OpenClaw on Google Cloud

The docs’ Google Cloud page is the same shape as the Hetzner one: a Debian VM, Docker installed with the official script, the Gateway port kept closed to the internet, and an SSH tunnel to the dashboard, with the shared Docker VM runtime page owning everything inside the container. What is specific to Google Cloud is the project and billing setup, the machine sizing, the gcloud commands, and the firewall review. Here is the sequence, in the docs’ order.

Provisioning

• Initialize and authenticate the gcloud CLI, or use the console; create a project, set it as current, enable the Compute Engine API, and enable billing, because Compute Engine will not start without it.
• Choose a machine: two vCPUs with eight gigabytes for a source image build, or a four- or two-gigabyte machine with the official pre-built image; create a Debian 12 VM with a twenty-gigabyte boot disk in a zone of your choice.
• Review the firewall rather than adding to it: keep the Gateway port closed to the public internet, restrict SSH source ranges to your administrative network when possible, and follow the security guide instead of a broad rule if you mean to expose the Gateway through a proxy or a tailnet.

Keep TCP 18789 closed to the public Internet.

On the VM

Connect over SSH with the gcloud command, allowing a minute or two for key propagation after creation. Install Docker with the official convenience script, add your user to the docker group, reconnect so the group applies, and verify Docker and Compose. From there the Docker VM runtime page takes over: the container setup, persistence under the state and workspace directories, custom binaries, verification and updates.

The sizing rule

• Use at least six gigabytes of memory for a source image build; on a smaller machine use the official pre-built image instead of building.
• Pricing varies by machine type and region; the machine table is the docs’ recommendation, not a floor for the pre-built path.
• The tunnel is the way in: SSH access to the VM is all the firewall needs, and the dashboard is reached through a forwarded loopback port.

OpenClaw on Docker explains the container that runs on the VM, and OpenClaw on Hetzner is the same recipe on a provider with more memory per dollar.

What stays yours

A Compute Engine VM is a rented server with a good CLI: the project, the billing, the image choice, the firewall review, the tunnel and the updates are all operator work, and OpenClaw on a VPS is the checklist that applies to it as to any other.

On Diali

Diali runs on Google Cloud too, in the EU, and every line of that page is a line we run for you: the VM, the container, the closed port, the updates. Hosted OpenClaw on Diali is the assistant and Security on Diali describes the boundary.

• A project with billing, a Debian VM, Docker from the official script.
• Six gigabytes to build, or the pre-built image on less.
• The firewall admits SSH; the Gateway port stays closed.