[feature] Support post-start init hook to restore ephemeral container state after pod restart

[mahu888]

Summary

NemoClaw provides no mechanism to run user-defined initialization commands after a pod restart. Any tools installed in the container's writable layer (e.g. via apt install or npm install -g) are lost on every pod restart, requiring manual intervention each time.

Problem

NemoClaw runs openclaw-gateway inside a k3s sandbox pod backed by an overlay filesystem:

On pod restart, the writable layer is discarded and rebuilt from the image. NemoClaw's orchestrator only restarts the gateway process — it does not execute any user-defined setup steps.

This forces users who need additional tools (CLI utilities, npm packages, environment overrides) to maintain a manual restore script and run it after every restart.

Real-world impact

Examples of setup that must be repeated manually after every pod restart:

What	Why needed
apt install ncal	agent uses cal for calendar generation
npm install -g clawhub	skill management CLI
npm config set cache /sandbox/.npm	fix npm cache permissions for sandbox user
Writing /tmp/gw-env.sh	override NEMOCLAW_INFERENCE_BASE_URL env injected by pod spec

Expected behavior

NemoClaw should support a post-start hook that runs automatically before (or just after) the gateway starts on every pod boot. For example:

Option A — init script file (lowest friction):

If this file exists, NemoClaw executes it inside the sandbox before starting the gateway.

Option B — openclaw.json lifecycle hooks:

Option C — k8s initContainer declared in the NemoClaw-managed pod spec, configurable via nemoclaw config.

Any of these would eliminate the need for users to maintain and manually trigger a restore script.

Workaround

Currently users must maintain a manual restore script and run it after every restart:

Environment

• NemoClaw: v0.1.0
• OpenShell: 0.0.16
• Platform: AWS EC2 (Ubuntu 24.04)

[prekshivyas]

Thanks @mahu888 for the detailed write-up — the pain point is real and clearly described.

After reviewing this, we don't think a post-start init hook is the right solution here. Re-running apt install / npm install on every pod restart is slow (network dependency each boot), fragile (fails if a package mirror is down), and opens a security surface that conflicts with ongoing sandbox hardening work (#1121, #654, #916).

The better path is baking your tools into the sandbox image so they're already there on every restart — no script needed. PR #1059 (--from <Dockerfile>) adds exactly this: you'll be able to supply a custom Dockerfile to nemoclaw onboard --from <Dockerfile> that extends the base image with whatever you need:

FROM ghcr.io/nvidia/openshell-community/sandboxes/openclaw:latest
RUN apt-get update && apt-get install -y ncal
RUN npm install -g clawhub
RUN npm config set cache /sandbox/.npm

Build once, persists across every restart, no network dependency on boot.

For the runtime env override case (/tmp/gw-env.sh), that's a narrower problem — if you still need that after #1059 lands, please open a separate issue scoped to runtime env injection and we can evaluate it independently.

We're going to focus on getting #1059 reviewed and merged as the preferred approach here.

[prekshivyas]

PR #1059 (--from <Dockerfile>) has been merged. Users can now bake persistent tools into their sandbox image via nemoclaw onboard --from <Dockerfile>, which covers the core use cases here (apt packages, npm globals, config).

For the runtime env override case (/tmp/gw-env.sh), please open a separate scoped issue if that's still needed — it's a different problem from tool persistence.

Closing as resolved.