OpenClaw on a DigitalOcean Droplet

The docs call DigitalOcean the straightforward paid VPS path: a one-gigabyte Basic Droplet at about six dollars a month, a clean Ubuntu image, and a script-by-script install that ends with the Gateway as a user service. They also point to Hetzner for more per dollar and to a free ARM tier elsewhere with a finicky signup. Here is each step and the reason it is there.

The steps

• Create a Droplet on a clean Ubuntu image, one vCPU and one gigabyte, with an SSH key; the docs warn against third-party one-click images unless you have read their startup scripts and firewall defaults.
• Connect as root, install Node 24, run the installer without onboarding, then create a non-root user, give it sudo and enable lingering for it. Root is for bootstrap only; OpenClaw runs as that user so its state and service belong to it.
• As that user, run onboarding with the service flag: model auth, channel setup, Gateway token, and the systemd user service in one pass.
• Add two gigabytes of swap, recommended on a one-gigabyte Droplet.
• Verify with the status command and the service status, and follow the service journal for the first minutes.

Reaching the dashboard

The Gateway binds to loopback, so there are two documented ways in: an SSH tunnel from your machine to the Gateway port, or Tailscale Serve, which authenticates the Control UI through tailnet identity and assumes the host itself is trusted. Neither opens the port to the internet, which is the point.

Use a clean base image (Ubuntu 24.04 LTS). Avoid third-party Marketplace 1-click images unless you have reviewed their startup scripts and firewall defaults.

Persistence and backups

State lives in the OpenClaw directory under the user’s home, config and credentials and sessions, and the workspace beside it with the memory files. Both survive reboots. The backup command creates an archive and restores into a fresh staging directory, with a caveat about absolute symbolic links when you move state to another host, and DigitalOcean snapshots back up the whole Droplet. OpenClaw backup and restore explains the formats and when to run them.

Compared with the others

The DigitalOcean page installs OpenClaw natively with a service; the Hetzner page runs it in Docker behind a cloud firewall. Both end with a tunnel, both leave you as the operator. OpenClaw on Hetzner is the Docker variant and OpenClaw on a VPS the checklist that applies to any rented server.

On Diali

Six dollars a month buys the Droplet, not the operator: the model bill, the updates, the swap, the tunnel and the three-in-the-morning restart are still yours. Hosted OpenClaw on Diali is the version where the instance, the Gateway and the updates are run for you, and What OpenClaw costs is the honest comparison of what each path spends.

• Clean image, non-root user, lingering, service: that is the install.
• Loopback plus a tunnel or a tailnet; never the open port.
• The Droplet is cheap; the operating is the cost.