#6527: feat(docker): add macOS-specific Docker setup with permission fixes

## Problem Running OpenClaw in Docker on macOS fails due to permission and path issues: - macOS users have uid 501, Docker node user has uid 1000 - Volume-mounted files keep host permissions → permission errors - Config paths like `/Users/username/...` do not exist in the container - `gateway.bind: loopback` (default) makes the web UI unreachable Related issues: #2781, #3407, #4076, #2434 ## Solution Add dedicated macOS Docker files: ### Dockerfile.macos - Uses `gosu` for proper user switching - **Installs Bun via npm with pinned version** (`npm install -g bun@1.2.0`) - avoids curl|bash supply chain risk - Smart entrypoint that: - Creates `/Users/<user>` → `/home/node` symlink for path compatibility - Only chowns essential dirs (skips `.git` to avoid hanging on pack files) - Properly drops to node user after permission fixes ### docker-compose.macos.yml - Security hardening: - `no-new-privileges: true` - `cap_drop: ALL` with minimal `cap_add` - `tmpfs` for `/tmp` - `OPENCLAW_HOST_USER` env var for symlink creation - Forces `bind: lan` (overrides loopback default) - **Documents `$USER`/`$HOME` requirements** with .env file instructions - **Removed explicit `container_name`** to allow multiple instances ### docs/platforms/macos-docker.md - Complete setup guide - Troubleshooting section - Security recommendations (exec allowlist, credential permissions) - **Clarified browser curl command is for host**, not container ## Testing - Tested on macOS Sonoma with Docker Desktop - Web UI accessible at http://localhost:18789 - Telegram provider connects successfully - Exec commands work with allowlist ## Usage ```bash # Build docker build -f Dockerfile.macos -t openclaw:macos . # Run docker compose -f docker-compose.macos.yml up -d ``` ## Greptile Feedback Addressed - ✅ [P0] Replaced `curl | bash` with pinned npm install - ✅ [P0] Fixed trailing comma in YAML - ✅ [P1] Removed explicit container_name - ✅ [P2] Added USER/HOME documentation - ✅ [P2] Clarified curl command is for host