Harden Docker infra, add credential passthrough and SSH agent forwarding

[pnlpleasr]

Summary

• SSH agent forwarding: forward the host SSH agent socket into sandbox containers so agents can git push via SSH without exposing private keys. Exact-match allowlist in the security validator with 4 regression tests.
• Credential passthrough: explicitly pass TELEGRAM_BOT_TOKEN, GOOGLE_PLACES_API_KEY, NOTION_API_KEY, OPENAI_WHISPER_API_KEY, and CLAUDE_* session keys through docker-compose.yml to gateway/CLI containers.
• Security hardening: robust .env parser (quote stripping, export prefix, key validation, unmatched quote warnings), tryRealpathAbsolute fail-closed, chmod 600 on temp files before writing secrets, trap cleanup, env var sanitizer coverage for SESSION_KEY/COOKIE patterns.
• Inline documentation: architecture comments across Dockerfile, Dockerfile.sandbox, docker-compose.yml, docker-setup.sh, and validate-sandbox-security.ts.

Changes

File	What
Dockerfile	Docker CLI install, chmod 1777 runs as USER root, architecture header
Dockerfile.sandbox	SSH agent forwarding design, --groups root for socket access
docker-compose.yml	UID/GID parameterization, credential passthrough with ${VAR:-} defaults, vault mount (long-form for spaces), loopback port binding
docker-setup.sh	Robust .env loader, UID/GID detection + root warning, vault dir allows spaces, chmod 600 + trap in upsert_env, unmatched quote warning
validate-sandbox-security.ts	ALLOWED_HOST_PATHS allowlist, tryRealpathAbsolute fail-closed for non-absolute paths
validate-sandbox-security.test.ts	4 allowlist regression tests (exact match, sibling blocked, parent blocked, traversal blocked)
sanitize-env-vars.ts	SESSION_KEY, SESSION_TOKEN, COOKIE added to blocklist
.dockerignore	.env excluded from build context

Test plan

• npx vitest run src/agents/sandbox/validate-sandbox-security.test.ts — 19 tests pass
• npx vitest run src/agents/sandbox/sanitize-env-vars.test.ts — 4 tests pass
• Gateway image rebuilt and container running
• End-to-end: send Telegram message asking agent to clone a repo via SSH

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8a67a3faf3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Use docker.sock group GID instead of hardcoded root group

This hardcodes supplementary group 0, but on standard Linux Docker installs /var/run/docker.sock is typically owned by the docker group (non-zero GID). With user: "${OPENCLAW_UID}:${OPENCLAW_GID}", the gateway process remains non-root and will get permission denied when trying to create sandbox containers unless the socket happens to be group root; this breaks sandbox execution on those hosts.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Provide fallback for new OPENCLAW_VAULT_DIR bind source

The new bind mount source uses ${OPENCLAW_VAULT_DIR} with no default, so upgrades from older setups (whose existing project .env lacks this key) expand to an empty source and make docker compose up fail mount validation. Since docker-setup.sh is documented as one-time setup, this introduces a startup regression unless users rerun setup or manually patch .env.

Useful? React with 👍 / 👎.

[greptile-apps]

Greptile Summary

This PR implements SSH agent forwarding and credential passthrough for the Docker infrastructure while adding comprehensive security hardening. The implementation is well-documented with inline architecture comments throughout.

Key improvements:

• SSH agent forwarding via exact-match allowlist (/run/host-services/ssh-auth.sock) with 4 regression tests covering siblings, parents, and traversal attacks
• Fail-closed tryRealpathAbsolute that returns null on resolution failures to prevent symlink escapes
• Robust .env parser with quote stripping, export prefix handling, key validation, and unmatched quote warnings
• chmod 600 on temp files before writing secrets with trap-based cleanup
• Loopback-only port binding (127.0.0.1) prevents LAN exposure
• .env files excluded from Docker build context

Security architecture:
The PR grants elevated privileges (Docker socket access, group root membership) that are necessary for the feature set but increase attack surface. These tradeoffs are explicitly documented in code comments. The security validation layer (validate-sandbox-security.ts) provides defense-in-depth against misconfiguration, with comprehensive test coverage (19 tests including symlink escape prevention).

Test coverage:
All security-critical paths have test coverage including allowlist exact-match validation, symlink resolution, and env var sanitization patterns.

Confidence Score: 4/5

• This PR is safe to merge with careful operational monitoring
• Score reflects high code quality and comprehensive test coverage, offset by the inherent security tradeoffs of Docker socket access. The implementation is correct with no logical errors found. Security validation is well-tested (19 tests pass). The main risks are architectural (Docker socket mount, group root membership) rather than implementation bugs, and these are explicitly documented and mitigated via validation layers.
• Monitor validate-sandbox-security.ts closely in production - this is the critical defense layer that prevents Docker socket abuse. Ensure it's always enforced and never bypassed.

_{Last reviewed commit: 8a67a3f}