Persist Chromium DevTools profile

Problem

OpenClaw can connect to the managed browser through CDP, but existing-session attachment modes look for Chromium's DevToolsActivePort file in the browser profile directory.

The image currently forces HOME=/tmp/browser-home and uses --user-data-dir=/tmp/browser-home/.chrome, while the documented persistent volume is /home/sandbox. As a result, browser state is not persisted in the documented volume and DevToolsActivePort is written in a transient, unexpected location.

Changes

• Use /home/sandbox as the default browser home directory.
• Store the Chromium profile in /home/sandbox/.config/google-chrome by default.
• Add BROWSER_HOME and BROWSER_USER_DATA_DIR for explicit overrides.
• Wait for both internal Chromium CDP and the exposed HAProxy CDP endpoint.
• Rewrite DevToolsActivePort with the exposed CDP port so local/container attachment helpers can discover the right endpoint.
• Update README examples and fix the OpenClaw compose variables.\n- Use CI_COMMIT_REF_SLUG for valid Docker tags on branch names containing /.

Validation

• bash -n scripts/sandbox-browser-entrypoint.sh
• git diff --check\n- GitLab CI lint API: valid, with no errors or warnings
• hadolint --ignore DL3008 Dockerfile
• shellcheck scripts/sandbox-browser-entrypoint.sh
• Runner Docker build: chrome:devtools-active-port-test
• Runtime smoke test on runner:
  • container stayed running
  • http://127.0.0.1:9222/json/version returned Chrome CDP metadata
  • /home/sandbox/.config/google-chrome/DevToolsActivePort existed and contained 9222 plus the browser WebSocket path

Prepared by iafred-bot GitLab: @fredbcode