[Bug] "gateway Running as non-root — privilege separation disabled" message leaks into Telegram responses

[manohar6839]

Description

When running NemoClaw with Telegram channel, the startup message gateway Running as non-root (uid=998) — privilege separation disabled from nemoclaw-start.sh (line 184) leaks into every Telegram response, appearing as the first line before the agent's actual reply.

Environment

• NemoClaw on Hetzner VPS (Ubuntu 24, 8GB RAM)
• OpenClaw v2026.3.24
• Telegram channel
• Sandbox running as uid=998 (non-root, as intended)

Root Cause

/usr/local/bin/nemoclaw-start (the container entrypoint, copied from scripts/nemoclaw-start.sh) has an echo statement at line 184:

if [ "$(id -u)" -ne 0 ]; then
  echo "[gateway] Running as non-root (uid=$(id -u)) — privilege separation disabled"
  export HOME=/sandbox

This echo goes to stdout, which gets captured by the Telegram bridge and prepended to agent responses.

Fix

Comment out or suppress the echo on line 184 of scripts/nemoclaw-start.sh:

if [ "$(id -u)" -ne 0 ]; then
  # echo "[gateway] Running as non-root (uid=$(id -u)) — privilege separation disabled"
  export HOME=/sandbox

Or redirect it to stderr so it only appears in logs, not in Telegram output:

  echo "[gateway] Running as non-root (uid=$(id -u)) — privilege separation disabled" >&2

Workaround (for current users)

Patch the running container directly:

docker exec openshell-cluster-nemoclaw kubectl exec -n openshell <sandbox-name> -- sed -i '184s/.*echo.*privilege separation.*/  # suppressed/' /usr/local/bin/nemoclaw-start

Then restart the gateway inside the sandbox.

Suggested Fix

Redirect the message to stderr (>&2) instead of stdout so it appears in logs but does not leak into channel responses.

[latenighthackathon]

Submitted a fix in PR #1072 — redirects all \ and \ echo statements to stderr so they don't leak into stdout-captured output (e.g., Telegram bridge responses).

[latenighthackathon]

This is addressed by PR #1072, which redirects all operational log messages in nemoclaw-start.sh to stderr. The [gateway] Running as non-root message at line 295 is one of the echo statements that PR redirects via >&2, preventing it from leaking into stdout where the Telegram bridge captures it.

[khun84]

@manohar6839 may i know how u restart the gateway in the sandbox? I tried this once, somehow the processes were mess up. Dont quit remember how i screw it up