gcloud-lab/apps/base/customer1/openclaw/deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: customer1
  name: openclaw
  labels:
    app: openclaw
spec:
  replicas: 1
  selector:
    matchLabels:
      app: openclaw
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app: openclaw
    spec:
      automountServiceAccountToken: false
      securityContext:
        fsGroup: 1000          # This helps chown files created by rootfs
        seccompProfile:
          type: RuntimeDefault

      initContainers:
        - name: init-home
          image: busybox:1.37
          imagePullPolicy: IfNotPresent
          command:
            - sh
            - -c
            - |
              mkdir -p /home/node/.npm /home/node/.openclaw/workspace
              # No chown needed — fsGroup + our UID will handle it
              echo "✅ Home directories created"
          securityContext:
            runAsUser: 1000      # Non-root
            runAsGroup: 1000
          volumeMounts:
            - name: openclaw-home-new
              mountPath: /home/node

        - name: init-config
          image: busybox:1.37
          imagePullPolicy: IfNotPresent
          command:
            - sh
            - -c
            - |
              cp /config/openclaw.json /home/node/.openclaw/openclaw.json
              cp /config/AGENTS.md /home/node/.openclaw/workspace/AGENTS.md || true
              echo "✅ Config copied"
          securityContext:
            runAsUser: 1000
            runAsGroup: 1000
          volumeMounts:
            - name: openclaw-home-new
              mountPath: /home/node
            - name: config
              mountPath: /config

      containers:
        - name: gateway
          image: ghcr.io/openclaw/openclaw:slim
          imagePullPolicy: IfNotPresent
          command:
            - node
            - /app/dist/index.js
            - gateway
            - run
          env:
            - name: HOME
              value: /home/node
            - name: OPENCLAW_CONFIG_DIR
              value: /home/node/.openclaw
            - name: NODE_ENV
              value: production
            # your secrets ...

            # Force npm cache to a writable location
            - name: NPM_CONFIG_CACHE
              value: /tmp/.npm

          resources:
            requests:
              memory: 2Gi
              cpu: "1"
            limits:
              memory: 6Gi
              cpu: "4"

          securityContext:
            runAsNonRoot: true
            runAsUser: 1000
            runAsGroup: 1000
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL

          volumeMounts:
            - name: openclaw-home-new
              mountPath: /home/node
            - name: tmp-volume
              mountPath: /tmp

      volumes:
        - name: openclaw-home-new
          persistentVolumeClaim:
            claimName: openclaw-home-new-pvc
        - name: config
          configMap:
            name: openclaw-config
        - name: tmp-volume
          emptyDir:
            medium: Memory