fix(docker): clarify HEALTHCHECK override contract and add probe to test image

Address CodeRabbit feedback: expand the Dockerfile.base HEALTHCHECK
comment to explicitly document that child images exposing services MUST
override the baseline probe, and add an explicit HEALTHCHECK to
test/Dockerfile.sandbox so it does not inherit a potentially
service-oriented check that would produce false positives.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Miyoung Choi <miyoungc@nvidia.com>

Author: miyoungc

Dockerfile.base

@@ -128,8 +128,11 @@ RUN mkdir -p /sandbox/.openclaw-data/agents/main/agent \
 RUN npm install -g openclaw@2026.3.11 \
     && pip3 install --no-cache-dir --break-system-packages "pyyaml==6.0.3"
 
-# Basic health check for the base image.  The base doesn't run services,
-# so just verify the Node.js runtime is functional.  The production
-# Dockerfile overrides this with a gateway-specific check.
+# Baseline health check — validates the Node.js runtime only.
+# The base image doesn't run services, so a process-level check is the
+# best we can do here.  **Child images that expose services MUST override
+# this** with a service-specific probe (e.g., curl the gateway /health
+# endpoint).  The production Dockerfile already does so; any new child
+# Dockerfile should add its own HEALTHCHECK instruction as well.
 HEALTHCHECK --interval=30s --timeout=5s --start-period=45s --retries=3 \
     CMD node -e "process.exit(0)" || exit 1

test/Dockerfile.sandbox

@@ -86,4 +86,9 @@ RUN mkdir -p /sandbox/openclaw-state/extensions /sandbox/openclaw-state/skills /
     && printf '%s\n' '---' 'name: override-hook' 'description: Override hook fixture' '---' > /sandbox/openclaw-state/hooks/demo-hook/HOOK.md \
     && printf '%s\n' 'export default async function overrideHook() {}' > /sandbox/openclaw-state/hooks/demo-hook/handler.js
 
+# Test image: no long-running service, so just verify the runtime works.
+# Overrides any inherited HEALTHCHECK to avoid false-positive probes.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD node -e "process.exit(0)" || exit 1
+
 ENTRYPOINT ["/bin/bash"]