How to Install OpenClaw on a VPS (Docker & npm Guide)

What Is OpenClaw?

OpenClaw is an open-source personal AI assistant that runs on your own hardware instead of someone else's cloud. It connects the AI models you already pay for to the messaging apps you already use — WhatsApp, Telegram, Discord, Slack, and more — through a local Gateway process that owns your configuration, conversation state, and workspace files.

Because the Gateway is a long-running service, OpenClaw can do things a chat tab cannot: run scheduled jobs, watch inboxes, manage files, and respond to messages 24/7. That is exactly why most people move it off their laptop and onto a small server as soon as they get serious with it.

This guide covers every supported install path — the official one-line script, manual npm installation, and Docker — plus the VPS-specific hardening steps the official docs recommend before you put an AI agent on a public server.

Why Run OpenClaw on a VPS?

You can absolutely run OpenClaw on a Mac or Windows machine at home. But a laptop sleeps, reboots for updates, and leaves the network when you do. An assistant that answers your WhatsApp messages only when your laptop lid is open is not much of an assistant.

On a VPS, the OpenClaw docs describe the intended architecture plainly: the Gateway runs on the VPS and owns state + workspace, and you treat the VPS as the source of truth — connecting from your laptop or phone via the Control UI, SSH, or Tailscale. Concretely, a VPS gives you:

• Always-on execution — scheduled tasks, reminders, and inbox watchers keep running while your devices sleep

• A stable IP and environment — no home-network NAT issues, no IP changes breaking channel connections

• Isolation — the agent works in its own sandbox, away from your personal files and browser sessions

• Easy recovery — snapshot the server, and you can rebuild your whole assistant in minutes

OpenClaw Requirements

Before installing, make sure your server meets these requirements from the official documentation:

• Node.js 22.22.3+, 24.15+, or 25.9+ — Node 26 is the recommended version

• Operating system: Linux (recommended for servers), macOS, Windows, or WSL2

• Memory: at least 2 GB RAM. The Docker image build is known to fail with out-of-memory exit code 137 on 1 GB machines

• An AI provider API key — Anthropic, OpenAI, or another supported provider, requested during onboarding

• pnpm — only needed if you build from source; not required for normal installs

A small 2 vCPU / 2–4 GB RAM VPS handles a personal OpenClaw instance comfortably. ARM servers work too, though the docs note low-power ARM hosts benefit from extra performance tuning, which we cover in the troubleshooting section.

Method 1: The Official Install Script (Fastest)

The recommended path on macOS, Linux, and WSL2 is the official installer script. It installs OpenClaw, checks your Node version, and launches onboarding in one step:

# Install OpenClaw and start onboarding
curl -fsSL https://openclaw.ai/install.sh | bash

# Or install without launching onboarding yet
curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard

# Windows PowerShell equivalent
iwr -useb https://openclaw.ai/install.ps1 | iex

Onboarding walks you through choosing an AI provider, entering API keys, and connecting your first messaging channel. When it finishes, the Gateway daemon is registered with your OS — a LaunchAgent on macOS, a systemd service on Linux and WSL2, or a Scheduled Task on Windows — so OpenClaw survives reboots automatically.

Method 2: Install OpenClaw with npm

If you manage Node versions yourself (nvm, fnm, Volta), install the CLI globally and run onboarding manually. Note the --allow-scripts flag: npm 12 blocks package lifecycle scripts by default, and OpenClaw needs its install scripts approved explicitly:

# Install the CLI globally (the flag approves OpenClaw's install scripts)
npm install -g openclaw@latest --allow-scripts=openclaw

# Run onboarding and register the background daemon
openclaw onboard --install-daemon

Method 3: OpenClaw Docker Setup

Docker is the cleanest way to keep OpenClaw isolated from the rest of your server, and it is the setup we recommend on a shared-purpose VPS. The project ships a setup script that builds the image, runs onboarding, and starts the Gateway under Docker Compose (v2 required):

# From the OpenClaw repo root — builds openclaw:local and onboards
./scripts/docker/setup.sh

# Prefer the pre-built image instead of building locally
export OPENCLAW_IMAGE="ghcr.io/openclaw/openclaw:latest"
./scripts/docker/setup.sh

# After setup, the Control UI is at:
#   http://127.0.0.1:18789/  (paste the gateway token from .env)

The Compose file bind-mounts three paths you should know about: your config directory maps to /home/node/.openclaw, your workspace to /home/node/.openclaw/workspace, and the auth-profile secrets to /home/node/.config/openclaw. Back those up and your assistant is fully portable.

Useful environment variables: OPENCLAW_IMAGE (use a registry image), OPENCLAW_SKIP_ONBOARDING (skip interactive setup), OPENCLAW_TZ (timezone, defaults to UTC), OPENCLAW_SANDBOX=1 (enable the agent sandbox), and OPENCLAW_HOME_VOLUME (persist the whole home dir in a named volume). The container runs as the non-root node user.

Choosing a VPS for OpenClaw

The official docs list working setups on DigitalOcean, Hetzner, GCP, Azure, Oracle Cloud, Fly.io, Railway, Hostinger, and even a Raspberry Pi. Any Linux VPS with 2+ GB RAM and root access works — we compare seven options in detail in our best OpenClaw hosting guide.

The practical difference between providers is how much of the setup and upkeep is on you. On an unmanaged box you handle OS updates, firewall rules, Node upgrades, and debugging alone. A managed OpenClaw VPS hands that to a support team — worth real money the first time your agent goes quiet at 2 AM and you don't know why.

Secure the OpenClaw Gateway (Do This First)

An AI agent with access to your messages and files is a high-value target, so the docs are blunt about the security model: keep the Gateway on loopback and access it via an SSH tunnel or Tailscale Serve. If you bind it to lan or tailnet instead, the Gateway requires a shared secret (gateway.auth.token or gateway.auth.password).

The standard remote-access pattern is an SSH tunnel from your laptop — the Control UI stays private while feeling local:

# Forward the OpenClaw Control UI to your laptop
ssh -N -L 18789:127.0.0.1:18789 youruser@your-vps-ip

# Then open http://127.0.0.1:18789/ locally

Prefer Tailscale? Install it on the VPS, join it to your tailnet, confirm SSH works over the Tailscale IP or MagicDNS name, and then restrict public SSH entirely. Either way, harden admin access before installing OpenClaw on any public server: key-based SSH only, no root login, and a firewall that closes everything you don't use.

When you're done, verify from the outside that nothing leaked: run our free Port Checker against your server's IP and confirm port 18789 shows closed or filtered from the public internet. You can find your server's public address with the IP Lookup tool.

Optional: Point a Domain at Your Server

You don't need a domain for OpenClaw itself — the Gateway is not meant to be a public website. But most people give the VPS a hostname anyway for SSH convenience (ssh claw.yourdomain.com beats memorizing an IP).

Add an A record at your DNS host pointing a subdomain to the VPS IP, then confirm it resolves with our DNS Lookup tool and watch it go live worldwide with the DNS Propagation Checker. If you later put a reverse proxy in front of anything on the server, check the certificate with the SSL Checker.

Verify the Install and Troubleshoot

Three commands tell you everything about the health of an OpenClaw install:

openclaw --version        # CLI installed and on PATH
openclaw doctor           # full environment health check
openclaw gateway status   # is the Gateway daemon running?

Build killed with exit code 137 — that's the out-of-memory killer. Resize to 2 GB+ RAM, or add swap before building the Docker image.

Sluggish on a small or ARM VPS — the docs recommend enabling Node's compile cache and disabling respawn: add NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cache and OPENCLAW_NO_RESPAWN=1 to your environment (or the systemd unit, with Restart=always and RestartSec=2).

npm refused to run install scripts — you're on npm 12+, which blocks lifecycle scripts by default. Re-run with --allow-scripts=openclaw.

Can't reach the Control UI — that's the security model working. The UI listens on 127.0.0.1:18789 by design; open the SSH tunnel from the previous section instead of binding it publicly.

From here, your assistant is live: connect channels in the Control UI, and consider a weekly snapshot of ~/.openclaw so state and workspace are always recoverable. If you're still choosing where to host, our OpenClaw hosting comparison ranks seven options by price and hassle.