feat(docker): add bootstrap init script to source-built images

Wire entrypoint.sh into Dockerfile, Dockerfile.full, and Dockerfile.heavy
so the agent can install tools via bootstrap.sh that persist across restarts.
Errors are logged to bootstrap.error.log and documented in AGENT.md.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker/Dockerfile

@@ -33,11 +33,14 @@ COPY --from=builder /src/build/picoclaw /usr/local/bin/picoclaw
 RUN addgroup -g 1000 picoclaw && \
     adduser -D -u 1000 -G picoclaw picoclaw
 
+# Copy entrypoint script
+COPY docker/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
 # Switch to non-root user
 USER picoclaw
 
 # Run onboard to create initial directories and config
 RUN /usr/local/bin/picoclaw onboard
 
-ENTRYPOINT ["picoclaw"]
+ENTRYPOINT ["/entrypoint.sh"]
-CMD ["gateway"]

docker/Dockerfile.full

@@ -37,8 +37,11 @@ RUN curl -LsSf https://astral.sh/uv/install.sh | sh && \
 # Copy binary
 COPY --from=builder /src/build/picoclaw /usr/local/bin/picoclaw
 
+# Copy entrypoint script
+COPY docker/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
 # Create picoclaw home directory
 RUN /usr/local/bin/picoclaw onboard
 
-ENTRYPOINT ["picoclaw"]
+ENTRYPOINT ["/entrypoint.sh"]
-CMD ["gateway"]

docker/Dockerfile.heavy

@@ -53,6 +53,10 @@ RUN deluser node 2>/dev/null; delgroup node 2>/dev/null; \
     addgroup -g 1000 picoclaw 2>/dev/null; \
     adduser -D -u 1000 -G picoclaw -h /home/picoclaw picoclaw 2>/dev/null || true
 
+# Copy entrypoint script
+COPY docker/entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
 USER picoclaw
 
 # Run onboard to create initial directories and config
@@ -63,5 +67,4 @@ COPY --chown=picoclaw:picoclaw workspace/ /home/picoclaw/.picoclaw/workspace/
 
 VOLUME /home/picoclaw/.picoclaw/workspace
 
-ENTRYPOINT ["picoclaw"]
+ENTRYPOINT ["/entrypoint.sh"]
-CMD ["gateway"]

workspace/AGENT.md

@@ -43,3 +43,11 @@ be practical, accurate, and efficient.
 - Improve through feedback and continued iteration
 
 Read `SOUL.md` as part of your identity and communication style.
+
+## Docker Bootstrap
+
+When running inside Docker, a script at `~/.picoclaw/workspace/bootstrap.sh` runs automatically on every container start. You can modify this file to install tools that persist across restarts.
+
+- **Install a tool**: add an idempotent install command to `bootstrap.sh` (check if already installed before installing)
+- **Check for errors**: if a previous bootstrap failed, read `~/.picoclaw/workspace/bootstrap.error.log` — it contains the full error output
+- **Changes take effect**: on the next container restart (the script runs before the gateway starts)