From e327788b533cea77aa950ac1d8429b28f4e15f51 Mon Sep 17 00:00:00 2001
From: Benedikt Schackenberg
 <6381261+BenediktSchackenberg@users.noreply.github.com>
Date: Fri, 3 Apr 2026 18:36:07 +0000
Subject: [PATCH] fix(sandbox): add python -> python3 symlink in base image
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Scripts using the bare `python` command fail inside the sandbox with
'python: command not found' because the base image only installs python3.
This causes tool call failures that can trigger agent hallucination (#1452).

Adding a python -> python3 symlink at /usr/local/bin/python makes
`python script.py`, shebangs like #!/usr/bin/env python, and any
dependency that calls python without a version suffix work out of the box.

Fixes (partially) #1452 — the python symlink eliminates the specific
trigger; the broader hallucination-on-tool-failure issue is tracked
upstream in OpenClaw.

Signed-off-by: Benedikt Schackenberg <6381261+BenediktSchackenberg@users.noreply.github.com>
---
 Dockerfile.base | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/Dockerfile.base b/Dockerfile.base
index 3fd658485..eb0bb9880 100644
--- a/Dockerfile.base
+++ b/Dockerfile.base
@@ -62,7 +62,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         iproute2=6.1.0-3 \
         iptables=1.8.9-2 \
         libcap2-bin=1:2.66-4+deb12u2+b2 \
-    && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/* \
+    # Create python -> python3 symlink so scripts using the bare `python`
+    # command work inside the sandbox without additional setup. (#1452)
+    && ln -s /usr/bin/python3 /usr/local/bin/python
 
 # gosu for privilege separation (gateway vs sandbox user).
 # Install from GitHub release with checksum verification instead of