Deploying OpenClaw in Containers

1. Start the Container

Set the image

1
export IMAGE=ghcr.io/openclaw/openclaw:2026.3.2

Generate a random token

1
openssl rand -hex 32

Set the gateway token

1
export OPENCLAW_GATEWAY_TOKEN=xxx 

This token is used for authentication on both the remote web UI and the local TUI.

Set directory permissions

1
2
mkdir -p openclaw-home
chmod -R 777 openclaw-home

Start the container

1
2
3
4
5
6
7
8
9
nerdctl run -d --user root \
  --name openclaw \
  --restart always \
  --security-opt apparmor=unconfined \
  --security-opt seccomp=unconfined \
  -p 18789:18789 \
  -v $(pwd)/openclaw-home:/root/ \
  $IMAGE \
  sleep infinity

Remove the container

1
nerdctl rm openclaw --force

2. Start the Service

Create the configuration file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
cat <<EOF > openclaw-home/.openclaw/openclaw.json
{
  "models": {
    "mode": "merge",
    "providers": {
      "custom": {
        "baseUrl": "https://x.x.x.x/v1",
        "apiKey": "x.x.x.x",
        "api": "openai-completions",
        "models": [
          {
            "id": "default",
            "name": "default",
            "reasoning": false,
            "input": [
              "text"
            ],
            "cost": {
              "input": 0,
              "output": 0,
              "cacheRead": 0,
              "cacheWrite": 0
            },
            "contextWindow": 262144,
            "maxTokens": 262144
          }
        ]
      }
    }
  },
  "agents": {
    "defaults": {
      "model": {
        "primary": "custom/default"
      },
      "models": {
        "custom/default": {},
      },
      "workspace": "/root/.openclaw/workspace",
      "compaction": {
        "mode": "safeguard"
      },
      "timeoutSeconds": 120,
      "maxConcurrent": 4,
      "subagents": {
        "maxConcurrent": 8
      }
    },
    "list": [
      {
        "id": "main"
      }
    ]
  },
  "tools": {
  },
  "messages": {
    "ackReactionScope": "group-mentions"
  },
  "gateway": {
    "port": 18789,
    "mode": "local",
    "bind": "lan",
    "controlUi": {
      "enabled": true,
      "basePath": "/openclaw",
      "allowInsecureAuth": true,
      "allowedOrigins": [ "*" ]
    },
    "auth": {
      "mode": "token",
      "token": "$OPENCLAW_GATEWAY_TOKEN"
    }
  }
}
EOF

Here bind is set to lan for remote access, and basePath is set to /openclaw to make web routing configuration easier.

Enter the container

1
nerdctl exec -it openclaw bash

Start the service

1
node openclaw.mjs gateway

3. Usage

3.1 Local

1
2
nerdctl exec -it openclaw \
  node openclaw.mjs agent --agent main --message "介绍一下你自己吧"

3.2 Web

Open http://${HOST_IP}:18789/openclaw and you will see the web UI.

But once the token is configured, you still have to authorize the device before you can use it.

List devices

1
node openclaw.mjs devices list

1
2
3
4
5
6
7
8
Pending (1)
┌──────────────────────────────────────┬────────────────────────┬──────────┬────────────┬──────────┬────────┐
│ Request                              │ Device                 │ Role     │ IP         │ Age      │ Flags  │
├──────────────────────────────────────┼────────────────────────┼──────────┼────────────┼──────────┼────────┤
│ 83730280-7fa9-4576-bd34-30733275b8f6 │ ff3db6b1cf6fbef9a33222 │ operator │            │ just now │        │
│                                      │ 3912cc3cf7ea5a3af03dea │          │            │          │        │
│                                      │ 333a96c622566617936f   │          │            │          │        │
└──────────────────────────────────────┴────────────────────────┴──────────┴────────────┴──────────┴────────┘

Approve the device

1
node openclaw.mjs devices approve 83730280-7fa9-4576-bd34-30733275b8f6