OpenClaw in 2026: Docker install, production hardening, reverse proxy, and remote Mac workflows

OpenClaw is a self-hosted personal AI assistant stack: a Gateway WebSocket control plane (default ws://127.0.0.1:18789), Control UI in the browser, CLI, optional channels (Telegram, Slack, etc.), and tool execution on the host or in sandboxes. In 2026, teams adopt it for two overlapping patterns:

• Gateway on Linux/VPS — always-on control plane next to your APIs, with SSH or Tailscale for remote CLI/WebChat.
• Gateway or heavy tools on a remote Mac — Xcode builds, macOS-only scripts, signed binaries, and long agent runs without keeping a laptop awake.

This article stays tutorial-first: reproducible commands, explicit ports, and failure modes you can scan in seconds.

Recommended CLI path (from the official README):

npm install -g openclaw@latest
openclaw onboard --install-daemon
openclaw gateway --port 18789 --verbose

Open http://127.0.0.1:18789/ for the Control UI. Upgrade path: openclaw doctor after updates.

Docker path (from official Docker docs — run from the cloned repo root):

git clone https://github.com/openclaw/openclaw.git
cd openclaw
./scripts/docker/setup.sh

Skip local build with a registry image:

export OPENCLAW_IMAGE="ghcr.io/openclaw/openclaw:latest"
./scripts/docker/setup.sh

Optional sandbox bootstrap for the gateway environment: export OPENCLAW_SANDBOX=1 before ./scripts/docker/setup.sh (see upstream sandboxing docs).

Bind mode. Config uses gateway.bind values such as lan, loopback, tailnet, auto, custom — not raw host aliases like 0.0.0.0 in that setting. Docker setup defaults OPENCLAW_GATEWAY_BIND=lan so the published host port works. If you use Tailscale Serve/Funnel, upstream docs require gateway.bind to stay loopback with those modes.

Token and UI. The Docker wizard generates a gateway token into .env; paste it in Control UI settings. Treat it like a root credential for your assistant plane.

DM and channels. README stresses: inbound DMs are untrusted input; default pairing policies block unknown senders until openclaw pairing approve …. Run openclaw doctor to surface risky DM policies.

Sandbox. For safer group/channel sessions, configure agents.defaults.sandbox.mode: "non-main" so non-main sessions run in per-session Docker sandboxes (full reference in upstream sandboxing docs). This is separate from “gateway in Docker” but shares Docker infrastructure.

Outbound. Restrict egress at the network layer if agents should not reach arbitrary hosts; combine with tool allow/deny policies in config.

Upstream documents Tailscale Serve/Funnel and SSH tunnels as first-class patterns. If you prefer a generic reverse proxy, terminate TLS on Nginx/Caddy and proxy to the local Gateway HTTP/WebSocket listener (typically 127.0.0.1:18789).

Caddy (illustrative) — enable WebSocket upgrade headers and preserve Host:

claw.example.com {
  reverse_proxy 127.0.0.1:18789
}

Nginx (illustrative) — add Upgrade and Connection for WS paths used by the Control UI; consult your exact OpenClaw web surface paths in docs.openclaw.ai/web.

Checklist: TLS cert valid; only 443 exposed; rate limit or IP allowlist admin routes; keep gateway token rotation documented; verify curl -fsS https://claw.example.com/healthz returns OK through the proxy.

Pattern for rented or dedicated Mac mini capacity: use the Mac as the execution island, keep secrets on the machine, and drive work over SSH.

1. Provision — SSH in (see our SSH/VNC checklist), install Docker Desktop or Colima, or install Node and the global CLI per section 3.
2. Deploy OpenClaw — Either openclaw onboard --install-daemon or clone the repo and run ./scripts/docker/setup.sh with persistent OPENCLAW_CONFIG_DIR / workspace mounts on a data disk.
3. Wire a batch job — Cron or launchd invokes your build script; artifacts land under ~/.openclaw/workspace or a CI directory; exit codes feed logs.
4. Notify — On success/failure, call your existing webhook (Slack/Telegram) from the same script; optionally let OpenClaw agent sessions read summaries from structured log files.
5. Verify — From your laptop: ssh mac 'curl -fsS http://127.0.0.1:18789/healthz' prints liveness; Control UI reachable via SSH tunnel: ssh -L 18789:127.0.0.1:18789 mac then open http://127.0.0.1:18789/.

Expected outcome: builds and agent batches complete unattended; Gateway stays healthy; you debug via logs and occasional UI over SSH without exposing 18789 to the public internet.

Do I need Docker if I only want sandboxed agents? Sandboxing can use Docker while the gateway runs natively — see upstream “Sandboxing” vs “Docker (optional)”.

Where is state stored? Docker compose bind-mounts config under OPENCLAW_CONFIG_DIR and workspace paths documented in docker install; treat backups like any secrets + workspace store.

First step when “nothing listens”? docker compose ps or openclaw doctor, then curl health endpoints.

OpenClaw in production is mostly about correct install path (CLI onboard vs ./scripts/docker/setup.sh), stable port 18789, bind mode aligned with how you expose the UI, and defense in depth (tokens, DM pairing, optional non-main sandboxes, firewall). Pair that with a remote Mac when macOS or long-running agents need dedicated hardware.

For predictable 24/7 Mac capacity—build farms, agents, and batch queues—review pricing and purchase, and keep help handy for access and billing questions.