Deploy OpenClaw

Everything you need to get OpenClaw running on your own server: a one-command install script for a fresh Ubuntu VPS, the official Docker path, and working notes on updating, backups, and where to host it.

Don't want to run a server? Deploy always-on on Agent37 - from $4/mo.

Every command below comes from the official docs at docs.openclaw.ai (install, Docker, and VPS guides). No invented flags, no unofficial images.

Quick Start

One command on a fresh Ubuntu VPS

SSH into a fresh Ubuntu or Debian VPS as root and run:

curl -fsSL https://raw.githubusercontent.com/agent37-platform/deploy-openclaw/main/deploy.sh | bash

Prefer to read scripts before running them (you should)? Clone this repo and run bash deploy.sh.

The script installs Docker, clones the official OpenClaw repo, creates persistent config and workspace directories, writes a .env with generated secrets, starts the gateway with Docker Compose, and waits for the health check. It is idempotent: re-running keeps your existing repo, config, and secrets.

The same thing, step by step

This is the documented Docker-on-VPS flow (the official Hetzner/VPS guides), which deploy.sh automates:

# base packages + Docker
apt-get update
apt-get install -y git curl ca-certificates
curl -fsSL https://get.docker.com | sh

# official repo: its docker-compose.yml is the deployment
git clone https://github.com/openclaw/openclaw.git
cd openclaw

# persistent state, owned by the container user (node, uid 1000)
mkdir -p /root/.openclaw/workspace
chown -R 1000:1000 /root/.openclaw

Create .env in the repo root (see .env.example in this repo for the full annotated set):

OPENCLAW_IMAGE=ghcr.io/openclaw/openclaw:latest
OPENCLAW_GATEWAY_TOKEN=<openssl rand -hex 32>
OPENCLAW_GATEWAY_BIND=lan
OPENCLAW_GATEWAY_PORT=18789
OPENCLAW_CONFIG_DIR=/root/.openclaw
OPENCLAW_WORKSPACE_DIR=/root/.openclaw/workspace
GOG_KEYRING_PASSWORD=<openssl rand -hex 32>

Then start it:

docker compose up -d

Setting OPENCLAW_IMAGE pulls the pre-built image from the official registry (ghcr.io/openclaw/openclaw, mirrored at openclaw/openclaw on Docker Hub). Official tags: latest, main, version tags like 2026.2.26, and a -browser variant that bundles Chromium. Leave OPENCLAW_IMAGE unset to build locally, which needs 2 GB+ RAM.

The upstream repo also ships ./scripts/docker/setup.sh, an interactive setup that automates the compose flow.

Bare metal (no Docker)

Needs Node 22.22.3+, 24.15+, or 25.9+ (Node 24 is the default target). Official installer:

curl -fsSL https://openclaw.ai/install.sh | bash

Skip the interactive onboarding with curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard, or use npm:

npm install -g openclaw@latest
openclaw onboard --install-daemon   # installs the systemd service on Linux

Verify:

openclaw --version
openclaw doctor
openclaw gateway status

On low-power or ARM boxes the docs recommend a Node compile cache and disabling respawn:

grep -q 'NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache' ~/.bashrc || cat >> ~/.bashrc <<'EOF'
export NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache
mkdir -p /var/tmp/openclaw-compile-cache
export OPENCLAW_NO_RESPAWN=1
EOF
source ~/.bashrc

And for the systemd unit (sudo systemctl edit openclaw-gateway.service): Restart=always, RestartSec=2, TimeoutStartSec=90.

Access the dashboard

The gateway listens on port 18789 and is not meant to be exposed to the internet. From your laptop:

ssh -N -L 18789:127.0.0.1:18789 root@YOUR_VPS_IP

Then open http://127.0.0.1:18789/ and paste the gateway token from the .env file. The tunnel needs AllowTcpForwarding local in the server's /etc/ssh/sshd_config (restart sshd after changing it).

Health endpoints need no auth:

curl -fsS http://127.0.0.1:18789/healthz   # liveness
curl -fsS http://127.0.0.1:18789/readyz    # readiness

Updating

Docker path:

cd ~/openclaw && git pull && docker compose pull && docker compose up -d

Pin OPENCLAW_IMAGE to a version tag in .env (for example ghcr.io/openclaw/openclaw:2026.2.26) if you want deploys you can reproduce and roll back by editing one line.

Bare metal:

openclaw update            # detects the install type; --channel beta|extended-stable|dev, --dry-run
openclaw doctor
openclaw gateway restart
openclaw health

Rollback on package installs: openclaw update --tag <known-good-version>. Auto-update is off by default; it is enabled via update.auto.enabled in ~/.openclaw/openclaw.json.

Backing up the workspace

Bare metal has a first-class command:

mkdir -p ~/Backups/openclaw
openclaw backup create --output ~/Backups/openclaw --verify

On the Docker/VPS setup, all state lives in the bind-mounted config dir plus the .env (which holds your gateway token and keyring password):

tar -czf openclaw-backup-$(date +%F).tar.gz -C /root .openclaw openclaw/.env
scp root@YOUR_VPS_IP:openclaw-backup-*.tar.gz .

Run a backup before major updates. Restoring is the reverse: untar to /root, chown -R 1000:1000 /root/.openclaw, docker compose up -d.

Common errors

Symptom	Cause and fix
Build dies with exit 137	OOM during the local image build (happens at 1 GB RAM). Use the pre-built image via OPENCLAW_IMAGE, or get 2 GB+.
Permission errors on config or workspace	The container runs as node (uid 1000). chown -R 1000:1000 /root/.openclaw.
Dashboard unreachable from your laptop	Use the SSH tunnel above; check AllowTcpForwarding local in /etc/ssh/sshd_config. Don't open 18789 to the world instead.
Agent can't reach a service running on the VPS itself	Inside the container 127.0.0.1 is the container. Use host.docker.internal.
Installer complains about Node	Bare-metal installs need Node 22.22.3+, 24.15+, or 25.9+.
Slow or flappy on a tiny ARM box	Apply the documented NODE_COMPILE_CACHE + OPENCLAW_NO_RESPAWN=1 tuning above.
Compose commands do nothing useful	Run docker compose from the repo root (where docker-compose.yml lives).

Where to run it

Option	Cost	Good	Watch out
Your own VPS (Hetzner, DigitalOcean, Lightsail, ...)	~$4-6/mo	Full control; deploy.sh works as-is on any fresh Ubuntu/Debian box	You do the patching, monitoring, and 3am restarts
Oracle Cloud Always Free	$0	Genuinely free ARM shapes (up to 4 cores / 24 GB)	Idle Always Free instances can be reclaimed by Oracle, and free ARM capacity is often unavailable. Keep backups off the box
Managed (Agent37)	from $3.99/mo	Zero server ops: hosted OpenClaw with a web terminal, file browser, scheduled jobs, and automatic runtime updates; BYOK API keys	No free tier, and support at that price is an AI bot before a human

Why there is no docker-compose.yml in this repo

The canonical docker-compose.yml ships inside the official OpenClaw repo and references that repo's own build context and scripts; the docs run it from the repo root. A copy here would be a stale fork that breaks the moment upstream changes. So this repo deliberately drives the official compose file instead of duplicating it. What is safe to ship is .env.example: the variables the official VPS guides tell you to set.

License

MIT. OpenClaw itself is a separate project with its own license; this repo only automates its documented installation.