OpenClaw on Linux and Ubuntu

Linux is the platform the Gateway is written for: Node is the primary and recommended runtime, the service is a systemd user unit, and every server guide in the docs ends up here. The newer part is the desktop companion, a Tauri app that sets up a local Gateway or connects to a remote one, ships as a deb or an AppImage, and lives in the system tray. Here is what the companion does on first run, what the bundles require, the rules for remote connections, and the caveats about sleep, codecs and voice.

The Gateway is fully supported on Linux.

The companion on first run

• Get started, then choose where the assistant lives: on this computer, which installs missing prerequisites and starts the Gateway as a systemd user service; or on another computer, a discovered Gateway, a URL, or an SSH tunnel, with the port defaulting to 18789.
• It installs the CLI and Node in a private managed runtime rather than requiring a global install, delegates install, start, stop and restart to the CLI-managed service, discovers nearby Gateways over Bonjour and can keep several dashboards connected at once.
• Model Setup checks for credentials, offers a sign-in or a key, and requires a successful model response before opening the agent; onboarding can then import Claude Code, Codex or Hermes memories into the workspace.

Installing the bundle

Stable releases ship a deb and an AppImage named after the version, with a checksum file beside them. The deb installs with apt; the AppImage needs FUSE 2, the libfuse2 package or its t64 variant on Ubuntu 24.04 and later, or runs with the extract-and-run variable. The published AppImages are built on Ubuntu 22.04 and need glibc 2.35 or newer plus a libstdc++ that provides the 3.4.30 symbol: Ubuntu 22.04 and Debian 12 meet that floor, RHEL 9 and Rocky Linux 9 ship 2.34 and cannot run it, and extracting the AppImage does not get around the requirement.

Remote connections and secrets

• Use HTTPS or secure WebSockets for public direct connections; plain HTTP or WebSockets are for loopback, trusted private networks and tailnet hosts.
• If the saved config pins a TLS fingerprint, choose the SSH tunnel: the embedded browser cannot enforce a certificate pin, so the app refuses a direct connection rather than expose the dashboard or its credentials.
• A provider API key in the app’s environment is kept by the Gateway service in an owner-only environment file; provider admin keys, GitHub tokens and unrelated variables are not copied into the service.

How to install OpenClaw lists every install method for the CLI path, and OpenClaw on a VPS is the checklist for a Linux server without a desktop.

Sleep, codecs, and Talk

With systemd-logind the companion prepares a suspension lease for its local Gateway before the host sleeps and resumes it after wake; remote routes are left alone. Media playback uses GStreamer: WebM, Opus, Vorbis and WAV through the good plugins, H.264, AAC and MP3 through libav or the bad plugins, which the deb declares and the AppImage bundles. Realtime Talk inside the embedded WebView is not validated, because the shell does not grant the microphone to WebKitGTK, so use a regular browser for Talk. OpenClaw on a Raspberry Pi is the Linux install on the smallest hardware, and OpenClaw system requirements has the general floor.

On Diali

Diali runs the Linux Gateway for you, on an isolated instance with the service, the updates and the exposure handled, and the desktop companion is simply not needed: the dashboard is the app. Hosted OpenClaw on Diali is the assistant.

• Node runtime, systemd user service, deb or AppImage companion.
• glibc 2.35 for the AppImage; Ubuntu 22.04 and Debian 12 pass, RHEL 9 does not.
• Direct remote connections need TLS; a pinned fingerprint means the SSH tunnel.