Running OpenClaw with Docker

Hetzner’s community forums had a thread last week where someone spent eight hours trying to get OpenClaw running on bare metal before giving up and switching to Docker. Took them twenty minutes after that. Docker is not strictly required for OpenClaw, but at this point it is the path of least resistance and the one most people in the community recommend.

The docker-compose approach

OpenClaw’s repo ships with a docker-compose.yml that handles the agent, the browser (a Chromium instance), and the gateway as separate containers. You clone the repo, copy the example .env file, fill in your API keys, and run docker compose up -d. On a decent VPS that takes maybe two to three minutes from cold start to a working agent.

The compose file also sets up an internal Docker network so the containers can talk to each other without exposing unnecessary ports. The only port that needs to reach the outside world is the webhook endpoint for your messaging platform, and even that can sit behind a reverse proxy if you want to add SSL (which you should).

Volumes matter

One thing people consistently get wrong on first setup is volumes. OpenClaw stores conversation history, downloaded files, and agent state on disk. If you do not mount a volume for the data directory, all of that disappears every time the container restarts. I have seen multiple posts from people who lost weeks of agent memory because they skipped this step and did not realize it until they rebooted their server.

The compose file includes volume mounts by default, but if you are writing your own docker run command, make sure you map the /data directory to somewhere persistent on the host. Same goes for the browser container’s download directory if you want to keep files the agent grabs from the web.

Networking gotchas

The most common networking issue is people trying to expose the agent’s internal API port to the public internet instead of just the gateway webhook port. Do not do that. The internal API has no authentication by default, and anyone who finds it can control your agent. The security guide goes deeper on this, but the short rule is: only expose the gateway port, firewall everything else.

Another one that trips people up is DNS resolution between containers. If your agent container cannot reach the browser container by hostname, check that they are on the same Docker network. The compose file handles this automatically, but custom setups sometimes miss it.

Keeping it updated

OpenClaw ships updates frequently, sometimes multiple times per week during active development cycles. Updating with Docker means pulling the latest images and recreating the containers, which is a docker compose pull && docker compose up -d away. But you should read the changelog first because breaking changes do happen, especially around config file format and environment variables.

If you are running this on a machine you do not want to babysit, you might want to look into managed hosting instead. OpenClaw Cloud handles all the Docker orchestration, updates, and security hardening so you can skip this entire article’s worth of work. But if you enjoy the control and want to learn how the pieces fit together, Docker is absolutely the way to go.