OpenClaw in a macOS VM

The macOS VM page in the docs starts by telling most people not to read it: the recommended default is a small Linux VPS for an always-on Gateway, dedicated hardware when you want full control and a residential IP for browser automation, since many sites block data-center IPs, or a hybrid where the Gateway lives on a cheap VPS and your Mac connects as a node when a task needs the screen. A macOS VM is for two cases only: macOS-only capabilities such as iMessage, or strict isolation from your daily Mac. Here is what the VM route gives you, the Lume path, the channel and iMessage setup inside it, and the reset trick.

What the VM route gives you

• A local VM on your Apple Silicon Mac through Lume: a full macOS environment in isolation so the host stays clean, iMessage support through the imsg bridge, which the docs note is impossible on Linux or Windows, instant reset by cloning, and no extra hardware or cloud cost.
• Hosted Mac providers work too, MacStadium and others; once you have SSH into a macOS VM anywhere, the install section applies.
• What Lume needs: an Apple Silicon Mac, macOS Sequoia or later on the host, about sixty gigabytes of disk per VM, and about twenty minutes.
• The quick path: install Lume, create the VM from the latest macOS image, complete Setup Assistant and enable Remote Login, run it without a display, SSH in, install OpenClaw, configure channels.

Use a macOS VM only when you specifically need macOS-only capabilities such as iMessage, or want strict isolation from your daily Mac.

Inside the VM

The install script puts Lume under your local bin directory, which may need adding to the PATH; creating the VM downloads macOS and opens a VNC window, where you pick language and region, skip the Apple ID unless you want iMessage later, create a user, skip the optional features, enable Remote Login under Sharing, and turn on automatic login for headless use. The VM’s address comes from the Lume get command, usually in the 192.168.64 range, and you SSH in with the account you created. Installing OpenClaw is the global npm install, with the allow-scripts flag on npm 12 or 11.16 and later, then onboarding with the daemon installed. For Telegram the docs keep the bot token in the state directory’s env file and add the channel with the use-env flag, so the managed Gateway reads the same file after a restart; for WhatsApp, set the DM policy and allowlist first, then scan the login QR from inside the VM, not the host, which is also the troubleshooting answer when the QR will not scan. Stop the VM and run it again without a display, and the daemon keeps the Gateway running in the background.

iMessage, golden image, always-on

• The bonus the docs call the killer feature: sign in to Messages inside the VM, install imsg, grant Full Disk Access and Automation permission to the process running OpenClaw, verify RPC support, then enable the iMessage channel with the CLI path and the Messages database path and restart the Gateway.
• Before customising further, stop the VM and clone it as a golden image; resetting is stop, delete, clone the golden image back, run headless.
• Running around the clock means keeping the Mac plugged in, disabling sleep, and caffeinate if needed; for true always-on the docs point back to a dedicated Mac mini or a small VPS.

OpenClaw and iMessage explains the channel the VM exists for, and Install OpenClaw on a Mac the plain install on the host when isolation is not the point.

The hybrid the docs prefer

The page’s own recommendation is the split: an always-on Gateway on a small VPS, and the Mac joining as a node when a task needs the browser or the desktop, which keeps the residential IP where the browsing happens and the uptime where the power never fails. OpenClaw on a VPS is the first half and OpenClaw nodes, remote hands the second.

On Diali

Diali is the always-on half of that hybrid, the Gateway running with us, and your own computer connects as the other half when a task needs the screen in front of you. Hosted OpenClaw on Diali is the assistant and Diali versus your own computer sets it beside running everything on your own machine.

• A VM only for iMessage or strict isolation.
• Lume on Apple Silicon: create, set up, SSH, install, run headless.
• Clone a golden image before you customise.