Align linux-public Docker CLI with daemon API

[jmcte]

Incident

The linux-public self-hosted runner pool advertises docker-capable, but its Docker CLI cannot communicate with its configured daemon:

client version 1.41 is too old. Minimum supported API version is 1.44

This blocked the final non-root container build in OMT-Global/openclaw-control-plane after all prior checks passed.

Affected evidence:

• linux-public-runner-03, CI run 29159452105, PR OMT-Global/openclaw-control-plane#36
• linux-public-runner-07, CI run 29159506621, PR OMT-Global/openclaw-control-plane#35

Both runners completed checkout, Go setup, formatting, YAML/reference validation, credential scan, vet, race tests, and binary build. The only remaining failure was docker build.

Required change

Release a linux-public runner image/configuration in which the Docker CLI and daemon support a compatible API version. The CLI must support at least API 1.44 for the daemon currently serving the runner socket.

Do not remove or weaken the container-build CI gate as a workaround.

Acceptance criteria

• A runner preflight records Docker client and server versions/API versions and fails clearly when they are incompatible.
• A fresh linux-public runner can execute docker version and docker build from the ordinary runner service account.
• The released runner artifact/version documents the Docker compatibility change and has the normal release validation evidence.
• An OpenClaw Control Plane CI rerun completes its non-root container build on the refreshed runner pool.
• After the release, the operator can reinstall/re-register the runners without reintroducing stale image state.

Rollout

1. Publish the runner-fleet release containing the compatible Docker CLI/daemon contract.
2. Operator reinstalls the affected self-hosted runners from that release.
3. Rerun OpenClaw Control Plane PRs Define workflow routing and a private-repo parity matrix across runner classes #35 and docs: add private-repo runner parity guide #36 and confirm the required CI Gate is green.

[jmcte]

2026-07-13 implementation status

PR #169 adds same-user Docker client/server version and API preflight plus a real scratch build in release smoke validation. PR #170 supplies the transactional release path needed to publish the compatible artifact. Both are green and mergeable, with Pheidon and Athena explicitly requested for non-author review.

This incident remains open for the rollout half of its acceptance criteria: publish the reviewed release, reinstall the public Linux runners without stale image state, and rerun OpenClaw Control Plane PRs #35 and #36 through their container-build gates.