fix(portable): launch cannot clean up OpenClaw permissions under rootless Podman #8584

Summary

nemoclaw launch my-assistant successfully starts OpenClaw and completes a real chat turn under the experimental portable/rootless-Podman profile, but after the user exits the TUI, host-side mutable-config permission cleanup cannot discover the running Podman-managed sandbox container. launch therefore fails closed with exit 1 even though the agent command exited 0.

This reproduced independently on Brev Ubuntu and a persistent Kubuntu seat, so it is not Brev-specific. It is related to the experimental native-Podman work tracked by #7744, but no issue or PR matching this exact cleanup failure was found.

Environments

Brev

• Ubuntu 24.04.4 LTS, x86_64
• NemoClaw v0.1.0
• OpenShell 0.0.85
• Podman 5.7.0, rootless portable profile
• L40S GPU

Persistent Kubuntu seat

• Ubuntu 26.04 LTS / Kubuntu, x86_64
• Podman 5.7.0, rootless portable profile
• NemoClaw installed from main using --experimental-profile portable --fresh
• Main was locally verified at 47542dd353814c0c12e8e10c496c080ab6c796fe

Reproduction

1. Install/onboard the portable profile and verify my-assistant is ready.

2. Run:

   nemoclaw launch my-assistant

3. Send Reply exactly: NEMOCLAW_OK in the OpenClaw TUI.

4. Confirm OpenClaw replies NEMOCLAW_OK.

5. Exit with /exit.

6. Check the host command status:

   echo "launch_exit=$?"

Observed

Chat succeeds, then launch prints:

OpenClaw permission cleanup failed (command exit 0; cleanup exit 1): No running direct OpenShell sandbox container found for 'my-assistant' (driver: docker). Expected one OpenShell-managed container labeled 'openshell.ai/sandbox-name=my-assistant' and named openshell-my-assistant or openshell-my-assistant-*. Is the sandbox running?

The final result is:

launch_exit=1

The sandbox remains running and healthy; the failure occurs only during post-command permission cleanup.

On Brev, the caller environment and runtime inspection showed:

DOCKER_HOST=
docker ps: no sandbox container
podman ps: openshell-sandbox-my-assistant
labels: openshell.managed=true, openshell.sandbox-name=my-assistant

Cause evidence

src/lib/sandbox/privileged-exec.ts performs direct discovery through the Docker-named dockerCapture helper and expects Docker-path labels/names:

• openshell.ai/managed-by=openshell
• openshell.ai/sandbox-name=<name>
• openshell-<name> or openshell-<name>-*

The portable Podman workload is visible through Podman with a different managed identity:

• openshell.managed=true
• openshell.sandbox-name=<name>
• openshell-sandbox-<name>

Consequently, cleanupOpenClawAfterExec cannot inspect, repair, or verify the mutable-config permission contract and correctly fails closed, but it is using the wrong runtime/container discovery path for this portable sandbox.

Expected

• Post-agent cleanup uses the sandbox's recorded owning runtime/provider and exact workload identity.
• A successful OpenClaw exit plus successful permission cleanup returns 0.
• The cleanup remains fail-closed for missing, ambiguous, renamed, or identity-mismatched workloads.
• Docker behavior remains unchanged.

Acceptance criteria

• Make post-exec/launch privileged cleanup discover and execute against the exact provider-owned portable Podman workload rather than the unrelated/default Docker daemon.
• Preserve exact sandbox ownership and container identity validation; do not fall back to an unsafe name-only match.
• Prove idempotent cleanup and the original agent exit-code behavior for Docker and rootless Podman.
• Add a regression where Docker sees no container but the provider-owned Podman runtime has openshell-sandbox-my-assistant; a successful agent command and cleanup must return 0.
• Retain nonzero, actionable failures for missing, duplicate, mismatched-label/name, or replaced-container cases.
• Add portable E2E coverage for nemoclaw launch <name> through a real chat turn, /exit, permission verification, and final exit status 0.

User impact

The intended one-command UX works until session exit, but cannot currently be recommended for portable images: automation sees failure, and NemoClaw cannot prove that the OpenClaw mutable-config permission contract was restored.