How to Protect OpenClaw from Container Escape Attacks

# In Dockerfile:
USER 10001:10001

# Or in docker-compose.yml:
services:
  openclaw:
    user: "10001:10001"

# For Kubernetes:
securityContext:
  runAsNonRoot: true
  runAsUser: 10001
  runAsGroup: 10001

# In docker run:
docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE openclaw:latest

# In Kubernetes:
securityContext:
  capabilities:
    drop:
      - ALL
    add:
      - NET_BIND_SERVICE  # Only if needed

# Create custom seccomp profile (seccomp-profile.json):
{
  "defaultAction": "SCMP_ACT_ERRNO",
  "architectures": ["SCMP_ARCH_X86_64"],
  "syscalls": [
    {"names": ["read", "write", "open", "close"], "action": "SCMP_ACT_ALLOW"},
    {"names": ["execve", "fork", "clone"], "action": "SCMP_ACT_ALLOW"}
  ]
}

# Apply profile:
docker run --security-opt seccomp=seccomp-profile.json openclaw:latest

# Create AppArmor profile (/etc/apparmor.d/openclaw):
#include <tunables/global>

profile openclaw flags=(attach_disconnected) {
  #include <abstractions/base>
  deny /proc/sys/** w,
  deny /sys/** w,
  deny /dev/mem rw,
}

# Load profile:
sudo apparmor_parser -r /etc/apparmor.d/openclaw

# Apply to container:
docker run --security-opt apparmor=openclaw openclaw:latest

# Configure Docker daemon (/etc/docker/daemon.json):
{
  "userns-remap": "default"
}

# Restart Docker:
sudo systemctl restart docker

# For rootless Docker:
openclaw-rootless-install.sh

# DANGEROUS - NEVER DO THIS:
# docker run -v /:/host openclaw:latest
# docker run -v /var/run/docker.sock:/var/run/docker.sock openclaw:latest

# SAFE - Mount only necessary paths read-only:
docker run -v ./data:/data:ro openclaw:latest

# Install Falco for runtime threat detection
helm install falco falcosecurity/falco

# Custom Falco rules for container escapes:
- rule: Container Escape Attempt
  condition: >
    spawned_process and
    (proc.name in (docker, kubectl, crictl) or
     fd.name startswith /var/run/docker.sock or
     proc.args contains "nsenter")
  output: "Container escape attempt detected"
  priority: CRITICAL

# Check current versions:
docker version
kubectl version
containerd --version
runc --version

# Update on Ubuntu/Debian:
sudo apt update && sudo apt upgrade docker-ce containerd.io

# Update on RHEL/CentOS:
sudo yum update docker-ce containerd