[Linux][Sandbox] v0.0.95 sandbox image build fails on Docker Engine — Dockerfile uses BuildKit-only --mount=type=bind,from= syntax not supported by openshell build path

[mercl-lau]

Warning

Regression: worked in v0.0.93 (94-step Dockerfile with COPY), broken in v0.0.95 (109-step Dockerfile with --mount=type=bind,from=)

Description

NemoClaw v0.0.95 onboard fails on all platforms using Docker Engine (non-Desktop) because the Dockerfile introduced BuildKit-only syntax (RUN --mount=type=bind,from=hermes-npm-patch-payload) that the openshell sandbox build path does not support. The build stops immediately at this step with "stopped after 0.2s". Docker Desktop (which defaults to BuildKit) is not affected.

The nemoclaw code sets DOCKER_BUILDKIT=1 in sandbox-prebuild.ts, but the openshell Docker-driver gateway performs the actual docker build and appears to use the traditional builder (output shows "Step X/Y" format, not BuildKit's "#N [stage]" format), ignoring the BuildKit flag.

v0.0.93 Dockerfile used only COPY instructions at the same step positions. v0.0.95 replaced them with --mount=type=bind,from= multi-stage bind mounts.

Platform scope: Reproduced on Ubuntu 22.04, Ubuntu 24.04, Ubuntu 24.04 GPU, Ubuntu 26.04 GPU, DGX Station, DGX Spark, WSL2 (all using Docker Engine); verified working on macOS and DGX Spark with Docker Desktop

Environment

Device:        Ubuntu 22.04 / Ubuntu 24.04 / DGX Station / WSL2
OS:            Linux (multiple distros)
Architecture:  x86_64 / arm64
Node.js:       v22.22.3
npm:           10.9.8
Docker:        Docker Engine 29.2.1 - 29.5.3
OpenShell CLI: openshell 0.0.85
NemoClaw:      v0.0.95
OpenClaw:      N/A (onboard failed)

Steps to Reproduce

1. On a Linux host with Docker Engine (not Docker Desktop), install NemoClaw v0.0.95:

   NEMOCLAW_INSTALL_TAG=v0.0.95 curl -fsSL https://www.nvidia.com/nemoclaw.sh | bash

2. Run nemoclaw onboard (or let the installer proceed to onboard)
3. Observe sandbox image build stops at Step 37/109 (hermes) or Step 76/163 (openclaw)

Expected Result

Sandbox image build should complete successfully on Docker Engine, just as it does on Docker Desktop.

Actual Result

Build output (traditional builder format, not BuildKit):

Step 36/109 : FROM base-image
Step 36/109 completed in 0.0s
Step 37/109 : RUN --mount=type=bind,from=hermes-npm-patch-payload,source=/,target=/run/nemo...
Step 37/109 stopped after 0.2s
Sandbox image build stopped after 4.7s

The --mount=type=bind,from= syntax requires BuildKit. Although nemoclaw sets DOCKER_BUILDKIT=1 in its Node.js subprocess env, the openshell Docker-driver gateway performs the actual build and does not propagate this flag — it falls back to the traditional builder which cannot parse --mount directives.

Logs

Not captured

[mercl-lau]

Reproduction confirmed

Tested on a CI runner (WSL2, Docker Engine 29.5.3, x86_64):

# Without BuildKit — fails
$ DOCKER_BUILDKIT=0 docker build -f test.Dockerfile .
Step 4/4 : RUN --mount=type=bind,from=payload,source=/p.txt,target=/tmp/p.txt cat /tmp/p.txt
the --mount option requires BuildKit. Refer to https://docs.docker.com/go/buildkit/ to learn how to build images with BuildKit enabled

# With BuildKit — succeeds
$ DOCKER_BUILDKIT=1 docker build -f test.Dockerfile .
#7 DONE 0.1s

Root cause: The openshell Docker-driver gateway performs the docker build as an independent process and does not inherit DOCKER_BUILDKIT=1 from nemoclaw's sandbox-prebuild.ts. Docker Engine 29.x defaults to the traditional builder (not BuildKit), so --mount=type=bind,from= is rejected.

Introduced by: #7520 (ci(images): build OpenClaw base image on native runners) which replaced COPY with RUN --mount=type=bind,from= in the Dockerfile.

Workaround: Users can set export DOCKER_BUILDKIT=1 in their shell before running nemoclaw onboard. Docker Desktop users are unaffected (BuildKit is the default).

[mercl-lau]

Update: daemon.json workaround does NOT work

We tried setting "features": {"buildkit": true} in /etc/docker/daemon.json and restarting Docker on all CI runners. Verified that docker build CLI now uses BuildKit by default (output shows #0 building with "default" instance).

However, the sandbox image build still fails with the legacy builder output (Step X/Y format). This confirms that openshell's Docker-driver gateway calls the Docker Engine API directly (e.g. /build endpoint) rather than shelling out to docker build CLI. The Engine API's /build endpoint does not honor the daemon.json BuildKit feature flag — it requires explicit opt-in via request parameters.

The DOCKER_BUILDKIT=1 env var and daemon.json approaches both only affect the CLI path, not the API path.

Conclusion: This cannot be worked around on the CI/ops side. The fix must come from either:

1. OpenShell gateway: use BuildKit when calling the Docker Engine build API
2. Dockerfile: avoid --mount=type=bind,from= syntax and use traditional COPY instead (as v0.0.93 did)

All non-Desktop platforms are blocked on v0.0.95 until this is fixed.