Skip to content
Back to the blog

Self-host OpenClaw on a VPS: requirements and security

Check OpenClaw's Linux requirements, decide whether a VPS fits, and keep its Gateway private before you choose a server.

  • OpenClaw
  • VPS
  • security

OpenClaw keeps a Gateway running to connect an agent with messaging channels, tools, and a model provider. A Linux VPS can keep that Gateway online when your laptop is off. It does not turn OpenClaw into a static website, include a model or API key, or make the installation a Hostbrid-managed service.

Check requirements before you choose a server

OpenClaw’s installation documentation currently lists Node.js 24.16 or later, or 26.1 or later, for Linux. Requirements can change, so check the official install guide immediately before installing. You need SSH access and a supported operating system. A Hostbrid VPS gives you root access; you remain responsible for installing and maintaining the software.

Do not choose memory based on the agent’s name. A Gateway that calls a hosted model API has a different resource profile from a local model running through Ollama. Include supporting services, logs, and update space in your estimate. Our Docker VPS sizing guide explains how to measure a workload before ordering. OpenClaw is not currently a one-click Hostbrid app or a managed service, so make sure you are prepared to maintain Node, firewall rules, and updates.

Keep the Gateway control surface private

OpenClaw’s VPS guide recommends binding the Gateway to loopback and connecting privately through an SSH tunnel or Tailscale. Do not expose its control port directly to the internet or publish the dashboard on 0.0.0.0. If you choose Docker, read the official Docker guide: container networking needs separate care, and its defaults may differ from a host installation.

The Gateway exposure runbook treats public access as a high-risk deployment. If your use case needs public remote access, define authentication, TLS, rate limits, sender allowlists, and tool isolation first. A firewall rule alone does not replace Gateway authentication.

Decide who can instruct the agent

OpenClaw treats each Gateway as one trust boundary. It is not a safe boundary between customers or users who do not trust one another: people who can message a tool-enabled agent share some of its delegated authority. For a trusted team, limit channels, use pairing or allowlists, and keep host commands denied or approval-gated unless there is a clear need. If you host separate customers, use separate Gateways and operating-system users.

Keep a recoverable copy of the agent’s state and workspace; protect credentials outside the server and rotate them if they may have been exposed. Read the OpenClaw security guide and run its audit after changing exposure or permissions.

VPS or local computer?

A Linux VPS is useful for an always-on Gateway and services that should be reachable from several devices. A Mac mini or another local machine may fit better when you need capabilities tied to that device, such as macOS nodes. OpenClaw can pair local nodes with a remote Gateway; running the Gateway on a VPS does not move local-device features onto the server.

Before ordering, check current resources and availability in the Hostbrid VPS catalogue. Hostbrid provides a self-managed Linux server; this guide is not an OpenClaw template, a deployment tested on a Hostbrid account, or an installation-support promise. If you do not want to own updates, agent permissions, and recovery, resolve those needs before production.

Manage your sites, servers and email.

Forgot your password?

Free, and it takes a minute.

At least 8 characters. Not all digits, not a common one.

We'll email you to confirm the account.