coollabsio/openclaw

What it solves

Running the OpenClaw agent gateway in production is fiddly: you need a reverse proxy, a web interface, a way to share browser sessions, persistent storage, and safe sandboxing. This project packages all that into a single Docker image with a compose file, so you can spin up the gateway, pair your browser or Mac app, and keep your data across updates.

How it works

The image boots an entrypoint script that reads environment variables, writes an openclaw.json config, runs doctor --fix, starts nginx as a reverse proxy on port 8080, and launches the gateway process (which listens internally on port 18789). nginx handles HTTP basic auth for the UI and WebSocket, and forwards /healthz without auth. A persistent volume at /data stores config, chat history, paired devices, and the workspace. An optional browser sidecar (CDP + VNC) is started with docker compose; it lets you log into sites that need OAuth/2FA, and the gateway reuses that session via CDP. Tool execution can be sandboxed by mounting the host Docker socket so the gateway can create sibling containers; the README stresses that this gives the container root on the host.

Who it’s for

Anyone who wants to self‑host the OpenClaw AI agent gateway—whether with a simple docker run for a single container, a full docker compose setup that includes the browser sidecar and webhooks, or a Coolify deployment. It’s also for people using the OpenClaw Mac app who need a remote gateway to connect to.

Highlights

• Single‑container docker run for a minimal setup; docker compose adds a browser sidecar and webhook hooks.
• nginx reverse proxy with basic auth, a health endpoint, and configurable allowed origins.
• Environment‑variable configuration for many AI providers (Anthropic, OpenAI, Gemini, DeepSeek, and more) with automatic primary model selection.
• Persistent /data volume keeps credentials, pairing, history, and workspace across container recreations.
• First‑login device approval: approve a browser or Mac app via openclaw devices list and openclaw devices approve.
• Optional Docker‑socket sandboxing to run tool‑executing sibling containers, with clear warnings about the security implications.
• Automatic image builds via GitHub Actions that publish new versions to Docker Hub, and a straightforward update path on Coolify.