Self-hosting OpenClaw on a VPS: what you need and how to stay safe

What OpenClaw is

According to its documentation, OpenClaw is an open-source, self-hosted gateway that connects chat apps such as Telegram, Discord, Signal and WhatsApp to AI agents. You run one Gateway process on your own computer or server and talk to it from your chat apps. The documentation describes it as MIT licensed.

The project has been renamed several times. Wikipedia and press coverage describe earlier names such as Clawdbot and Moltbot before OpenClaw, with the current name dating from early 2026. Sources disagree on why the names changed, and on the later role of its creator, so we do not state those details here. Check the official site and repository for the current state.

What VPS does OpenClaw need

The official getting-started page lists software requirements (a recent Node.js version, which the installer can set up, and an API key from a model provider) but names no minimum hardware. Treat any exact RAM figure you read elsewhere as an estimate, and check the current docs.

As a rule of thumb, a gateway that sends prompts to a hosted model is a light workload, so a small plan with a couple of gigabytes of RAM is a sensible starting point, and you can resize later. Memory use grows with extra tools, a browser the agent controls, or sandbox containers it starts. If you want a local model instead of an API, you need far more RAM or a GPU, which changes the budget completely.

For the cheapest option, compare small plans by renewal price, location and reliability in the plan table below, and avoid shared-CPU plans if you see slowdowns.

Setup outline: Docker or the installer

OpenClaw can be installed with a one-line installer script, or with npm, Docker and other methods listed on its install page. On a VPS many people prefer Docker, because the agent then lives in a container instead of loose on the host. The general outline is the same either way:

• Create a normal, non-root user on a fresh Ubuntu or Debian server, log in with SSH keys and enable a firewall.
• Install Docker, then follow the official install page to start the Gateway and run onboarding.
• Add your model provider's API key through the documented configuration, not in chat messages.
• Connect one chat channel and restrict who may talk to the bot with an allowlist.
• Read the official security page before you add any tools or skills.

Security: treat the agent as untrusted code

An agent that can run commands, read files and browse the web is powerful, and that is exactly the risk. Security researchers and agencies have publicly reported weak defaults, a one-click remote-code-execution flaw (CVE-2026-25253, reported as fixed in a 2026 release), prompt-injection attacks that hide instructions in web pages, and malicious skills uploaded to the ClawHub extension catalog. Keep the software updated and follow these rules:

• Run it on its own VPS or in a container, never on a server that holds other sites, databases or customer data.
• No root: run the agent as an unprivileged user and give it only the folders and tools it needs (least privilege).
• Keep the firewall closed except SSH, and do not expose the dashboard to the internet. By default it listens only on localhost; for remote access use an SSH tunnel or a private network such as Tailscale, as the docs suggest.
• Keep secrets out of reach: use a dedicated API key with a spending limit, never your main cloud or registrar credentials.
• Review every skill or plugin before installing it, as you would a program from an unknown author.
• Require human approval for irreversible actions, and watch API spend, because a looping agent can burn through tokens.

When NOT to self-host it

If you cannot maintain a Linux server, patch it regularly and read security notices, a self-hosted agent is a poor first project. The same goes for any setup where the agent would need access to private data or production systems. In those cases, wait, use a managed offering, or run it on a throwaway machine with nothing valuable on it.