OpenClaw Docker: Install, Compose, Update Guide

Do not index

You run OpenClaw in Docker by installing Docker Engine on Ubuntu, pulling the alpine/openclaw image, generating a compose file with the official docker-setup.sh script (or copying the annotated one below), mounting a persistent volume for the .openclaw config directory, putting your model API key in .env, and running docker compose up -d. On a 2 vCPU, 4 GB VPS the first working gateway takes about 15 minutes.

This is the hands-on version of that sentence: exact commands, a complete docker-compose.yml with volumes, env vars, ports, restart policy, and a healthcheck, plus the parts most guides skip, which are updating without losing state, uninstalling cleanly, running a local model on an NVIDIA GPU, and hardening the container so a tool call cannot wander outside it. If you would rather not own any of that, we also cover when it makes sense to let Agent 37 run OpenClaw in an isolated container for you from $3.99/mo (as of October 2026) instead.

Quick answer: The DIY path is apt install docker, docker pull alpine/openclaw, a compose file with a named volume for ~/.openclaw, and docker compose up -d. Update with docker compose pull && docker compose up -d, which keeps your volume. The managed path is Agent 37, which runs OpenClaw in an isolated, always-on container from $3.99/mo with browser terminal, file browser, and live desktop, so you never touch a compose file.

IMAGE TAG: A developer typing docker compose commands in a terminal at a standing desk. Background detail: second monitor showing a Slack alert about a failed container restart, coffee mug with a chipped handle.

What is OpenClaw Docker, and can OpenClaw run in a Docker container?

OpenClaw Docker means running the OpenClaw gateway, the open-source agent runtime that connects a model to WhatsApp, Telegram, Slack, and Discord, inside a Linux container instead of installing it directly on a host. Yes, it runs in Docker; the project publishes images and a setup script for exactly this. The container holds the runtime, a mounted volume holds your config and conversation state.

People usually mean one of three setups when they say "OpenClaw Docker":

Docker Compose on a VPS (Hetzner, DigitalOcean, Hostinger, Ubuntu on anything). This is the setup most of this guide walks through.

Docker Desktop on a laptop or Mac mini. Fine for development. Your laptop sleeps, loses Wi-Fi, and gets OS updates, so it is a poor place for an agent that is supposed to answer messages at 3 a.m.

A managed container you never SSH into. This is what we do at Agent 37: each OpenClaw instance runs in its own isolated container with persistent files and memory, a browser-based TTY terminal, a visual file browser, and a live Linux desktop over noVNC. Your API keys go directly to Anthropic or OpenAI; we never see them. Managed OpenClaw hosting starts at $3.99/mo, and agencies can provision instances through the API from $4.76/mo per instance.

The rest of this post assumes you want to do it yourself, because that is what "openclaw docker" searchers mostly want. The managed option is there at the end for when the ops bill outgrows the compute bill.

[Book a 30 minute call with Agent 37](https://cal.com/vishnukool/30min)

What do you need before installing OpenClaw in Docker on Ubuntu?

You need an Ubuntu 22.04 or 24.04 host with 2 vCPU, 4 GB RAM, and 20 GB of disk, Docker Engine with the Compose plugin, a non-root user in the docker group, outbound HTTPS, and at least one model provider API key (Anthropic or OpenAI). Browser automation and multi-channel setups want 4 GB RAM as the floor, not the target.

Minimum specs that actually hold up

Resource	Minimum	Comfortable	Why
vCPU	1	2	Node runtime plus channel workers
RAM	2 GB	4 GB	Chromium-based tools OOM below 4 GB
Disk	10 GB	20 GB or more	Image layers, logs, workspace files, Ollama models if local
Network	Outbound 443	Same, plus a reverse proxy if you expose the dashboard	Model APIs and channel webhooks

Install Docker Engine and Compose on Ubuntu

Follow the official Docker Engine install steps for Ubuntu; the condensed version is:

sudo apt-get update
sudo apt-get install -y ca-certificates curl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo $VERSION_CODENAME) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo usermod -aG docker $USER && newgrp docker
docker compose version

API keys to have ready

ANTHROPIC_API_KEY or OPENAI_API_KEY (or both, if you want model fallback)

Channel credentials: a Telegram bot token from BotFather, a Discord bot token, a Slack app token. WhatsApp pairs by QR code after first boot, so nothing to prepare there.

A long random string for OPENCLAW_GATEWAY_TOKEN; generate one with openssl rand -hex 32.

Which OpenClaw Docker image should you pull: alpine/openclaw or openeuler/openclaw?

Pull alpine/openclaw for the smallest image and the broadest community usage; pull openeuler/openclaw if you standardize on openEuler base images or need its security-hardened userland. Both run the same OpenClaw gateway. Pin a version tag in production rather than latest, because latest moves with upstream releases and can change config expectations under you.

# Smallest footprint, most common in guides and Reddit threads
docker pull alpine/openclaw:latest

# openEuler-based alternative
docker pull openeuler/openclaw:latest

# See what you actually pulled
docker image ls | grep openclaw

How to read the tags

latest tracks the newest upstream release. Good for a first test, bad for anything you depend on.

Semantic version tags (for example 2026.x.y) are what you pin in docker-compose.yml for production. Check the tag list on the image's Docker Hub page before you choose, since tag naming is set by the image maintainers, not by this guide.

The alpine/openclaw image is a few hundred MB smaller than the openEuler build, which matters on a 10 GB VPS disk and when you run docker compose pull on a metered connection.

openclaw docker vs local install: you can run OpenClaw without Docker by installing Node and the OpenClaw package directly on the host. It works, and it is slightly faster to debug. You lose reproducibility, the ability to roll back by changing one tag, and the isolation between the agent's shell tools and your host. For a 24/7 agent, the container wins.

What does the official OpenClaw docker-setup.sh script generate?

The docker-setup.sh script in the OpenClaw GitHub repository checks for Docker, creates the ~/.openclaw config directory and a workspace directory, writes a .env file with placeholder keys and a generated gateway token, generates a docker-compose.yml that mounts both directories, pulls the image, and starts the gateway. It is the fastest zero-to-running path on a fresh VPS.

git clone https://github.com/openclaw/openclaw.git
cd openclaw
chmod +x docker-setup.sh
./docker-setup.sh

What you end up with on disk:

docker-compose.yml: one openclaw service, the image tag the script was released with, a restart: unless-stopped policy, and bind mounts for config and workspace.

.env: OPENCLAW_GATEWAY_TOKEN, empty ANTHROPIC_API_KEY and OPENAI_API_KEY lines for you to fill in, and a port variable.

~/.openclaw/: the directory that holds openclaw.json, channel session files (the WhatsApp pairing lives here), memory, and logs. This is the directory you must back up and must never lose.

~/.openclaw/workspace/: files the agent reads and writes during tasks.

The script is a great starting point and a poor finishing point. It does not add a healthcheck, it does not bind the gateway port to localhost, it does not drop capabilities, and it does not use a named volume. The next section fixes all four.

What does a complete OpenClaw docker-compose.yml look like, and which volumes must be persisted?

A production OpenClaw compose file has one service, a pinned image tag, restart: unless-stopped, an env_file for secrets, the gateway port bound to 127.0.0.1, a named volume for the .openclaw config directory, a bind mount for the workspace, and a healthcheck. The config volume is the only thing that must survive; everything else is rebuildable.

.env (chmod 600 this file):

OPENCLAW_GATEWAY_TOKEN=replace-with-output-of-openssl-rand-hex-32
ANTHROPIC_API_KEY=sk-ant-...
OPENAI_API_KEY=
OPENCLAW_GATEWAY_PORT=18789
TZ=UTC

docker-compose.yml (annotated, copy-pasteable):

services:
  openclaw:
    # Pin a version tag in production. latest is fine for a first test only.
    image: alpine/openclaw:latest
    container_name: openclaw
    # Comes back after reboots and crashes, stays down if you stop it on purpose.
    restart: unless-stopped
    env_file: .env
    environment:
      # Listen on all interfaces inside the container; the ports line below
      # decides what the outside world can reach.
      - OPENCLAW_GATEWAY_BIND=0.0.0.0
    ports:
      # Bound to localhost only. Reach it over an SSH tunnel or put a
      # reverse proxy with TLS in front. Never publish 0.0.0.0:18789 raw.
      - "127.0.0.1:${OPENCLAW_GATEWAY_PORT:-18789}:18789"
    volumes:
      # MUST persist: openclaw.json, channel sessions, memory, logs.
      - openclaw-config:/root/.openclaw
      # Nice to persist: files the agent reads and writes. Bind mount so you
      # can open them from the host.
      - ./workspace:/root/.openclaw/workspace
    healthcheck:
      # Adjust the path if your image tag exposes a different health route.
      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:18789/ >/dev/null 2>&1 || exit 1"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  openclaw-config:

Bring it up and watch the first boot:

mkdir -p workspace && chmod 700 .env
docker compose up -d
docker compose logs -f openclaw

The same thing as a single docker run, if you refuse to write YAML:

docker volume create openclaw-config
docker run -d --name openclaw --restart unless-stopped \
  --env-file .env \
  -e OPENCLAW_GATEWAY_BIND=0.0.0.0 \
  -p 127.0.0.1:18789:18789 \
  -v openclaw-config:/root/.openclaw \
  -v "$(pwd)/workspace:/root/.openclaw/workspace" \
  alpine/openclaw:latest

Which volumes must be persisted: only /root/.openclaw (or whatever home directory your image uses; confirm with docker inspect alpine/openclaw:latest | grep -i home). If that directory is not on a named volume or bind mount, every docker compose down deletes your WhatsApp pairing, your conversation memory, and your channel config. That single mistake is behind most "state lost after restart" threads.

How do you access the OpenClaw gateway and pair WhatsApp, Telegram, Slack, or Discord?

After first boot, open an SSH tunnel to the localhost-bound port, load the gateway dashboard in your browser with the gateway token, and add channels from there. Telegram, Slack, and Discord take a bot token you paste in. WhatsApp shows a QR code you scan from the phone that owns the number. Session files are written to the config volume.

# From your laptop: forward the VPS localhost port to your own localhost
ssh -L 18789:127.0.0.1:18789 user@your-vps-ip
# Then open http://localhost:18789 and paste OPENCLAW_GATEWAY_TOKEN when asked

Per-channel notes

Telegram: create a bot with BotFather, copy the token, add it in the dashboard or openclaw.json. Message the bot once so OpenClaw learns your chat ID. Lock the bot to your user ID so strangers cannot drive your agent.

WhatsApp: scan the QR from the dashboard or from docker compose logs -f openclaw, where it renders as ASCII. The pairing is tied to the files in the config volume; wipe the volume and you re-pair.

Slack: create an app with Socket Mode, generate an app-level token and a bot token, paste both.

Discord: create an application, enable the message content intent, invite the bot with the scopes OpenClaw lists in its docs, paste the token.

If you want the dashboard reachable without a tunnel, put Caddy or Nginx in front with TLS and basic auth, and keep the container port on 127.0.0.1. Publishing 0.0.0.0:18789 on a VPS means anyone who guesses your token format gets a shell-capable agent.

How do you start, stop, restart, update, and uninstall OpenClaw Docker without losing state?

Start with docker compose up -d, stop with docker compose stop, restart with docker compose restart, read logs with docker compose logs -f. Update by backing up the config volume, changing the image tag, then docker compose pull && docker compose up -d; the named volume survives. Uninstall completely with docker compose down -v, which deletes the volume on purpose.

Daily lifecycle

docker compose up -d          # start (creates container if needed)
docker compose stop           # stop, keep container and volume
docker compose start          # start a stopped container
docker compose restart        # restart (for example after editing .env)
docker compose logs -f --tail=200 openclaw   # follow logs
docker compose ps             # see health status
docker compose exec openclaw sh   # shell into the running container

How to update OpenClaw Docker to a new version and keep config and conversation state

# 1. Back up the config volume to a tarball first. Always.
docker run --rm -v openclaw-config:/data -v "$(pwd):/backup" alpine \
  tar czf /backup/openclaw-config-$(date +%F).tgz -C /data .

# 2. Edit docker-compose.yml: change the image tag to the new version
#    (or leave :latest if you accept moving targets)

# 3. Pull and recreate. The named volume is untouched.
docker compose pull
docker compose up -d

# 4. Confirm it came back healthy
docker compose ps
docker compose logs --tail=50 openclaw

# 5. Remove the old image layers
docker image prune -f

If the new version fails, roll back by setting the old tag and running docker compose up -d again. If upstream changed the config schema and the old container cannot read the new files, restore the tarball into the volume:

docker compose down
docker run --rm -v openclaw-config:/data -v "$(pwd):/backup" alpine \
  sh -c "rm -rf /data/* && tar xzf /backup/openclaw-config-YYYY-MM-DD.tgz -C /data"
docker compose up -d

How to uninstall OpenClaw Docker completely, including volumes

docker compose down -v        # removes container, network, AND the named volume
docker image rm alpine/openclaw:latest
rm -rf ./workspace .env docker-compose.yml   # only if you want the files gone too

down without -v keeps the volume, which is what you want when you are just rebuilding. -v is the irreversible one.

How do you run OpenClaw in Docker with Ollama on an NVIDIA GPU?

Install the NVIDIA driver and the NVIDIA Container Toolkit on the host, add an ollama service to the same compose file with a GPU device reservation, pull a model into the Ollama volume, and point OpenClaw at http://ollama:11434 as an OpenAI-compatible endpoint. OpenClaw itself does not need the GPU; only the Ollama container does.

Host prerequisites: an NVIDIA driver that reports in nvidia-smi, then the NVIDIA Container Toolkit install guide, then sudo nvidia-ctk runtime configure --runtime=docker && sudo systemctl restart docker. Test with docker run --rm --gpus all nvidia/cuda:12.4.0-base-ubuntu22.04 nvidia-smi.

Add this to the compose file from earlier:

  ollama:
    image: ollama/ollama:latest
    container_name: ollama
    restart: unless-stopped
    volumes:
      - ollama-models:/root/.ollama
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: all
              capabilities: [gpu]
    # No ports line: only the openclaw container needs to reach it.

volumes:
  openclaw-config:
  ollama-models:

Then pull a model and wire it up:

docker compose up -d ollama
docker compose exec ollama ollama pull llama3.1:8b
# In .env or openclaw.json, set the provider base URL to http://ollama:11434/v1
# and the model name to llama3.1:8b, then docker compose restart openclaw

Sizing reality for the RTX 3060 question that keeps coming up: 12 GB of VRAM runs 7B and 8B models at 4-bit quantization comfortably and 13B models with some offload to system RAM. It will not run a 70B model usefully. Give the Ollama container access to the full GPU with count: all; splitting one consumer card between containers is not worth the complexity.

Can OpenClaw escape its Docker container, and how do you harden tool execution?

Not through any normal path: OpenClaw's shell and file tools run as processes inside the container's namespaces, so they see the container filesystem and network, not your host. Docker is still not a hard security boundary against kernel exploits or misconfiguration. The real risks are a mounted Docker socket, a privileged flag, or a published port, all of which you control.

NIST SP 800-190 lists the container-specific risks that matter here: image vulnerabilities, over-privileged containers, and host-level access from inside a container. For an agent that can run arbitrary shell commands on request, translate those into five rules:

Never mount `/var/run/docker.sock`. A socket mount is root on the host. An agent with it can start a privileged container and read anything.

Never use `privileged: true` or `network_mode: host`. You lose the namespace isolation that makes the sandbox a sandbox.

Drop capabilities and block privilege escalation. Add cap_drop: [ALL] and security_opt: [no-new-privileges:true] to the service.

Run read-only with scoped writable paths. read_only: true plus tmpfs: [/tmp] and the two volumes above means a bad tool call cannot modify the runtime.

Restrict egress if the agent handles untrusted input. A dedicated Docker network with an egress proxy that only allows your model provider, your channel APIs, and the domains the agent genuinely needs.

Hardened additions to the openclaw service:

    user: "1000:1000"             # confirm the image supports a non-root user
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    pids_limit: 256
    mem_limit: 3g

The OWASP Docker Security Cheat Sheet covers each of these in more depth. openclaw docker vs vm: if you are running agents for multiple clients, or letting an agent browse untrusted websites, a container per tenant on a shared kernel is thinner isolation than a VM per tenant. That is the point at which many teams either move to Firecracker-style microVMs or stop running the infrastructure themselves.

[Book a 30 minute call with Agent 37](https://cal.com/vishnukool/30min)

Why does OpenClaw Docker fail after setup, and how do you fix the common errors?

Most failures after a successful up -d are one of four things: permission denied on the mounted config directory, the gateway port already in use, the dashboard unreachable because the port is bound to localhost and you forgot the tunnel, or state vanishing on restart because the config directory was never on a volume. Each has a one-line check.

Symptom	Cause	Fix
`EACCES` or `permission denied` writing to `.openclaw`	Bind mount owned by a different UID than the container user	`sudo chown -R 1000:1000 ./workspace` (match the `user:` line), or switch to a named volume which Docker initializes with the right owner
`bind: address already in use` on 18789	Another process or an old container holds the port	`sudo ss -ltnp	grep 18789`, then` docker rm -f `the stale container or change` OPENCLAWGATEWAYPORT`
Dashboard times out from your browser	Port is bound to `127.0.0.1` on the VPS (correct) and you have no tunnel	`ssh -L 18789:127.0.0.1:18789 user@vps`, then open `localhost:18789`
Gateway refuses connection inside the container	`OPENCLAW_GATEWAY_BIND` left at `127.0.0.1` so the published port hits nothing	Set it to `0.0.0.0` in `environment:` and restart
WhatsApp asks to re-pair after every restart	Config directory on the container's writable layer, not a volume	Add the `openclaw-config:/root/.openclaw` volume; re-pair once
Container restarts in a loop	Missing or invalid API key, or healthcheck path wrong for your tag	`docker compose logs --tail=100 openclaw`; fix `.env`; adjust or remove the healthcheck
OOM killed under browser tasks	Less than 4 GB RAM or `mem_limit` too tight	Resize the VPS or raise `mem_limit`
`could not select device driver "nvidia"`	Container Toolkit not installed or Docker not restarted after `nvidia-ctk`	Re-run the toolkit configure step and `systemctl restart docker`

When in doubt: docker compose logs -f openclaw first, docker compose exec openclaw sh second, and only then start editing YAML.

How do you run OpenClaw Docker on a Synology NAS or other home server?

On Synology, install Container Manager from Package Center, create /volume1/docker/openclaw/config and /workspace, upload the compose file above as a Project with those two folders as bind mounts instead of the named volume, set PUID and PGID to a NAS user you create for it, and publish the port only to your LAN. The same compose file works on Unraid, Proxmox LXC, and a Raspberry Pi 5.

Three home-server caveats:

ARM vs x86. Most Synology models are x86_64; the Plus series with Intel or AMD chips runs the images directly. ARM models and Raspberry Pi need an arm64 tag; check the image's architecture list on Docker Hub before you pull.

No GPU, slower CPU. A NAS CPU is fine for a chat agent calling a cloud model and poor for local Ollama inference. Keep the model in the cloud.

Residential uptime. Your ISP, your router firmware update, and your power company are now part of the agent's availability story. Fine for a personal assistant, risky for anything a client pays for.

If you want a persistent, always-on box without any of that, AI agent hosting on Agent 37 is the same idea as the NAS, except the machine lives in a datacenter and we handle the kernel.

When should you skip DIY OpenClaw Docker and use managed hosting instead?

Stay on DIY Docker when you already run containers in production, need custom networking, or want a GPU box under your desk. Move to managed hosting when your time is worth more than the compute bill, when you cannot afford the agent being down while you sleep, or when you need one isolated OpenClaw instance per client without becoming a hosting company.

Factor	DIY Docker on Ubuntu VPS	Agent 37 managed	Agent 37 Cloud (API)	ClawHosters
Entry price (as of October 2026)	About $4 to $6/mo compute plus your hours	$3.99/mo	$4.76/mo per instance, metered by the minute	EUR 19/mo
Who patches the runtime	You	Platform, automatic runtime updates and security patches	Platform	Platform
Isolation	Your compose file, your hardening	Isolated container per instance	Isolated instance per API call	Dedicated EU servers (Germany)
Access	SSH tunnel to localhost port	Browser TTY terminal, file browser, live Linux desktop (noVNC)	REST API, SSH, signed URLs	Web dashboard, optional REST API
Integrations	Whatever you wire up	1000+ via Composio (Gmail, WhatsApp, Slack, GitHub)	Same instances, your UI	Channel connectors
API keys	In your `.env`	Go directly to Anthropic or OpenAI; Agent 37 never touches them	Same	BYOK or included
Per-client provisioning	Script it yourself	Task board and dashboard	One `POST /v1/instances`	Manual
Best for	Engineers who already run Docker	Founders, traders, operators, non-technical users	Agencies and SaaS reselling agents	EU data residency priority

IMAGE TAG: A platform engineer at a rack-adjacent desk running terminal commands while glancing at a phone alert. Background detail: cable-managed mini server shelf, LED status lights, energy drink can with condensation.

The honest math: a $5 VPS plus two hours a month of updates, log checks, and the occasional re-pair is cheap only if those two hours are free. McKinsey's State of AI research shows organizations moving agents from experiments into operations, and operational means someone owns uptime. On Agent 37 that someone is us: each instance stays on when you log off, files and memory survive between tasks, runtime updates and security patches are automatic, and you get the same browser terminal you would otherwise reach through an SSH tunnel. Agencies that want to resell take the same instances through Agent 37 Cloud, where one API call provisions an isolated OpenClaw or Hermes instance from a registered template and a $5 starter credit covers the first one. Lionox, for example, launched its own branded agent product in a day on that path instead of maintaining a fleet of compose files.

If you specifically need EU-only infrastructure, ClawHosters runs managed OpenClaw on servers in Germany from EUR 19/mo. If you need short-lived sandboxes for CI-style agent runs rather than a persistent gateway with channel state, E2B and Daytona fit that lane; they are not a home for a 24/7 WhatsApp agent.

Key facts at a glance

OpenClaw runs in Docker; pull alpine/openclaw (smallest) or openeuler/openclaw, and pin a version tag in production.

The only directory you must persist is the .openclaw config directory; put it on a named volume or you lose channel pairings and memory on every rebuild.

Update with a volume backup, then docker compose pull && docker compose up -d; uninstall completely with docker compose down -v.

Bind the gateway port to 127.0.0.1, never mount the Docker socket, drop all capabilities, and run read-only to keep tool execution inside the container.

Local models need the NVIDIA Container Toolkit and a separate Ollama service; OpenClaw itself needs no GPU.

Agent 37 runs OpenClaw in isolated, always-on containers from $3.99/mo managed or $4.76/mo per instance via API (as of October 2026), with browser terminal, file browser, live desktop, and 1000+ Composio integrations.

FAQ

How do I update OpenClaw Docker to the latest version without losing my config and conversation history?

Back up the config volume to a tarball with a throwaway Alpine container, change the image tag in docker-compose.yml, then run docker compose pull followed by docker compose up -d. Compose recreates only the container; the named volume holding openclaw.json, channel sessions, and memory is untouched. If the new version misbehaves, set the previous tag and run up -d again, or restore the tarball into the volume.

How do I completely uninstall OpenClaw Docker, including the volumes?

Run docker compose down -v in the directory with your compose file. The -v flag removes the named volume along with the container and network, which deletes your WhatsApp pairing and conversation state permanently. Then docker image rm alpine/openclaw:latest to reclaim disk, and delete the workspace folder and .env by hand if you want the host clean. Without -v, down keeps the volume for a later reinstall.

Is running OpenClaw in Docker better than a VM or a plain local install?

For one personal agent, Docker on a small VPS is the sweet spot: reproducible, easy to roll back by changing a tag, and isolated from your host. A plain local install is marginally easier to debug but ties the agent to a laptop that sleeps. A VM per agent gives stronger isolation than a container and matters once you run agents for several clients or let them browse untrusted sites, at the cost of more RAM and more patching.

Do I need Docker knowledge to run OpenClaw on Agent 37?

No. Agent 37 deploys an OpenClaw instance in one click into its own isolated container, with a browser-based terminal, a visual file browser, and a live Linux desktop over noVNC when you want to look under the hood. You bring your own Anthropic or OpenAI key, which goes directly to the provider, and runtime updates and security patches are automatic. Plans for personal Hermes and OpenClaw hosting start at $3.99/mo as of October 2026.

What is the cheapest way to keep OpenClaw running 24/7 in Docker?

The lowest cash price is a 2 vCPU, 4 GB VPS in the $4 to $6/mo range on Hetzner or DigitalOcean with the compose file above and restart: unless-stopped, which brings the container back after reboots. Add your own hours for updates, backups, and re-pairing channels. The lowest managed price is Agent 37 at $3.99/mo, where the instance stays on, keeps its files and memory between tasks, and is patched for you.

[Book a 30 minute call with Agent 37](https://cal.com/vishnukool/30min)

OpenClaw Docker: how do you install, run, and update it on Ubuntu in 2026?

What is OpenClaw Docker, and can OpenClaw run in a Docker container?

What do you need before installing OpenClaw in Docker on Ubuntu?

Which OpenClaw Docker image should you pull: alpine/openclaw or openeuler/openclaw?

What does the official OpenClaw docker-setup.sh script generate?

What does a complete OpenClaw docker-compose.yml look like, and which volumes must be persisted?

How do you access the OpenClaw gateway and pair WhatsApp, Telegram, Slack, or Discord?

How do you start, stop, restart, update, and uninstall OpenClaw Docker without losing state?

How do you run OpenClaw in Docker with Ollama on an NVIDIA GPU?

Can OpenClaw escape its Docker container, and how do you harden tool execution?

Why does OpenClaw Docker fail after setup, and how do you fix the common errors?

How do you run OpenClaw Docker on a Synology NAS or other home server?

When should you skip DIY OpenClaw Docker and use managed hosting instead?

Key facts at a glance

FAQ