OpenClawDocs
View as MarkdownView this page as plain textOpen in ChatGPTAsk questions about this pageOpen in ClaudeAsk questions about this page

Hosting

Hetzner

Run a persistent OpenClaw Gateway on a Debian or Ubuntu Hetzner VPS. This page covers Hetzner provisioning, host security, and access; the shared Docker VM runtime page owns container setup, persistence, custom binaries, verification, and updates.

Treat the VPS as stateful infrastructure. Keep personal browser, Apple, Google, and password-manager profiles off a company-shared runtime. If users do not share one trust boundary, split them across Gateways, hosts, or OS users. See Gateway security and VPS hosting.

What you need

  • A Hetzner VPS with root access
  • SSH access from your laptop
  • A Hetzner Cloud Firewall or host firewall
  • Model and optional channel credentials
  • About 20 minutes

Provision and secure the VPS

  • Create the server

    In Hetzner Cloud, create a Debian or Ubuntu server with at least 6 GB RAM for a source image build. On a smaller server, use the official pre-built image described in Docker VM runtime. Add your SSH key during provisioning.

    Connect as root:

    bash
    ssh root@<vps-ip>

  • Restrict inbound traffic

    Attach a Hetzner Cloud Firewall that allows TCP 22 from your administrative network. Do not add a public inbound rule for TCP 18789; the tunnel below reaches that port through SSH.

    If you also use UFW on the host, allow SSH before enabling it:

    bash
    apt-get updateapt-get install -y ufwufw allow OpenSSHufw enableufw status verbose

    If you intentionally publish the Gateway through a reverse proxy or tailnet, follow Gateway security instead of opening the container port directly to 0.0.0.0/0.

  • Install Docker

    bash
    apt-get updateapt-get install -y git curl ca-certificatescurl -fsSL https://get.docker.com | shdocker --versiondocker compose version

    • Configure the Docker runtime

    On the VPS, follow Docker VM runtime from Before you begin through Verify and administer the Gateway. The maintained setup script uses these root-owned host paths by default:

    bash
    export OPENCLAW_CONFIG_DIR="$HOME/.openclaw"export OPENCLAW_WORKSPACE_DIR="$HOME/.openclaw/workspace"export OPENCLAW_AUTH_PROFILE_SECRET_DIR="$HOME/.openclaw-auth-profile-secrets"

    If a source build ends with Killed or exit code 137, resize the server before retrying. See the shared guide for binary baking, the complete persistence map, and the update command.

    Access the Control UI

    First confirm the VPS SSH daemon allows local port forwarding. In /etc/ssh/sshd_config, use:

    text
    AllowTcpForwarding local

    local permits ssh -L from your laptop while blocking remote forwards from the server. After changing it, validate and restart SSH:

    bash
    sshd -tsystemctl restart ssh

    From your laptop, open the tunnel and leave it running:

    bash
    ssh -N -L 18789:127.0.0.1:18789 root@<vps-ip>

    Open http://127.0.0.1:18789/ and paste the Gateway token from the VPS .env. To reprint the dashboard URL or approve a browser device, run on the VPS:

    bash
    cd openclawdocker compose run --rm openclaw-cli dashboard --no-opendocker compose run --rm openclaw-cli devices listdocker compose run --rm openclaw-cli devices approve <requestId>

    If the tunnel fails with administratively prohibited, recheck AllowTcpForwarding and the SSH service configuration. A cloud firewall only needs to admit SSH; it does not need to admit port 18789.

    Infrastructure as code

    For teams that prefer Terraform, community-maintained projects provide remote state, cloud-init provisioning, deployment and backup scripts, firewall hardening, and SSH tunnel setup:

    Next steps

    Was this useful?
    On this page

    On this page