depends_on:
      gateway:
        condition: service_healthy
    networks:
      - openclaw-net
    deploy:
      resources:
        limits:
          cpus: "0.5"
          memory: "256M"
volumes:
  openclaw_data:
    driver: local
  openclaw_logs:
    driver: local
  redis_data:
    driver: local
networks:
  openclaw-net:
    driver: bridge

# nginx/nginx.conf
upstream openclaw_gateway {
    server gateway:18789;
    keepalive 32;
}
server {
    listen 80;
    server_name your-domain.com;
    # 強制 HTTPS
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl http2;
    server_name your-domain.com;
    ssl_certificate     /etc/nginx/ssl/cert.pem;
    ssl_certificate_key /etc/nginx/ssl/key.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    # 請求體大小限制
    client_max_body_size 50m;
    # WebSocket 支持
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    # 超時配置
    proxy_connect_timeout 60s;
    proxy_send_timeout 120s;
    proxy_read_timeout 120s;
    location / {
        proxy_pass http://openclaw_gateway;
    }
    # 健康檢查端點
    location /health {
        proxy_pass http://openclaw_gateway/health;
        access_log off;
    }
}

# 啟動所有服務
docker-compose up -d

# 查看服務狀態(tài)
docker-compose ps

# 查看 Gateway 日志
docker-compose logs -f gateway

# 重啟 Gateway（不重啟 Redis/Nginx）
docker-compose restart gateway

# 更新鏡像并重新部署
docker-compose pull gateway
docker-compose up -d --no-deps gateway

# 停止所有服務
docker-compose down

# 停止并刪除數(shù)據(jù)卷（?? 危險操作）
docker-compose down -v

openclaw-docker/
├── Dockerfile                  # 鏡像構建文件
├── docker-compose.yml          # 多服務編排
├── .env.production             # 生產(chǎn)環(huán)境變量
├── .dockerignore               # 構建排除文件
├── config/
│   └── openclaw.yaml           # Gateway 配置
├── workspace/                  # Skills、插件等
│   └── skills/
├── nginx/
│   ├── nginx.conf              # 反向代理配置
│   └── ssl/                    # SSL 證書
└── scripts/
    ├── deploy.sh               # 部署腳本
    └── backup.sh               # 備份腳本

#!/bin/bash
# scripts/deploy.sh
# OpenClaw Docker 一鍵部署腳本

set -e

echo "?? 開始部署 OpenClaw..."

# 1. 檢查 Docker 環(huán)境
if ! command -v docker &> /dev/null; then
    echo "? Docker 未安裝，請先安裝 Docker"
    exit 1
fi

if ! command -v docker-compose &> /dev/null; then
    echo "? docker-compose 未安裝"
    exit 1
fi

# 2. 檢查環(huán)境變量文件
if [ ! -f .env.production ]; then
    echo "? .env.production 文件不存在"
    echo "?? 請從 .env.example 復制并填寫配置"
    exit 1
fi

# 3. 創(chuàng)建必要目錄
mkdir -p workspace/skills nginx/ssl data/backups

# 4. 備份當前運行版本（如果存在）
if docker ps | grep -q openclaw-gateway; then
    echo "?? 備份當前版本..."
    docker commit openclaw-gateway openclaw:backup-$(date +%Y%m%d-%H%M%S)
fi

# 5. 拉取最新鏡像并構建
echo "?? 構建鏡像..."
docker-compose build --pull gateway

# 6. 啟動服務
echo "?? 啟動服務..."
docker-compose up -d

# 7. 等待健康檢查通過
echo "? 等待服務就緒..."
for i in $(seq 1 30); do
    if curl -sf http://localhost:18789/health > /dev/null 2>&1; then
        echo "? OpenClaw Gateway 已就緒"
        break
    fi
    sleep 2
done

# 8. 顯示狀態(tài)
echo ""
echo "?? 服務狀態(tài)："
docker-compose ps

echo ""
echo "? 部署完成！"
echo "   Gateway: http://localhost:18789"
echo "   日志: docker-compose logs -f gateway"

#!/bin/bash
# scripts/backup.sh
# OpenClaw 數(shù)據(jù)備份腳本

BACKUP_DIR="./data/backups"
TIMESTAMP=$(date +%Y%m%d-%H%M%S)
BACKUP_FILE="${BACKUP_DIR}/openclaw-backup-${TIMESTAMP}.tar.gz"

mkdir -p "$BACKUP_DIR"

echo "?? 備份 OpenClaw 數(shù)據(jù)..."

# 備份數(shù)據(jù)卷
docker run --rm \
    -v openclaw_data:/data:ro \
    -v "$(pwd)/${BACKUP_DIR}":/backup \
    alpine tar czf "/backup/openclaw-data-${TIMESTAMP}.tar.gz" -C /data .

# 備份配置文件
tar czf "${BACKUP_DIR}/openclaw-config-${TIMESTAMP}.tar.gz" \
    config/ .env.production docker-compose.yml

# 清理 7 天前的備份
find "$BACKUP_DIR" -name "*.tar.gz" -mtime +7 -delete

echo "? 備份完成: ${BACKUP_FILE}"
echo "   保留最近 7 天的備份"

# 進入容器 Shell
docker exec -it openclaw-gateway sh
# 查看進程
docker exec openclaw-gateway ps aux
# 查看資源使用
docker stats openclaw-gateway --no-stream
# 查看容器詳細信息
docker inspect openclaw-gateway