Skip to content

feat: add ZeroClaw AI agent runtime stack #691

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
michael-valdron merged 4 commits into from
Jul 30, 2026
+102 −0
Merged

feat: add ZeroClaw AI agent runtime stack #691

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a5ea650
feat: add ZeroClaw AI agent runtime stack
akurinnoy Jun 30, 2026
36e5ca1
chore: add CODEOWNERS entry for zeroclaw stack
akurinnoy Jul 14, 2026
2f67e0f
Update schemaVersion to 2.3.0
akurinnoy Jul 27, 2026
57edcf8
chore: skip zeroclaw stack in odo v3 test
akurinnoy Jul 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,3 +62,6 @@

# OpenClaw stacks
/stacks/openclaw/ @akurinnoy

# ZeroClaw stacks
/stacks/zeroclaw/ @akurinnoy
91 changes: 91 additions & 0 deletions stacks/zeroclaw/1.0.0/devfile.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,91 @@
# ZeroClaw — AI Agent Gateway/Runtime Stack
#
# ZeroClaw is an open-source Rust-based AI agent gateway/runtime.
# Repo: https://github.com/zeroclaw-labs/zeroclaw
#
# The daemon container runs the zeroclaw daemon which provides:
# - Gateway server on port 42617 — webhooks, websockets, web UI
#
# The editor (VS Code, ttyd, etc.) is chosen separately in the dashboard
# and injected into the tools container.
#
# First boot: run `zeroclaw quickstart` in the terminal to create
# your first agent, then restart the workspace.

schemaVersion: 2.3.0
metadata:
name: zeroclaw
displayName: ZeroClaw AI Agent Runtime
description: A fast, lightweight AI agent runtime. 50+ integrations, webhooks, websockets, and a web UI — all in one binary.
icon: https://raw.githubusercontent.com/zeroclaw-labs/zeroclaw/master/apps/tauri/icons/icon.png
tags:
- AI
- Agent
- Gateway
- ZeroClaw
projectType: AI
language: Polyglot
version: 1.0.0

attributes:
controller.devfile.io/storage-type: per-workspace

components:
- name: tools
container:
image: quay.io/devfile/universal-developer-image:ubi9-latest
memoryLimit: 1Gi
memoryRequest: 256Mi
mountSources: true

# ZeroClaw daemon container.
# Runs the daemon (gateway on port 42617).
# Config persists in the PVC at /home/user/.zeroclaw.
- name: zeroclaw
container:
image: quay.io/che-incubator/zeroclaw-image:latest
mountSources: false
memoryRequest: 256Mi
memoryLimit: 1Gi
args: ["daemon", "--host", "0.0.0.0"]
env:
- name: HOME
value: /home/user
- name: ZEROCLAW_DATA_DIR
value: /home/user/.zeroclaw/data
Comment on lines +50 to +55

@coderabbitai coderabbitai Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail
skopeo inspect --config docker://quay.io/che-incubator/zeroclaw-image:latest \
  | jq -e '.config.Env[]? | select(. == "ZEROCLAW_ALLOW_PUBLIC_BIND=true")'

Repository: devfile/registry

Length of output: 194

🏁 Script executed:

#!/usr/bin/env bash
set -euo pipefail

echo "== devfile references =="
cat -n stacks/zeroclaw/1.0.0/devfile.yaml | sed -n '1,120p'

echo
echo "== repository searches for ZeroClaw env / public bind / image =="
rg -n "ZEROCLAW_ALLOW_PUBLIC_BIND|allow_public_bind|zeroclaw|zhao|quay.io/che-incubator/zeroclaw-image|ZeroClaw" stacks README.md . -g '!vendor' -g '!node_modules' -g '!dist' -g '!build' 2>/dev/null | head -200

Repository: devfile/registry

Length of output: 7805

🌐 Web query:

ZeroClaw gateway.allow_public_bind ZEROCLAW_ALLOW_PUBLIC_BIND docker configuration docs

💡 Result:

In ZeroClaw, gateway.allow_public_bind (or the environment variable ZEROCLAW_ALLOW_PUBLIC_BIND) is a security configuration setting that governs whether the gateway is permitted to bind to non-localhost addresses, such as 0.0.0.0 (all interfaces) [1][2]. By default, for security reasons, ZeroClaw restricts the gateway to the localhost (127.0.0.1) to prevent unintended exposure to external networks [1][2]. If you attempt to bind to 0.0.0.0 without this setting explicitly enabled, the gateway will refuse to start [2][3]. Docker Configuration In containerized environments like Docker, it is common to set ZEROCLAW_ALLOW_PUBLIC_BIND=true [4][5]. This is necessary because containers typically need to bind to all interfaces (often represented as [::] or 0.0.0.0) to allow traffic from the host or other containers to reach the service [4]. The security model for containerized deployments relies on Docker's internal network isolation rather than restricting the bind address to localhost [4]. Example Docker Compose configuration: services: zeroclaw: image: ghcr.io/zeroclaw-labs/zeroclaw:latest environment: - ZEROCLAW_ALLOW_PUBLIC_BIND=true - ZEROCLAW_GATEWAY_PORT=42617 ports: - "42617:42617" When setting this to true, be aware that the gateway becomes reachable outside of localhost (e.g., on your local area network) [1][6]. If you require public webhooks, the recommended approach is to use a tunnel (such as Tailscale, ngrok, or Cloudflare) rather than exposing the port directly via a public bind [1][2].

Citations:

🌐 Web query:

quay.io/che-incubator/zeroclaw-image Dockerfile ZEROCLAW_ALLOW_PUBLIC_BIND

💡 Result:

The ZEROCLAW_ALLOW_PUBLIC_BIND environment variable is a configuration setting used in ZeroClaw container deployments to control the gateway's network binding behavior [1][2]. The official ZeroClaw container image typically includes a default configuration file that already sets allow_public_bind = true and binds to [::] (all network interfaces), enabling the gateway to be reachable out of the box when the container's ports are published [3][1]. Key details regarding this variable include: - Purpose: In containerized environments, the ZeroClaw gateway is designed to refuse binding to public interfaces (like 0.0.0.0 or [::]) for security reasons unless explicitly authorized [4][2]. Setting ZEROCLAW_ALLOW_PUBLIC_BIND=true provides this authorization, allowing the gateway to accept connections from outside the container [5][1][6]. - Usage: You generally only need to set this environment variable if you are bind-mounting a custom configuration file that defaults to localhost binding [3]. - Configuration: When used, it is typically passed as an environment variable in a docker-compose.yml or similar deployment manifest [5][1][6]. - Security: It is an opt-in mechanism to move away from the default, safer localhost-only binding [4][2]. Ensure that any public exposure is managed appropriately through network security controls (e.g., firewall, VPC, or tunnels) [4]. For most standard deployments using the official image, the internal defaults are sufficient, and the environment variable can be omitted [3]. If you are experiencing connectivity issues despite publishing ports, or if you are using a custom configuration, ensuring this variable is set to true may be required [1][6].

Citations:

🌐 Web query:

github.com/zeroclaw-labs/zeroclaw config.schema allow_public_bind ZEROCLAW_ALLOW_PUBLIC_BIND

💡 Result:

The configuration parameter allow_public_bind and its corresponding environment variable ZEROCLAW_ALLOW_PUBLIC_BIND in ZeroClaw are security controls designed to prevent accidental exposure of the ZeroClaw HTTP gateway [1][2]. By default, the ZeroClaw gateway binds to the loopback address (127.0.0.1) [3][4]. If you attempt to configure the gateway to bind to a non-loopback address (such as 0.0.0.0) without setting allow_public_bind to true, the application will refuse to start [3][4][5]. This mechanism is intended to block accidental public exposure [2][6]. Key details: - Configuration: In config.toml, this is set under the [gateway] section as allow_public_bind = true or false [3][4]. - Environment Variable: Alternatively, you can use the environment variable ZEROCLAW_ALLOW_PUBLIC_BIND, typically set to 1 or true (e.g., ZEROCLAW_ALLOW_PUBLIC_BIND=true) [7][3][8]. - Use Case: This setting is frequently required when running ZeroClaw inside a container (e.g., Docker or Kubernetes) to allow the service to be reachable within the container network or across a local network [7][8][9]. - Security Recommendation: Documentation strongly advises caution when enabling this, as it makes the gateway reachable outside of localhost. It is recommended to use it only on trusted local networks or in conjunction with a secure tunnel (e.g., Cloudflare, Tailscale, or ngrok) for external access [3][4]. The parameter is defined in the project's gateway configuration schema [1][2].

Citations:

🌐 Web query:

site:quay.io/che-incubator/zeroclaw-image Dockerfile ZEROCLAW_ALLOW_PUBLIC_BIND

💡 Result:

I couldn’t find a direct quay.io/che-incubator/zeroclaw-image Dockerfile match, but ZeroClaw’s docs say ZEROCLAW_ALLOW_PUBLIC_BIND=true is used for Docker/container networking because the gateway normally blocks public binds. The config reference also shows gateway.allow_public_bind defaults to false. (github.com)

If you want, I can keep digging specifically for the Quay image/Dockerfile history.

Citations:

Make the public-bind override explicit in the devfile.

The command binds ZeroClaw to 0.0.0.0, but ZeroClaw’s default gateway.allow_public_bind is false, so container deployments are typically run with ZEROCLAW_ALLOW_PUBLIC_BIND=true. Since this devfile does not expose it and the wrapper image’s environment cannot be determined from the repository, set the env var here to avoid the daemon rejecting the bind and losing the public endpoint.

Suggested fix 
       env:
         - name: HOME
           value: /home/user
+        - name: ZEROCLAW_ALLOW_PUBLIC_BIND
+          value: "true"
         - name: ZEROCLAW_DATA_DIR
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
args: ["daemon", "--host", "0.0.0.0"]
env:
- name: HOME
value: /home/user
- name: ZEROCLAW_DATA_DIR
value: /home/user/.zeroclaw/data
args: ["daemon", "--host", "0.0.0.0"]
env:
- name: HOME
value: /home/user
- name: ZEROCLAW_ALLOW_PUBLIC_BIND
value: "true"
- name: ZEROCLAW_DATA_DIR
value: /home/user/.zeroclaw/data
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@stacks/zeroclaw/1.0.0/devfile.yaml` around lines 50 - 55, Make the
public-bind override explicit in the devfile’s daemon container environment: add
ZEROCLAW_ALLOW_PUBLIC_BIND with value true alongside HOME and ZEROCLAW_DATA_DIR,
preserving the existing daemon arguments and environment entries.

endpoints:
- name: gateway
targetPort: 42617
exposure: public
protocol: https
attributes:
cookiesAuthEnabled: true
discoverable: false
urlRewriteSupported: false
volumeMounts:
- name: zeroclaw-data
path: /home/user/.zeroclaw

- name: zeroclaw-data
volume:
size: 1Gi

commands:
- id: quickstart
exec:
label: "Create your first agent (quickstart)"
component: zeroclaw
commandLine: zeroclaw quickstart
workingDir: /home/user
- id: status
exec:
label: "Show ZeroClaw status"
component: zeroclaw
commandLine: zeroclaw status
workingDir: /home/user
- id: doctor
exec:
label: "Run diagnostics"
component: zeroclaw
commandLine: zeroclaw doctor
workingDir: /home/user
7 changes: 7 additions & 0 deletions stacks/zeroclaw/stack.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
name: zeroclaw
displayName: ZeroClaw AI Agent Runtime
description: A fast, lightweight AI agent runtime. 50+ integrations, webhooks, websockets, and a web UI — all in one binary.
icon: https://raw.githubusercontent.com/zeroclaw-labs/zeroclaw/master/apps/tauri/icons/icon.png
versions:
- version: 1.0.0
default: true
1 change: 1 addition & 0 deletions tests/check_odov3.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,7 @@ ginkgo run --mod=readonly --procs 2 \
--skip="stack: ollama" \
--skip="stack: hermes" \
--skip="stack: openclaw" \
--skip="stack: zeroclaw" \
--slow-spec-threshold 120s \
--timeout 3h \
tests/odov3 -- -stacksPath "$stacksPath" -stackDirs "$stackDirs" ${args}
Loading