Simplify to named volumes only (cattle not pets)

docker/Dockerfile

@@ -1,6 +1,6 @@
 # OpenClaw Gateway - Custom ARM64 Build
 # Platform: linux/arm64
-# Configs are volume-mounted at runtime, not baked into image
+# All configs via named volumes - copy files in with docker cp
 
 FROM --platform=linux/arm64 ghcr.io/openclaw/openclaw:latest
 
@@ -25,7 +25,6 @@ RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.
     && rm -rf /var/lib/apt/lists/*
 
 # Install gog (Google Workspace CLI) for ARM64
-# Using direct binary install since brew may not be available
 RUN GOG_VERSION=$(curl -s https://api.github.com/repos/steipete/gog/releases/latest | jq -r .tag_name) \
     && curl -L "https://github.com/steipete/gog/releases/download/${GOG_VERSION}/gog_Linux_arm64.tar.gz" \
     | tar -xz -C /usr/local/bin/ \
@@ -36,25 +35,13 @@ COPY docker/tools/* /usr/local/bin/
 COPY docker/bin/* /usr/local/bin/
 RUN chmod +x /usr/local/bin/*
 
-# Create directories for volume-mounted configs
-# These will be mounted at runtime with your secrets and configs
-RUN mkdir -p /data/config /data/secrets /data/gog \
-    && chown -R node:node /data
+# Create directories in the persistent volume location
+RUN mkdir -p /home/node/.openclaw/ssh /home/node/.openclaw/gog \
+    && chown -R node:node /home/node/.openclaw
 
-# Set environment for config paths
-ENV OPENCLAW_CONFIG_DIR=/data/config
-ENV GOG_CONFIG_DIR=/data/gog
-ENV GOOGLE_APPLICATION_CREDENTIALS=/data/secrets/google-credentials.json
-
-# Link gog config to persistent location
-RUN ln -sf /data/gog /home/node/.config/gog
-
-# SSH keys will be stored in persistent volume
-# Create directory and symlink for SSH
-RUN mkdir -p /home/node/.openclaw/ssh \
+# Link gog config and ssh to standard locations
+RUN ln -sf /home/node/.openclaw/gog /home/node/.config/gog \
     && ln -sf /home/node/.openclaw/ssh /home/node/.ssh
 
 # Switch back to node user
 USER node
-
-# Default entrypoint from base image

docker/tools/setup-gog.sh

@@ -1,14 +1,15 @@
 #!/bin/bash
 # setup-gog.sh - Initialize gog with credentials from volume
-# Run this after container starts and secrets are mounted
+# Usage: docker cp client_secret.json container:/home/node/.openclaw/
+#        docker exec container setup-gog.sh
 
 set -e
 
-CREDS_FILE="/data/secrets/google-client-secret.json"
+CREDS_FILE="/home/node/.openclaw/google-client-secret.json"
 
 if [ ! -f "$CREDS_FILE" ]; then
     echo "ERROR: Google client secret not found at $CREDS_FILE"
-    echo "Mount your secrets JSON to /data/secrets/google-client-secret.json"
+    echo "Copy it in first: docker cp client_secret.json \$(docker ps -q -f name=openclaw):/home/node/.openclaw/google-client-secret.json"
     exit 1
 fi