From 8896bdc9631e8a38caf9190276fdb47a30c67be9 Mon Sep 17 00:00:00 2001
From: OpenClaw Dev <dev@openclaw.local>
Date: Sun, 25 Oct 2026 03:15:32 +0100
Subject: [PATCH] build: Makefile with cross-builds (linux/termux arm64,
 armv7), non-root distroless Dockerfile, example config

---
 .dockerignore       |  8 ++++++++
 Dockerfile          | 20 ++++++++++++++++++++
 Makefile            | 46 +++++++++++++++++++++++++++++++++++++++++++++
 config.example.yaml | 29 ++++++++++++++++++++++++++++
 4 files changed, 103 insertions(+)
 create mode 100644 .dockerignore
 create mode 100644 Dockerfile
 create mode 100644 Makefile
 create mode 100644 config.example.yaml

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..b1e62ba
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,8 @@
+.git
+android
+bin
+dist
+data
+*.db
+config.yaml
+.env
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..f08c34d
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,20 @@
+# syntax=docker/dockerfile:1
+# Pinned Go version, matches go.mod (go 1.25).
+FROM golang:1.25.3-alpine AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+ARG VERSION=docker
+RUN CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.version=${VERSION}" -o /out/openclaw ./cmd/openclaw \
+ && mkdir -p /out/data
+
+FROM gcr.io/distroless/static-debian12:nonroot
+COPY --from=build /out/openclaw /usr/local/bin/openclaw
+COPY --from=build --chown=65532:65532 /out/data /data
+ENV OPENCLAW_DATA_DIR=/data \
+    OPENCLAW_LISTEN=0.0.0.0:8787
+USER 65532:65532
+EXPOSE 8787
+VOLUME ["/data"]
+ENTRYPOINT ["/usr/local/bin/openclaw"]
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..dfc0a34
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,46 @@
+BINARY  := openclaw
+VERSION ?= $(shell git describe --tags --always --dirty 2>/dev/null || echo dev)
+LDFLAGS := -s -w -X main.version=$(VERSION)
+GOFLAGS := -trimpath
+DIST    := dist
+export CGO_ENABLED := 0
+
+.PHONY: all build test vet race run cross linux-amd64 linux-arm64 linux-armv7 android-arm64 android-armv7 docker clean
+
+all: vet test build
+
+build:
+	go build $(GOFLAGS) -ldflags '$(LDFLAGS)' -o bin/$(BINARY) ./cmd/openclaw
+
+test:
+	go test ./...
+
+race:
+	CGO_ENABLED=1 go test -race ./...
+
+vet:
+	go vet ./...
+
+run: build
+	./bin/$(BINARY) -config config.yaml
+
+cross: linux-amd64 linux-arm64 linux-armv7 android-arm64 android-armv7
+
+linux-amd64:
+	GOOS=linux GOARCH=amd64 go build $(GOFLAGS) -ldflags '$(LDFLAGS)' -o $(DIST)/$(BINARY)-linux-amd64 ./cmd/openclaw
+linux-arm64:
+	GOOS=linux GOARCH=arm64 go build $(GOFLAGS) -ldflags '$(LDFLAGS)' -o $(DIST)/$(BINARY)-linux-arm64 ./cmd/openclaw
+linux-armv7:
+	GOOS=linux GOARCH=arm GOARM=7 go build $(GOFLAGS) -ldflags '$(LDFLAGS)' -o $(DIST)/$(BINARY)-linux-armv7 ./cmd/openclaw
+# Termux on Android: GOOS=android, pure Go (no NDK needed thanks to CGO_ENABLED=0)
+android-arm64:
+	GOOS=android GOARCH=arm64 go build $(GOFLAGS) -ldflags '$(LDFLAGS)' -o $(DIST)/$(BINARY)-termux-arm64 ./cmd/openclaw
+# android/arm needs cgo+NDK; a static linux/arm binary runs fine in Termux instead.
+android-armv7:
+	GOOS=linux GOARCH=arm GOARM=7 go build $(GOFLAGS) -ldflags '$(LDFLAGS)' -o $(DIST)/$(BINARY)-termux-armv7 ./cmd/openclaw
+
+docker:
+	docker build -t openclaw:$(VERSION) .
+
+clean:
+	rm -rf bin $(DIST)
diff --git a/config.example.yaml b/config.example.yaml
new file mode 100644
index 0000000..1d452e1
--- /dev/null
+++ b/config.example.yaml
@@ -0,0 +1,29 @@
+# OpenClaw configuration. Secrets can come from env instead:
+#   OPENCLAW_AUTH_TOKEN, OPENCLAW_LLM_API_KEY, OPENCLAW_LLM_BASE_URL, OPENCLAW_LLM_MODEL,
+#   OPENCLAW_LISTEN, OPENCLAW_DATA_DIR, OPENCLAW_WORKSPACE, OPENCLAW_ALLOWED_ORIGINS (comma separated)
+listen: 127.0.0.1:8787          # bind to 0.0.0.0 only behind TLS (reverse proxy) or in a trusted LAN
+auth_token: ""                  # required, >= 16 chars. Generate: openssl rand -hex 32
+allowed_origins: []             # browser origins allowed besides same host; "*" only if you really mean it
+data_dir: ./data
+workspace: ""                   # default: <data_dir>/workspace; file tools cannot leave it
+
+llm:
+  base_url: https://api.openai.com/v1   # OpenRouter: https://openrouter.ai/api/v1 · Ollama: http://localhost:11434/v1
+  api_key: ""
+  model: gpt-4o-mini
+  timeout_sec: 120
+  temperature: 0.7
+
+agent:
+  system_prompt: "You are OpenClaw, a concise and helpful self-hosted assistant. Use tools when they help."
+  max_iterations: 8
+  history_limit: 50
+
+tools:
+  web_fetch:
+    enabled: true
+    max_bytes: 524288
+    timeout_sec: 15
+    allow_private: false        # true allows localhost/LAN targets (SSRF risk)
+  files_enabled: true
+  file_max_bytes: 1048576