OpenClaw is a self-hosted Gateway that connects chat applications to AI coding agents. Running that Gateway on a Linux VPS keeps it online when your laptop is closed, while the server retains the sessions, routing configuration, credentials, and workspace. You administer it over SSH and reach its web Control UI through a secure tunnel or a private tailnet connection.
Antihost offers VPS plans with one-click OpenClaw, NVMe storage and a 14-day free trial.
What OpenClaw does
OpenClaw is open-source software released under the MIT license. Its central component is a Gateway process that connects chat channels with AI coding agents and coordinates the surrounding control plane. The official architecture describes one Gateway bridging channel connections, sessions, routing, the command-line interface, the web Control UI, and optional local nodes.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
“The Gateway is the single source of truth for sessions, routing, and channel connections.”
That design matters because the Gateway, rather than an individual phone or workstation, owns the active state. You can connect a supported chat application, send a request to an AI coding agent, inspect or manage the session in the Control UI, and keep the service available without leaving a personal computer running.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Who benefits from a VPS deployment?
- Developers: keep an agent endpoint available for coding tasks and automation.
- Power users: use one persistent service from several devices instead of maintaining separate local installations.
- Teams: operate a shared service with deliberate account, host, and workspace boundaries.
A VPS does not turn OpenClaw into a managed service. You remain responsible for operating-system updates, SSH hardening, credentials, backups, firewall policy, and the data stored in the Gateway state and workspace.
What changes when OpenClaw runs on a VPS?
On a VPS, the Gateway runs continuously on a Linux server and owns the state and workspace there. Your laptop or phone becomes an administration and access device: it connects to the Control UI, to a chat channel, or to the server through SSH or Tailscale.
“The Gateway runs on the VPS and owns state + workspace.”
Treat the server as the source of truth. A replacement laptop will not recreate the service unless you restore the Gateway state and workspace from backups. Conversely, deleting or losing the VPS can remove the operational data that makes the installation useful, so snapshots or file-level backups should be part of the initial design rather than an afterthought.
Prerequisites and requirements
You need the following before starting:
- A Linux VPS or cloud virtual machine with SSH access.
- Node.js 24.16 or newer, or Node.js 26.1 or newer. The installation documentation recommends Node 26.
- An API key for the AI provider you intend to use.
- A decision about how SSH administration and remote dashboard access will work before you expose any service.
- A backup plan for the Gateway state and workspace.
The official OpenClaw material does not publish a universal minimum for CPU cores, RAM, disk size, or monthly VPS cost. Those values depend on the channels, agent workloads, concurrency, logs, and operating-system overhead you choose. Do not treat a third-party VM size as an official OpenClaw requirement.
Choose architecture before choosing a VM
First decide whether administration will stay inside a private network. A tailnet-only design keeps the Gateway private and lets you manage it through Tailscale. An SSH-based design keeps the Gateway on loopback and uses an encrypted local forward when you need the web UI. A publicly reachable binding is a different risk profile and requires explicit authentication and firewall decisions.
Also decide whether this is a personal installation or a team runtime. A personal server can use one carefully protected OS account. A team deployment should use a dedicated runtime and dedicated OS accounts, not a host that is also logged into a user’s personal Apple, Google, browser, or password-manager accounts.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
How to install OpenClaw on a Linux VPS
The installation is a short sequence, but the order matters: secure administration first, install the software second, then verify the service before connecting channels.
1. Provision and harden SSH access
Create a Linux VPS with an account that can administer the machine over SSH. Before exposing the dashboard, apply the SSH and firewall policy appropriate for your provider and organization.
If you want tailnet-only administration, the VPS guide recommends installing Tailscale first. Verify that a second SSH session works through the VPS’s Tailscale address before restricting public SSH. Keeping a second session open while changing access rules gives you a recovery path if the first connection is interrupted.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not assume that a provider’s default firewall is sufficient for the Gateway. Decide which ports, source networks, and administrative identities are required, and leave everything else closed.
2. Run the official installer
From the VPS shell, run the installer published at https://openclaw.ai/install.sh:
curl -fsSL https://openclaw.ai/install.sh | bashThe installer detects the operating system, installs Node when necessary, installs OpenClaw, and starts onboarding. Piping a remote script directly to a shell is a powerful operation; run it only on the VPS you intend to manage and ensure that you obtained the URL from the official OpenClaw documentation.
3. Complete onboarding
Onboarding offers a quick path and a custom path.
- Quick start: reuses detected AI access when possible, verifies that access with a real completion, and opens the web dashboard.
- Custom setup: walks through the full configuration flow so you can choose the provider and other settings deliberately.
Have the AI provider API key ready. A successful package installation is not proof that the provider connection works; the onboarding completion check is the first useful end-to-end test.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
4. Install the managed Gateway service
Install the managed service with either command:
openclaw gateway installopenclaw onboard --install-daemonOn Linux and WSL2, this is a systemd user service. The service is what allows the Gateway to run independently of an interactive shell, so closing your SSH session does not stop the process.
5. Verify the installation
Run the three checks below and investigate failures before connecting production channels:
openclaw --version
openclaw doctor
openclaw gateway statusopenclaw --versionconfirms which OpenClaw build is installed.openclaw doctorchecks the installation and reports configuration or environment problems.openclaw gateway statusshows whether the managed Gateway service is running.
6. Open the dashboard and connect a channel
From an administration session, run:
openclaw dashboardUse the documented channel setup flow to connect Telegram, Discord, Slack, WhatsApp, or another supported channel. Add one channel first, send a controlled test message, and confirm that the expected session and routing behavior appear in the Control UI before adding more integrations.
How to access the dashboard remotely without exposing it
The secure default is to keep the Gateway bound to loopback and reach it through an SSH tunnel or Tailscale Serve. Loopback means the service listens only on the VPS itself; an outside device cannot connect directly until you create an authenticated private path.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSSH tunnel
Use your SSH client’s local-port-forwarding feature to map a port on your laptop to the loopback-bound dashboard port on the VPS. Then open the local address in your browser. The exact local port and dashboard port depend on the OpenClaw configuration and your SSH client, so confirm those values in the Control UI or current OpenClaw documentation rather than guessing.
This approach keeps the Gateway off the public network. Close the forwarding session when you no longer need the dashboard, and protect the SSH account and keys as carefully as the Gateway credentials.
Tailscale Serve
Tailscale Serve provides a private tailnet path to the dashboard. Install and authenticate Tailscale on the VPS, keep the Gateway on loopback, and publish it through Serve to the identities in your tailnet. This avoids opening a public dashboard port while allowing approved devices to connect from outside your home or office network.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Binding to a LAN or tailnet address
If you intentionally bind the Gateway to lan or tailnet, configure gateway.auth.token or gateway.auth.password unless authentication is delegated to a trusted proxy. A network-reachable service without an authentication boundary should not be considered a secure remote-access design.
Use a firewall to limit which networks can reach the bound address. A private address is not a substitute for authentication: any compromised device or account on that network may otherwise be able to reach the service.
Security model for a VPS deployment
OpenClaw’s security boundary includes the VPS, the OS account running the service, the Gateway state, channel credentials, AI-provider keys, and the workspace that agents can access. Secure each layer separately.
Keep administration and application access private
- Prefer loopback plus an SSH tunnel or Tailscale Serve.
- If the Gateway must bind to a LAN or tailnet address, set the documented token or password authentication, or use a trusted proxy that performs authentication.
- Restrict public SSH after verifying an alternative private path, such as a working Tailscale SSH session.
- Use provider firewall controls to minimize reachable ports and source networks.
Separate users and trust zones
Run team deployments on a dedicated runtime and dedicated OS accounts. Do not sign a shared runtime into personal Apple, Google, browser, or password-manager accounts. Those accounts can expose unrelated data to every process or person who can reach the shared environment.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →If users are adversarial to one another, separate gateways, hosts, or OS users are recommended. A single shared Gateway is not an adequate isolation boundary for mutually untrusted users simply because each person uses a different chat channel.
Protect state, workspace, and credentials
Back up the Gateway state and workspace regularly, and test that you can restore them. Store API keys and channel credentials only where the deployment expects them, limit who can read the relevant files, and remove credentials that are no longer needed. A backup that contains those secrets must receive the same access controls as the live VPS.
Choosing a VPS or cloud platform
The official provider picker includes Azure, DigitalOcean, Fly.io, Google Cloud Platform, Hetzner, Northflank, Oracle Cloud, Railway, Render, Raspberry Pi, Upstash Box, and AWS EC2, Lightsail, and free-tier options. No single provider is identified as universally best; evaluate the operational characteristics below for the region and workload you actually expect.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
| Decision factor | Questions to answer | Why it matters to OpenClaw |
|---|---|---|
| SSH and firewall controls | Can you restrict source networks, manage keys, and recover access safely? | The Gateway and dashboard should not be exposed by default, and SSH is the primary administration path. |
| Region and latency | Is the server close to the operator and the connected chat services? | Distance affects interactive dashboard use and the perceived response time of channel conversations. |
| Backups and snapshots | Are snapshots available, how are they restored, and how often can they run? | The VPS owns the state and workspace, so recovery capability is part of the service design. |
| Persistent-disk behavior | Does storage survive reboots, resizing, and host failure, and what is the recovery workflow? | Ephemeral or poorly documented storage can erase the files that make the Gateway stateful. |
| CPU architecture | Is the desired plan ARM, x86, or both, and are all required packages available? | Architecture affects package compatibility and may require the tuning described for small or ARM hosts. |
| Small-VM performance | How does the smallest practical plan behave under memory pressure and concurrent work? | Low-memory hosts may need cache and restart tuning, and heavy agent workloads can outgrow them. |
| Deployment model | Do you want a hands-on VM or a more managed deployment workflow? | Managed convenience can reduce administration, while a conventional VM gives more direct control over SSH, systemd, disks, and firewalls. |
| Price and billing | What is the current regional price, billing unit, backup charge, and commitment? | Costs change by region, plan, storage, bandwidth, and promotions; verify current terms before provisioning. |
Because the OpenClaw documentation does not publish a universal CPU, RAM, disk, or cost floor, select a plan using observed workload and recovery requirements rather than a nominal “minimum.” Start with a plan that leaves memory headroom, monitor it while connecting channels and running representative tasks, and resize when the service or operating system is consistently under pressure.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesTuning small VMs and ARM hosts
The official VPS guidance includes two settings for low-power VMs or ARM hosts:
NODE_COMPILE_CACHE=/var/tmp/openclaw-compile-cacheNODE_COMPILE_CACHE gives Node a persistent compile-cache location, which can improve repeated command and worker startup times. Ensure that the chosen path is on storage that remains available across the process lifecycle and has suitable permissions.
OPENCLAW_NO_RESPAWN=1OPENCLAW_NO_RESPAWN=1 keeps routine Gateway restarts in-process instead of respawning. On systemd hosts, the guide also suggests a longer TimeoutStartSec when startup needs more time, plus SSD-backed state and cache paths. Apply these adjustments only after confirming that the service’s environment and systemd unit receive the variables and timeout you intend; a setting written in an unrelated shell profile will not necessarily reach the managed service.
Backups, updates, and recovery
Back up both the Gateway state and the workspace. Backing up only the VPS disk or only a project directory can leave you without sessions, routing data, or channel configuration. Keep at least one recovery copy separate from the running VM, restrict access to backups because they can contain credentials or private conversations, and periodically verify that the copy can be read.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Document the recovery sequence: provision a compatible Linux host, restore the state and workspace with correct ownership and permissions, reinstall the supported Node and OpenClaw versions, reinstall the managed Gateway service, and run the verification commands. The exact restore mechanics depend on your backup system; the important property is that a failed host does not require reconstructing the configuration from memory.
Before upgrading Node or OpenClaw, take a fresh backup and record the currently working version from openclaw --version. After an upgrade, run openclaw doctor and openclaw gateway status, then test the dashboard and one channel before declaring the migration complete.
Troubleshooting common installation failures
| Symptom | Checks and corrective action |
|---|---|
| The installer stops before onboarding | Confirm the VPS has network access, an account allowed to install software, and a supported Node environment. Re-run the installer only after correcting the reported operating-system or permission problem. |
| Node is rejected | Check the installed version. OpenClaw requires Node 24.16+ or 26.1+; Node 26 is the documented recommendation. Install a supported release, then run the installer or onboarding again. |
| Onboarding cannot complete an AI request | Verify the selected provider API key, its permissions and billing status, and outbound network access from the VPS. Re-run the real-completion check after correcting the provider configuration. |
| The service is not running after SSH logout | Run openclaw gateway status. If no managed service exists, install it with openclaw gateway install or openclaw onboard --install-daemon; then check the status again. |
| The dashboard works on the VPS but not remotely | Confirm that you are using the intended SSH tunnel or Tailscale Serve path. If the Gateway is loopback-bound, a direct browser connection to the VPS address will not work by design. |
| A LAN or tailnet binding is reachable but rejected | Check that gateway.auth.token or gateway.auth.password is configured, unless a trusted proxy is deliberately handling authentication. |
| Startup is slow on a small or ARM VM | Use the documented Node compile-cache path, consider OPENCLAW_NO_RESPAWN=1, allow more systemd startup time with TimeoutStartSec, and place state and cache on SSD-backed storage. |
| A restored VPS lacks sessions or projects | Restore both Gateway state and workspace, not just the operating-system image or an individual project directory. Check file ownership and permissions before starting the service. |
A practical deployment checklist
- Provision a Linux VPS with SSH access and choose a region close to the operator and channels.
- Decide whether administration will use loopback plus SSH, Tailscale, or an authenticated network binding.
- Install Tailscale first if you intend to restrict administration to a tailnet, and verify a second SSH session before closing public SSH.
- Install a supported Node release: 24.16+ or 26.1+, with Node 26 recommended.
- Run the official installer and complete onboarding with a working AI-provider API key.
- Install the managed Gateway service.
- Run
openclaw --version,openclaw doctor, andopenclaw gateway status. - Keep the Gateway on loopback unless you have a specific, authenticated reason to bind to a LAN or tailnet address.
- Open the dashboard through
openclaw dashboardand a private access path. - Connect one channel, perform a controlled test, then add additional channels.
- Back up Gateway state and workspace, protect those backups, and test restoration.
- For shared use, provide a dedicated runtime and OS accounts; for adversarial users, separate gateways, hosts, or OS users.
Is running OpenClaw on a VPS secure?
It can be, provided you treat the VPS as a production service rather than as an exposed development shell. The safest baseline is a hardened SSH path, a loopback-bound Gateway, SSH tunneling or Tailscale Serve for the dashboard, explicit authentication for any LAN or tailnet binding, dedicated accounts for shared deployments, and tested backups of state and workspace. The VPS gives OpenClaw continuous availability, but it also concentrates credentials, conversations, routing data, and code-access permissions in one server that you must secure and recover.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
