openclaw - 💡(How to fix) Fix [Bug]: v2026.4.27 fails during config load with EACCES on /var/lib/openclaw/plugin-runtime-deps [4 comments, 3 participants]

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

On v2026.4.27, the gateway fails during config load with EACCES when OpenClaw tries to create /var/lib/openclaw/plugin-runtime-deps/..., causing a restart loop. In this deployment the gateway is intentionally sealed and runtime dependency installation is not allowed; v2026.4.23 works in the same setup.

Steps to reproduce

1. Start from a working Docker Desktop / Windows / WSL2 setup on v2026.4.23.

2. Use a sealed gateway deployment where runtime dependency installation is intentionally restricted:

   • no runtime pip/uv/poetry installs
   • no local venv creation inside the container
   • only /home/node/.openclaw is writable for config/data
   • /var/lib/openclaw/plugin-runtime-deps is not writable for the runtime user

3. Update the repository to v2026.4.27.

4. Rebuild and recreate the gateway container.

5. Start the gateway container.

6. Follow the logs with:

   docker logs -f openclaw-openclaw-gateway-1

7. Observe that the container enters a restart loop and repeatedly logs an EACCES error while reading /home/node/.openclaw/openclaw.json.

Expected result: The gateway should load the config successfully and continue normal startup.

Actual result: The gateway fails during config load because it tries to create a directory under /var/lib/openclaw/plugin-runtime-deps and gets EACCES, after which the container restarts.

Expected behavior

The gateway should read and validate openclaw.json successfully, then continue normal startup and become healthy.

Actual behavior

On v2026.4.27, the gateway fails during config load and enters a restart loop. The error is:

EACCES: permission denied, mkdir '/var/lib/openclaw/plugin-runtime-deps/openclaw-2026.4.27-f53b52ad6d21'

In this deployment, the gateway container is intentionally sealed: runtime dependency installation is not allowed, and /var/lib/openclaw/plugin-runtime-deps is not writable for the runtime user by design.

The stack trace shows this happens while resolving bundled provider policy surfaces during config normalization / applyModelDefaults, before normal gateway startup completes.

OpenClaw version

2026.2.27

Operating system

Windows 11

Install method

Docker Desktop on Windows / WSL2. Repository updated to v2026.4.27, then gateway container rebuilt and recreated. Container: openclaw-openclaw-gateway-1 Image: openclaw:gateway-secure-patched This deployment intentionally uses a sealed gateway container: - no runtime pip/uv/poetry installs - runtime dependency expansion is restricted - only /home/node/.openclaw is writable for config/data

Model

openai/gpt-5.4-mini

Provider / routing chain

Configured routing includes OpenAI, Gemini, and Ollama-backed models. The failure occurs during provider/config normalization before the selected runtime model is actually used.

Additional provider/model setup details

The issue appears while processing model defaults / provider policy surfaces during config loading.

Relevant config area:

• agents.defaults.model.primary / fallbacks
• agent model.primary / fallbacks entries

The crash is triggered before normal gateway startup, not during an actual user model call.

Logs, screenshots, and evidence

Relevant log excerpt:

Failed to read config at /home/node/.openclaw/openclaw.json Error: EACCES: permission denied, mkdir '/var/lib/openclaw/plugin-runtime-deps/openclaw-2026.4.27-f53b52ad6d21'

[openclaw] CLI failed: Error: EACCES: permission denied, mkdir '/var/lib/openclaw/plugin-runtime-deps/openclaw-2026.4.27-f53b52ad6d21'

Stack trace includes:
- ensureBundledPluginRuntimeDeps
- prepareBundledPluginRuntimeRoot
- loadBundledPluginPublicArtifactModuleSync
- tryLoadBundledProviderPolicySurface
- resolveBundledProviderPolicySurface
- normalizeProviderConfigForConfigDefaults
- applyModelDefaults
- materializeRuntimeConfig
- validateConfigObject

The container restart policy is:
unless-stopped

Observed behavior:
- container starts
- exits during config load
- Docker restarts it
- the same EACCES error repeats

Impact and severity

High. The gateway never reaches normal startup on v2026.4.27 in this setup, so OpenClaw is unusable until rolling back to v2026.4.23.

Additional information

Previous working version: v2026.4.23

Earlier failing versions in the same setup:

• v2026.4.24
• v2026.4.25
• v2026.4.26

Those versions failed later in startup around “starting channels and sidecars...”. v2026.4.27 fails earlier during config load with EACCES on /var/lib/openclaw/plugin-runtime-deps.