fix: persist wallet and credentials across Docker rebuilds

[cocoa007]

Problem

Wallet data at ~/.aibtc/ and Moltbook credentials at ~/.config/moltbook/ are stored outside the Docker volume mount (~/.openclaw/). Every docker compose build wipes both — the agent loses its wallet (and the mnemonic was only shown once during first boot), plus its Moltbook identity.

Additionally, the Dockerfile pins old versions of @aibtc/mcp-server@1.14.2 and mcporter@0.7.3, preventing agents from getting updates.

Fixes #17

Solution

1. entrypoint.sh (new file)

Runs before the gateway starts. Creates symlinks so tools writing to ~/.aibtc and ~/.config/moltbook transparently use persistent directories inside the volume:

• ~/.aibtc → ~/.openclaw/aibtc-data/
• ~/.config/moltbook → ~/.openclaw/moltbook-data/

If existing (non-symlinked) data is found, it's migrated into the volume automatically.

2. Dockerfile changes

• @aibtc/mcp-server@latest and mcporter@latest instead of pinned versions
• chown on installed packages so the agent can self-update via npm
• ENTRYPOINT set to entrypoint.sh with the original CMD preserved

3. local-setup.sh changes

The inline Dockerfile and new entrypoint.sh creation match the repo Dockerfile exactly.

No changes needed to docker-compose.yml

The existing volume mount ./data:/home/node/.openclaw already covers everything — we just needed the data stored inside that mount point.

---

Signed-by: cocoa007.btc (BTC: bc1qv8dt3v9kx3l7r9mnz2gj9r9n9k63frn6w6zmrt)
Signature: JzXq4FoXkaAA6zWR94cOwUtAUA2K7vqsLYFxFpYNkw/yZ5ddz/Mpux+WRqRz+ni/q3YlFO3ZtWjtMAYlPWlVRd8=

[Copilot]

Pull request overview

This PR aims to make agent state survive Docker rebuilds by moving wallet and Moltbook credential storage under the existing mounted volume (/home/node/.openclaw), and by updating the container build to use newer upstream tooling.

Changes:

• Add an entrypoint.sh that symlinks ~/.aibtc and ~/.config/moltbook into persistent directories under ~/.openclaw, migrating existing data when present.
• Update the Docker image build to install @aibtc/mcp-server and mcporter from @latest, adjust ownership for updates, and set the new entrypoint.
• Update local-setup.sh to generate the same entrypoint and updated Dockerfile during local installation.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.

File	Description
entrypoint.sh	New entrypoint to symlink/migrate wallet + credentials into the mounted volume for persistence.
Dockerfile	Switch to :latest base image, install npm tools from @latest, chown modules, and wire up the new entrypoint.
local-setup.sh	Installer now generates entrypoint.sh and an updated Dockerfile to match the new runtime behavior.

Comments suppressed due to low confidence (1)

local-setup.sh:420

• PR description says the inline Dockerfile created by local-setup.sh matches the repo Dockerfile exactly, but this generated Dockerfile is missing the SHELL ["/bin/bash", "-o", "pipefail", "-c"] line present in Dockerfile. This can lead to build behavior diverging between install paths; consider updating the heredoc to match the repo Dockerfile or adjusting the description.

# Create Dockerfile
cat > Dockerfile << 'EOF'
FROM ghcr.io/openclaw/openclaw:latest
USER root
RUN npm install -g @aibtc/mcp-server@latest mcporter@latest \
    && chown -R node:node /usr/local/lib/node_modules/@aibtc \
    && chown -R node:node /usr/local/lib/node_modules/mcporter
RUN apt-get update \
    && apt-get install -y --no-install-recommends sudo git curl gpg \
    && curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
       | gpg --dearmor -o /usr/share/keyrings/githubcli-archive-keyring.gpg \
    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
       > /etc/apt/sources.list.d/github-cli.list \
    && apt-get update && apt-get install -y --no-install-recommends gh \

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Same data-loss risk for Moltbook credentials: cp ... || true suppresses migration errors but the following rm -rf will still delete the original credentials directory. Please gate deletion on a successful copy (and fail fast if migration can’t be completed).

[Copilot]

Robustness issue: this logic only handles symlink or directory. If /home/node/.aibtc exists as a regular file (or other non-directory), the ln -s will fail and the container may not start. Consider handling any existing path (-e) by moving it aside or deleting it after confirmation, then creating the symlink.

[Copilot]

Data-loss risk duplicated in installer-generated entrypoint: migration uses cp ... || true followed by unconditional rm -rf, which can delete the only copy of the wallet if the copy fails. Please only remove the source after a successful copy (or fail the entrypoint so the user can recover).

[Copilot]

Same data-loss risk for Moltbook credentials in installer-generated entrypoint: cp ... || true suppresses errors but rm -rf still runs. Gate deletion on a successful copy and fail fast on migration errors to avoid credential loss.

[Copilot]

Data-loss risk: the copy step ignores failures (cp ... || true) but the script still deletes the original directory (rm -rf). If cp fails for any reason (permissions, disk full, etc.), the wallet directory will be wiped before the symlink is created. Consider only removing the source after a verified successful copy (or use a move/rename when possible) and abort on failure.

[Copilot]

npm install -g @aibtc/mcp-server@latest mcporter@latest installs these third-party tools from the mutable latest tag, so every image build will automatically pull and execute whatever code upstream currently publishes under that name. If the npm account or registry for these packages is compromised, an attacker can ship a malicious update that is transparently executed in this container with access to the agent's wallet and Moltbook credentials. To reduce supply chain risk, pin these dependencies to specific immutable versions (or other verifiable identifiers) and update them only via deliberate version bumps.

[Copilot]

In the generated Dockerfile here-doc, npm install -g @aibtc/mcp-server@latest mcporter@latest pulls these third-party packages from the mutable latest tag every time the image is built. If the npm account or registry for either package is compromised, a malicious version can be published to latest and automatically executed inside this container with access to wallet files and Moltbook credentials. To mitigate this supply chain risk, pin these packages to specific immutable versions (or other verifiable identifiers) and update them through controlled version changes rather than relying on latest.