Running OpenClaw inside Docker gives you isolation, easy upgrades, and consistent environments across machines. Here is a clean, working setup with the key details that usually trip people up.
Why Docker
Docker keeps everything (runtime, config, data) bundled and reproducible. You can move a setup between machines, pin versions, and avoid “works on my machine” problems.
The basics
Create a directory for your config and data, then run the official image with the ports the gateway needs exposed. Keep your auth token in an environment variable, not in the command line, so it stays out of shell history and logs.
Named volumes for persistence
Persist the data directory with a named volume so agents, memory, and sessions survive container restarts and upgrades. Without this, you lose everything when the container is replaced.
Networking that matters
Bind the gateway to localhost by default, and put a reverse proxy in front if you need remote access. Exposing the gateway directly to the internet without auth protection is a common and dangerous mistake.
Upgrading safely
Before upgrading, back up the data volume. Pull the new image and recreate the container. Because state lives in the volume, the upgrade is low-risk and reversible.
A small compose file goes a long way
A docker-compose.yml captures the whole setup: image, ports, volumes, environment, and restart policy. One command brings it up, and the same file works on any Docker host.
Wrap up
Docker is one of the cleanest ways to run OpenClaw: reproducible, isolated, and easy to upgrade. Get the volumes and auth right, and the rest is straightforward.
Top comments (0)