OpenClaw on a Hetzner VPS

The upstream docs have a Hetzner page, and it is the honest shape of a self-hosted Gateway: a Debian or Ubuntu server, Docker, a cloud firewall that admits SSH and nothing else, and an SSH tunnel from your laptop to reach the dashboard. Hetzner is there because it gives more cores and memory per dollar than the alternatives the docs list. Here is what the page asks for, in order, and the two lines that decide whether the result stays secure.

What you need

• A Hetzner VPS with root access and your SSH key added at provisioning; at least six gigabytes of memory for a source image build, or the official pre-built image on a smaller server.
• A Hetzner Cloud Firewall, or a host firewall, that allows SSH from your administrative network and nothing inbound on the Gateway port.
• Model credentials and, optionally, channel credentials.
• About twenty minutes.

The shape of the install

Provision, connect as root, restrict inbound traffic, install Docker with the official script, then follow the shared Docker runtime page from beginning to end: it owns the container setup, persistence under the state and workspace directories, custom binaries, verification and updates. If a source build ends with a kill signal or exit code 137, the docs say to resize the server rather than retry. The setup treats the VPS as stateful infrastructure and says to keep personal browser, Apple, Google and password-manager profiles off a shared runtime.

Do not add a public inbound rule for TCP 18789; the tunnel below reaches that port through SSH.

Docker on the server

The Gateway runs in Docker Compose with a CLI container that shares its network namespace; the dashboard URL, device approvals and channel logins are run through that CLI container. OpenClaw on Docker explains what the setup script does and does not do, on any host.

Reaching the dashboard

• Confirm the server’s SSH daemon allows local port forwarding, validate the config and restart SSH.
• From your laptop, open a tunnel that maps the Gateway port on localhost to the same port on the server, and leave it running.
• Open the local address in a browser and paste the Gateway token from the server’s environment file; an administratively prohibited error means the forwarding setting is wrong.

The cloud firewall only ever needs to admit SSH. If you would rather publish the Gateway through a reverse proxy or a tailnet, the docs send you to the security guidance instead of opening the port to the world. OpenClaw on a VPS is the general checklist for any rented server.

On Diali

Every line of that page is a line Diali runs for you: the instance, the firewall, no public ports, outbound access to the public web only, never to our internal network, the cloud metadata server or other tenants, the Gateway and its updates, and a dashboard that is not reached through a tunnel. What stays yours is who may message the assistant and what it may do. Hosted OpenClaw on Diali is the assistant; Security on Diali describes the boundary.

• Six gigabytes for a source build, or the pre-built image.
• The firewall admits SSH; the dashboard comes through a tunnel.
• Infrastructure as code exists for it, and so does the standing job of running it.