OpenClaw on a VPS

A VPS is the classic way to keep OpenClaw running when your laptop is closed. It works, and upstream documents a dozen providers. It is also where most of the two-in-the-morning stories come from. Here is the setup as the docs describe it, the parts people skip, and the point at which renting a server stops being cheaper than not renting one.

How a cloud setup is meant to work

The Gateway runs on the server and owns the state and the workspace; you reach it from your laptop or phone through the Control UI, an SSH tunnel or Tailscale. The secure default keeps the Gateway on loopback. If you bind it to a LAN or tailnet address it demands a shared secret, and the docs tell you to harden SSH access to the box before you install anything on a public host.

• Treat the server as the source of truth, and back up state and workspace regularly.
• On small or ARM machines, enable Node’s compile cache and keep restarts in-process, or CLI commands feel slow.
• With systemd, give the service a longer start timeout; the managed unit already restarts it on failure.
• Out-of-memory kills show up as exit code 137; the platform page explains which child process gets picked.

The parts people skip

Certificates, the reverse proxy, port conflicts, an extra tunnel to reach the dashboard, and the update that renames a config key. The upstream pages cover each one. The threads about them are what fills every forum on the subject.

Even with a nice provisioning script I found myself back in an ssh terminal at 11pm debugging why the agent stopped responding.

The arithmetic

A VPS has a monthly price, and it is often lower than a managed plan. But the model bill is the same wherever the Gateway runs, and the cost calculator shows it is usually the larger number. The line that actually differs is your time, and the moment the server needs an evening a month, the cheaper option is not the cheaper option.

When the VPS is still right

You already run servers and enjoy it. You need a specific region, a specific kernel, or hardware the agent must sit next to. You want root, and you accept what comes with it. Our page on your own server makes that case properly before saying where it stops.

And when it is not

If what you want is the agent rather than the box, hosted OpenClaw is the same runtime on an isolated instance in the EU, with the hardening, updates and backups already done, reachable from your messaging apps rather than an SSH tunnel.

• Rent the box if you want the box.
• Host the agent if you want the agent.
• Either way, back up the state and read the security page before you open a port.