OpenClaw is an autonomous AI agent that works in the background, automating headless browsers and messages in multiple channels. Running it on a local machine means uptime is limited, availability depends on your home network. The agent is supported by a Virtual Private Server that provides an always-on environment that runs 24/7 without stopping.
This guide covers how to choose a server, harden it, deploy with Docker, set up the communication channel and tune performance. Each step assumes you have a clean Linux environment and basic terminal knowledge. The process begins with the selection of the right server specifications for the workload.
Prerequisites & VPS Specifications
OpenClaw manages persistent memory graphs, runs a Node.js runtime, and launches headless Chromium instances for web browsing. These processes consume memory and if your server is too small, you’ll have containers crash or your browser time out.
Minimum Server Specifications
- Operating system: Ubuntu 24.04 LTS or Ubuntu 22.04 LTS (fresh install)
- CPU: minimum 2 vCPUs
- RAM: 4 GB minimum (8 GB recommended for multiple browser windows)
- Storage: NVMe SSD, 20 GB+
- Network: Static IPv4 address & unmetered bandwidth
You will also need a funded API key from an LLM provider like Anthropic Claude, OpenRouter, or OpenAI. If your API calls require low latency and/or data residency compliance, pick a VPS provider with data centers in the US.
Step 1: Lock Down Server Security
OpenClaw can run bash scripts, manipulate files and interact with system-level processes. Blocking access before installation prevents unauthorized use of those capabilities.
- Turn off password login for SSH. Only use key-pair authentication by setting the password authentication directive to “no” in the SSH daemon config file and restarting the service.
- Set up UFW (Uncomplicated Firewall). Set default inbound policy to deny and outbound to allow. Turn on the firewall, then define explicit rules to permit SSH, HTTP on port 80, and HTTPS on port 443.
- Isolate admin traffic (recommended). Install a mesh VPN tool like Tailscale, and then route your SSH connection over a private network, so you can shut off port 22 to the public altogether.
Step 2: Installing Docker and Dependencies
Docker thus represents the cleanest way to isolate, maintain and update OpenClaw without interfering with the host system. Log in to the server via SSH, then run the following commands to update all system repositories and install the prerequisite packages for secure transport and certificate handling.
Add the Docker GPG key and repository to your package manager: Install Docker Engine, Docker CLI client, containerd, and Docker Compose. Make sure the Docker service is enabled to start when the system boots and check the version outputs to verify the installation.
Step 3: Deploy OpenClaw Container
Correct OpenClaw VPS hosting configuration will save the config files as well as persistent data in a different directory. Preserves container integrity during upgrade; does not lose data when rebuilding containers
In your home directory create a new folder. Add an environment file with your LLM API keys, a strong randomly generated gateway token to access the dashboard, the application port (3000) and the Node environment set to production.
Run the official image of OpenClaw in detached mode: Bind the container port to localhost only (127.0.0.1 on port 3000) to make sure that the backend is never exposed for public traffic. Install the local data directory for persistence and use the “unless-stopped” restart policy for automatic crash recovery. Read all the variables from the env file.
Step 4: Set Up a Communication Channel
OpenClaw uses messaging to communicate remotely. The most common integration is Telegram.
- Open Telegram and text BotFather.
- Create your bot token with the new bot command.
- You can access the OpenClaw dashboard via an SSH tunnel or an Nginx reverse proxy.
- Sign in with your gateway token.
- Go to Telegram channel settings and paste the bot token and save it.
Shut Down Bot Access
After you’ve connected, send a start message to your bot from your personal account. The system will return your unique user ID. Copy that ID and paste it into the allowed users field in the dashboard and set the DM policy to restricted mode. It prevents unauthorised users from consuming your LLM API budget.
Robust Long-Term Operation Optimization
Over time a running OpenClaw instance will collect cached browser assets, memory graph snapshots, and log files. If you don’t maintain them, they degrade performance or take up disk space.
Good Practices
- Automatic restart: The restart policy manages unexpected crashes. If you want more robust monitoring, write a systemd service unit that watches the container and alarms if it crashes multiple times.
- API failover routing: Request from a single point like OpenRouter. This enables the agent to continue to function during upstream LLM provider outages.
- Scheduled disk cleanup: Set up a cron job to remove unused Docker images, stopped containers and old browser caches from headless Chromium sessions.
- Log rotation: Ensure that Docker logs are not allowed to grow to very large sizes after several weeks of running, by restricting the size at 10 MB and number of rotation files at 3.
Conclusion
After the server is properly sized and secured, hosting OpenClaw on a VPS is a simple infrastructure task. The agent is a containerized workload and relies on sufficient resources, locked-down access, Docker-based isolation and routine maintenance for reliable performance. By following these steps the agent obtains a stable foundation for continuous operation on any connected messaging platform.