Hosting OpenClaw on a VPS: Installation, Docker and Gateway Hardening

OpenClaw is an open-source AI assistant that does more than chat: it works with your tools and channels. Instead of only answering questions, it can plan tasks, send reminders, sort messages and trigger actions.

That is why hosting needs a clear strategy. Once an agent gets access to messaging channels, automations or shell commands, "runs locally on my laptop" and "I'll secure it later" no longer cut it. You need stability, isolation and security boundaries from the start.

In this guide I show you step by step how to run OpenClaw on a VPS, which hardware the OpenClaw docs list, how to connect Telegram, WhatsApp and Discord, and how to secure the gateway.

1. What is OpenClaw?

OpenClaw is an open-source AI assistant under the MIT license, built by Peter Steinberger and the community and maintained by the OpenClaw Foundation (OpenClaw repository, as of Nov 8, 2026).

The key difference from classic chat frontends:

• OpenClaw connects language models to channels such as Discord, iMessage, Slack, Teams, Telegram and WhatsApp, plus more than 20 others (OpenClaw README, as of Nov 8, 2026). iMessage needs a Mac with Messages; on a Linux VPS it only works through a Mac over SSH (OpenClaw docs, as of Nov 8, 2026).
• With its built-in scheduler, OpenClaw wakes the agent at scheduled times and can send the result to a channel (OpenClaw docs, as of Nov 8, 2026). It stores memories as Markdown files in the workspace, ~/.openclaw/workspace (OpenClaw docs, as of Nov 8, 2026).
• You find skills and plugins in ClawHub, the public registry for OpenClaw. Anyone can upload, so check the scan result on the detail page before installing (OpenClaw docs, as of Nov 8, 2026).

That is powerful, because your agent does not just react, it works for you. It is also risky, because you can de facto give an AI operational rights.

Rule of thumb: A chatbot without tool access is a text system. An agent with shell/tooling is a small operating-system project. Treat it that way.

2. Why VPS instead of local?

A local machine fits when you actively use it and need local file access or a visible browser. If you had gateway disconnects, the OpenClaw docs name a VPS as the default (OpenClaw docs, as of Nov 8, 2026).

For channel agents, "always online" is not just comfort, it matters functionally. If the process is gone during reboots or sleep mode, scheduled jobs do not run and channels reconnect.

3. Hardware Requirements

For OpenClaw, resource needs depend mainly on four factors:

1. Number of parallel channels
2. Team size and concurrent use
3. Cloud API vs. local models
4. Side processes (queue, logs, tools, browser automation)

Starting points

The AI assistant calculator estimates the needs of your setup (guidance from RackDiff).

Image build and RAM

Building a Docker image from source needs 6 GB of RAM or more, per the OpenClaw docs. On smaller servers, use the prebuilt image ghcr.io/openclaw/openclaw (OpenClaw docs, as of Nov 8, 2026).

4. Installation

The OpenClaw docs name the installer as the default path, plus npm and Docker. Docker is optional and isolates the gateway in a container (OpenClaw docs, as of Nov 8, 2026).

Option A: Installer or npm

The installer sets up Node.js if needed, installs OpenClaw and starts onboarding (OpenClaw docs, as of Nov 8, 2026):

# Installer per OpenClaw docs: installs Node.js if needed, then OpenClaw, and starts onboarding
curl -fsSL https://openclaw.ai/install.sh | bash

Manually with npm you need Node.js 24.16.0+ or 26.1.0+; Node 22, 23 and 25 are not supported (OpenClaw docs, as of Nov 8, 2026):

# Node.js 24.x via NodeSource (command per OpenClaw docs)
curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash -
sudo apt-get install -y nodejs
node -v   # required: 24.16.0+ or 26.1.0+; for security the docs name 24.22.1+ or 26.12.1+

# global npm directory in home, so npm installs without sudo
mkdir -p "$HOME/.npm-global"
npm config set prefix "$HOME/.npm-global"
export PATH="$HOME/.npm-global/bin:$PATH"   # also add this line to ~/.bashrc

npm install -g openclaw@latest --allow-scripts=openclaw   # npm 11.15 and older: without --allow-scripts
openclaw onboard --install-daemon

Check:

openclaw --version
openclaw doctor
openclaw gateway status

On Linux, onboarding sets up a systemd user service, openclaw-gateway.service (OpenClaw docs, as of Nov 8, 2026).

Option B: Docker

You need Docker Engine with Compose v2 from the apt repository; per Docker, the convenience script is not meant for production systems (Docker docs, as of Nov 8, 2026). Use Docker 28.0.0 or newer: in older versions, ports bound to 127.0.0.1 are reachable from the same L2 segment (Docker docs, as of Nov 8, 2026).

The Compose template publishes the ports without a host IP, so Docker exposes them on all addresses and bypasses ufw (OpenClaw repository, Docker docs, Docker docs, as of Nov 8, 2026). That is why you bind them to 127.0.0.1 before the first start.

git clone https://github.com/openclaw/openclaw.git
cd openclaw

Before the first start, bind the ports of the openclaw-gateway service in docker-compose.yml to loopback (otherwise the template publishes them on all addresses):

    ports:
      - "127.0.0.1:${OPENCLAW_GATEWAY_PORT:-18789}:18789"
      - "127.0.0.1:${OPENCLAW_BRIDGE_PORT:-18790}:18790"
      - "127.0.0.1:${OPENCLAW_MSTEAMS_PORT:-3978}:3978"

Then start and check (OpenClaw docs, as of Nov 8, 2026):

export OPENCLAW_IMAGE="ghcr.io/openclaw/openclaw:<version>"   # prebuilt image, version tag instead of latest
./scripts/docker/setup.sh                                     # creates the gateway token in .env and starts the gateway
docker compose logs -f --tail=100 openclaw-gateway
curl -fsS http://127.0.0.1:18789/healthz

• In the Docker setup, CLI commands run through the openclaw-cli service (docker compose run --rm openclaw-cli …).
• Check the port change after every git pull.
• The template keeps the state under ~/.openclaw on the host (OpenClaw docs, as of Nov 8, 2026).

Option C: One-click templates

If your host offers a preconfigured OpenClaw template, check first:

• Is the gateway port exposed publicly?
• Is auth enabled by default?
• Are update strategy and backup paths documented?

Clarify these questions with the host before using the template.

5. Connecting channels

Telegram

Steps per the OpenClaw docs (OpenClaw docs, as of Nov 8, 2026):

1. Open @BotFather in Telegram, send /newbot, save the token.
2. Do not pass the token in a command; put it in ~/.openclaw/.env (Docker: .env in the repo directory) as TELEGRAM_BOT_TOKEN=…; this applies to the default account, alternatively tokenFile.
3. Restart the gateway (openclaw gateway restart), check status with openclaw channels status --probe.
4. Message the bot, then openclaw pairing list telegram and openclaw pairing approve telegram <CODE> (code valid for one hour).
5. Groups: allow the group ID under channels.telegram.groups; turn off privacy mode with /setprivacy or make the bot an admin, then re-add the bot.

WhatsApp (QR-based session)

Steps per the OpenClaw docs (OpenClaw docs, as of Nov 8, 2026):

1. The docs advise a separate number.
2. Run openclaw channels login --channel whatsapp; login works via QR only. On remote hosts, get the QR to your phone live, screenshots can expire.
3. Approve the first DM: openclaw pairing approve whatsapp <CODE>.
4. Credentials live under ~/.openclaw/credentials/whatsapp/<accountId>/: include them in backups and keep them private.

Discord

Steps per the OpenClaw docs (OpenClaw docs, as of Nov 8, 2026):

1. Create a "New Application" in the Developer Portal; on the "Bot" page, "Reset Token" creates the first token.
2. Enable Message Content Intent; the docs advise Server Members Intent, Presence Intent only if needed.
3. OAuth2 URL Generator: scopes bot and applications.commands; permissions View Channels, Send Messages, Read Message History, Embed Links, Attach Files.
4. Set the token as DISCORD_BOT_TOKEN on the host, send the bot a DM, openclaw pairing approve discord <CODE>.

Practical tip: Connect channels one at a time and check each with openclaw channels status --probe (OpenClaw docs, as of Nov 8, 2026).

6. Security

An agent with channel and tool access is a potential attack vector. The following points are based on the security pages of the OpenClaw docs.

6.1 Keep the gateway off the public internet

On a normal host, the gateway binds to loopback (port 18789); without authentication it must never run on 0.0.0.0 (OpenClaw docs, as of Nov 8, 2026).

For remote access, the docs name Tailscale Serve, with the gateway staying on loopback, and an SSH tunnel as fallback. Behind a reverse proxy, set gateway.trustedProxies and have X-Forwarded-For overwritten instead of appended; public hosts only via wss:// (OpenClaw docs, as of Nov 8, 2026).

SSH tunnel example, then open http://127.0.0.1:18789/ in the browser:

ssh -N -L 18789:127.0.0.1:18789 user@your-vps

6.2 Gateway authentication

Auth is enabled by default, onboarding creates a token (gateway.auth.mode: "token"). No auth (none) only on trusted loopback (OpenClaw docs, as of Nov 8, 2026). The token variable is OPENCLAW_GATEWAY_TOKEN (OpenClaw docs, as of Nov 8, 2026):

# ~/.openclaw/.env (in the Docker setup: .env in the repo directory)
OPENCLAW_GATEWAY_TOKEN=<long-random-token>

6.3 Firewall

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status verbose

Do not add a public rule for port 18789 (OpenClaw docs, as of Nov 8, 2026). Ports published by Docker bypass ufw; that is why Option B binds them to 127.0.0.1 (Docker docs, as of Nov 8, 2026). With Tailscale Serve the gateway stays on loopback, so no port rule is needed (OpenClaw docs, as of Nov 8, 2026).

Optionally, the host's cloud firewall allows only TCP 22 from your own admin network (OpenClaw docs, as of Nov 8, 2026).

6.4 Dedicated service accounts

• No root login for agent processes
• No personal OAuth tokens directly in the agent
• Use separate technical accounts for production integrations

6.5 Prompt injection

The OpenClaw docs treat links, attachments and pasted instructions as hostile by default (OpenClaw docs, as of Nov 8, 2026).

Countermeasures per the OpenClaw docs (OpenClaw docs, as of Nov 8, 2026):

• Risky tools (exec, browser, web_fetch, web_search) only for trusted agents or via allowlist
• Sensitive tool execution in a sandbox, secrets outside the reachable file system
• Have a reader agent without tools summarize untrusted content
• Critical commands only with approval

6.6 Model choice

For agents with tool, file or network access, the OpenClaw docs advise a current-generation model from the upper performance tier; smaller or older models should not run agents with tools. Model choice is only the first layer of protection (OpenClaw docs, as of Nov 8, 2026).

6.7 Baseline checklist

The hardened baseline in the OpenClaw docs covers these points:

• Network boundary: gateway on loopback, access via Tailscale Serve or SSH tunnel (OpenClaw docs, as of Nov 8, 2026).
• Authentication: token auth with a long random token (OpenClaw docs, as of Nov 8, 2026).
• Secrets: provider and channel tokens in ~/.openclaw/.env or, in the Docker setup, in the .env created by setup.sh, not in versioned files. OpenClaw ignores a .env in the working directory for provider credentials (OpenClaw docs, as of Nov 8, 2026).
• Channels: DMs with dmPolicy: "pairing", groups only with mention (requireMention: true) (OpenClaw docs, as of Nov 8, 2026).
• Tools: profile messaging, exec with security: "deny" and ask: "always", fs.workspaceOnly: true (OpenClaw docs, as of Nov 8, 2026).
• Audit: run openclaw security audit regularly (OpenClaw docs, as of Nov 8, 2026).
• Separation: one gateway per trust boundary, ideally separate OS users (OpenClaw docs, as of Nov 8, 2026).
• Backups: see section 8, backup and rollback strategy (OpenClaw docs, as of Nov 8, 2026).

The Docker template starts two services, openclaw-gateway and openclaw-cli; exactly one gateway runs per state volume (OpenClaw docs, as of Nov 8, 2026). Add a reverse proxy, log shipping and a backup job as needed.

With agents in particular, operational security does not come from a single tool but from several small security boundaries.

7. Cost factors

Running costs are the VPS plan plus your model provider usage. OpenClaw itself is MIT-licensed (OpenClaw repository, as of Nov 8, 2026). VPS prices incl. VAT are in the VPS comparison; your model provider lists model costs.

Local models save calls to the model provider but need more RAM and CPU. Per the OpenClaw docs, OpenClaw needs a large context; smaller or quantized models cut the context and raise the prompt injection risk (OpenClaw docs, as of Nov 8, 2026). More in Ollama on a VPS.

Ongoing effort

• Operating time: updates, incident fixes, monitoring
• Backups: storage snapshots or external backup targets
• Security effort: regular token rotation and access reviews
• Downtime costs: when agent flows are part of production processes

These points do not argue against self-hosting. They help you plan realistically, not too tight.

Prices compared

Current prices incl. VAT are in the VPS comparison.

8. Troubleshooting

Gateway does not start: lock or port in use

Do not delete lock files by hand (OpenClaw docs, as of Nov 8, 2026):

openclaw gateway status --deep
openclaw gateway recover-lock

recover-lock shows which process holds the lock. After stopping that process, confirm with the printed openclaw gateway recover-lock --confirm <fingerprint>.

WhatsApp disconnects

Diagnose with openclaw channels status --probe, openclaw doctor and openclaw logs --follow. If that does not help: back up the account's auth directory, log out, log in again (OpenClaw docs, as of Nov 8, 2026).

Image build aborts (Killed, exit code 137)

A build from source needs 6 GB of RAM or more. Use a larger server or the prebuilt image (OpenClaw docs, as of Nov 8, 2026).

Config missing after interrupted onboarding

openclaw doctor checks the configuration; then restart onboarding (openclaw onboard). Do not delete the state directory ~/.openclaw: it holds credentials, channel sessions and memory (OpenClaw docs, OpenClaw docs, as of Nov 8, 2026).

Discord: bot does not respond

Is Message Content Intent enabled? Restart the gateway after changing intents. Diagnose with openclaw doctor, openclaw channels status --probe and openclaw logs --follow (OpenClaw docs, as of Nov 8, 2026).

Bonus: backup and rollback strategy

Once OpenClaw is part of real workflows, you need a clear rollback path (OpenClaw docs, as of Nov 8, 2026):

1. Before every update, create a backup (commands below).
2. Update in a maintenance window with active log tailing.
3. Functional check: /healthz, then one message per channel.
4. Rollback: openclaw update --tag <version> --dry-run, then without --dry-run. A downgrade does not undo configuration and database migrations.

Backup for installer or npm installs:

mkdir -p ~/Backups/openclaw
openclaw backup create --output ~/Backups/openclaw --verify

In the Docker setup, put OPENCLAW_IMAGE with a fixed version tag permanently into the .env in the repo directory; Docker Compose reads this file for ${…} placeholders, and a variable set in the shell takes precedence (Docker docs, as of Nov 8, 2026). For an update, change the tag there. Back up the state first: stop the gateway, snapshot the ~/.openclaw directory or the volume. The update per the docs (OpenClaw docs, as of Nov 8, 2026):

docker compose pull openclaw-gateway openclaw-cli
docker compose stop openclaw-gateway
docker compose up -d openclaw-gateway

• Never copy only the .sqlite file of a running database.
• Backups contain credentials, so permissions for the owner only.

That way you can restore the last working state if needed.

First-week launch check

After go-live, a short daily check pays off:

• Day 1-2: Check all channel connections and reconnect behavior after reboots.
• Day 3-4: Watch latency spikes and API error rates at peak times.
• Day 5-6: Use deliberately manipulated inputs to check whether approvals and tool limits hold, and run openclaw security audit (OpenClaw docs, as of Nov 8, 2026).
• Day 7: Review the logs and adjust cooldowns, timeouts, rate limits.

Such a mini operations cycle keeps small configuration errors from growing into bigger security or stability problems.

9. Conclusion

On a VPS, OpenClaw runs around the clock without your laptop having to be on; state, memory and credentials live on your server (OpenClaw repository, as of Nov 8, 2026). If you use a cloud model provider, it processes the content the agent sends to the model.

Besides the setup, the security architecture is decisive: no open gateway, clean auth, clear permissions and observability from day one.

A small, secured server is enough to start; the OpenClaw docs name 2 GB of RAM or more for several channels (OpenClaw docs, as of Nov 8, 2026). Security first, then scaling.

If you are still unsure about server size, start with the calculator and then scale with real load.

The AI assistant calculator estimates the resource needs.