WiP feat: Docker CLI for sandbox detection + Odoo WASM channel

Dockerfile

@@ -36,7 +36,13 @@ RUN cargo build --release --bin ironclaw
 FROM debian:bookworm-slim
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates libssl3 \
+    ca-certificates libssl3 curl gnupg \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Docker CLI (for sandbox mode detection and container management)
+RUN curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg \
+    && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/debian bookworm stable" > /etc/apt/sources.list.d/docker.list \
+    && apt-get update && apt-get install -y --no-install-recommends docker-ce-cli \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=builder /app/target/release/ironclaw /usr/local/bin/ironclaw

Dockerfile.worker

@@ -62,8 +62,18 @@ RUN useradd -m -u 1000 -s /bin/bash sandbox \
     && mkdir -p /home/sandbox/.claude \
     && chown sandbox:sandbox /home/sandbox/.claude
 
+# Pre-install MCP config for Odoo MCP access in Claude Code mode
+COPY --chown=sandbox:sandbox mcp-config.json /home/sandbox/.mcp.json
+
+# Create entrypoint script that copies MCP config to /workspace at startup
+# Claude Code looks for .mcp.json in the project root (/workspace)
+RUN echo '#!/bin/bash' > /home/sandbox/entrypoint.sh && \
+    echo 'cp /home/sandbox/.mcp.json /workspace/.mcp.json 2>/dev/null || true' >> /home/sandbox/entrypoint.sh && \
+    echo 'exec ironclaw "$@"' >> /home/sandbox/entrypoint.sh && \
+    chmod +x /home/sandbox/entrypoint.sh
+
 USER sandbox
 WORKDIR /workspace
 
 # The orchestrator passes the full command via Docker cmd.
-ENTRYPOINT ["ironclaw"]
+ENTRYPOINT ["/home/sandbox/entrypoint.sh"]

channels-src/odoo

@@ -0,0 +1 @@
+../../../channels-src/odoo

mcp-config.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "odoo": {
+      "type": "http",
+      "url": "http://odoo-mcp:9000"
+    }
+  }
+}

src/orchestrator/job_manager.rs

@@ -365,7 +365,7 @@ impl ContainerJobManager {
             binds: if binds.is_empty() { None } else { Some(binds) },
             memory: Some((memory_mb * 1024 * 1024) as i64),
             cpu_shares: Some(self.config.cpu_shares as i64),
-            network_mode: Some("bridge".to_string()),
+            network_mode: Some("ironclaw-gateway-infra_internal".to_string()),
             extra_hosts: Some(vec!["host.docker.internal:host-gateway".to_string()]),
             cap_drop: Some(vec!["ALL".to_string()]),
             cap_add: Some(vec!["CHOWN".to_string()]),

src/tools/wasm/storage.rs

@@ -156,6 +156,7 @@ impl StoredCapabilities {
                 max_request_bytes: self.max_request_body_bytes as usize,
                 max_response_bytes: self.max_response_body_bytes as usize,
                 timeout: std::time::Duration::from_secs(self.http_timeout_secs as u64),
+                ..Default::default()
             });
         }