How to Deploy OpenClaw on Hetzner - Docker VPS Guide

Hetzner is one of the most compelling low-cost places to run OpenClaw, and the official docs lean into that. The documented path is a production-minded Docker VPS setup with durable host-mounted state, a custom image so required binaries survive, and SSH tunnel access to the gateway instead of a casually exposed dashboard.

What the official docs support

The docs frame this as a persistent Ubuntu or Debian VPS deployment, not disposable infrastructure. State lives under /root/.openclaw, Docker handles the runtime, and the Control UI is meant to be reached through an SSH tunnel unless you intentionally expose the service and harden it yourself.

I like this route for operators who want a simple, predictable Linux box they control end to end. You are not fighting platform abstractions, and the docs are honest about the tradeoff: keep personal data, browser profiles, and mixed-trust workloads off the same machine if the gateway is going to act like business infrastructure.

What you need first

• A Hetzner VPS with root access
• SSH access from your laptop
• Docker and Docker Compose on the VPS
• Provider credentials for whichever models and channels you plan to use

Recommended setup flow

The core idea is simple: make the host own the durable state, make Docker own the runtime, and keep the web surface private by default.

1. Provision an Ubuntu or Debian VPS in Hetzner, then SSH in as root. The docs explicitly call the server stateful infrastructure rather than something you throw away casually, which is a helpful framing for backup and auth decisions.
2. Install Docker with apt-get plus the Docker install script, then verify docker --version and docker compose version. This is the base layer that will hold the gateway image and restart policy.
3. Clone the OpenClaw repository and create the persistent host directories under /root/.openclaw and /root/.openclaw/workspace. The docs also call out setting ownership to uid 1000 so the container user can write cleanly.
4. Create the .env file with OPENCLAW_IMAGE, OPENCLAW_GATEWAY_BIND, OPENCLAW_GATEWAY_PORT, OPENCLAW_CONFIG_DIR, OPENCLAW_WORKSPACE_DIR, and GOG_KEYRING_PASSWORD. Leave OPENCLAW_GATEWAY_TOKEN blank unless you intentionally want to manage it there, because OpenClaw can generate a random token on first start.
5. Use the documented docker-compose.yml pattern that bind-mounts config and workspace from the host, then follow the shared Docker VM runtime steps to bake required binaries, build, launch, and finally connect through ssh -N -L 18789:127.0.0.1:18789 root@YOUR_VPS_IP.

ssh root@YOUR_VPS_IP
apt-get update
apt-get install -y git curl ca-certificates
curl -fsSL https://get.docker.com | sh

Access, safety, and operational notes

The docs are clear that the safest default is a loopback-style access pattern through SSH tunneling. That keeps the gateway private while still making the Control UI easy to reach from your own laptop. If you later expose it publicly, that should be a deliberate network and auth decision, not an accident of port mapping.

The other useful thing in the Hetzner guide is the pointer to the shared Docker VM runtime documentation. Rather than duplicating everything, the page tells you exactly where to look for build, launch, persistence, and update behavior. That usually means fewer platform-specific surprises later.

How to verify it is working

After the container is up, open the dashboard through the SSH tunnel, confirm the gateway token or password works, and then verify persistence by restarting the container and checking that openclaw.json, auth-profiles, and workspace files remain mounted from the host.

Common gotchas

• Treat the VPS as stateful infrastructure, not a disposable scratch box
• Persistent data belongs on the host, not only inside the container image
• SSH tunneling is the documented default access path, not a public wide-open port

If you want the operator version with tighter rollout checklists, safer defaults, and more production patterns, The OpenClaw Playbook is the easiest shortcut.