OpenClaw Containerized Deployment Guide

Deployment video: OpenClaw Advanced Tutorial (all platforms): Docker isolation + browser networking + Feishu streaming output

Volcano Engine coding plan: Ark Coding Plan (the 9.9 promo has ended; currently only a 10% off first-order discount)

Qiniu Cloud free trial token: Qiniu Cloud

iFlytek Coding Plan: iFlytek

This guide will help you quickly set up an OpenClaw environment via Docker, including the main program, the CLI management tool, and a headless browser.

Feishu official plugin installation guide : OpenClaw Feishu Official Plugin User Guide

Why Deploy with Docker?

OpenClaw involves a large number of environment dependencies and network requests while running. The main reasons Docker is recommended are as follows:

• Runtime environment isolation: OpenClaw depends on specific runtime libraries. Running it in a container prevents it from modifying your host system configuration and avoids the “dependency hell” caused by version conflicts.
• Least privilege: Through Docker, we can restrict OpenClaw to only specific directories and resources. Even if the program misbehaves or triggers an unknown security vulnerability, the damage stays confined inside the container.
• Sensitive information protection: All API Keys and environment variables are managed through Docker config files (such as .env) and are not exposed in the system’s global process list, greatly reducing the risk of key leakage.
• One-click cleanup: If you no longer need the environment, just delete the container and image, and the host stays clean as new, with no leftover files.

1. Environment Preparation

Before you begin, install the appropriate Docker runtime for your operating system:

• Windows: we recommend installing Docker Desktop.
• macOS: we recommend the lightweight OrbStack or Docker Desktop.
• Linux (or other Linux-like systems): refer to the official documentation to install Docker and Docker Compose.

---

2. Deploying Docker Compose

Create a working directory (such as openclaw),

In that directory, create a .env file and write the following:

VOLC_API_KEY=xxxxxxxx
LARK_APP_ID=xxxxxxx
LARK_APP_SECRET=xxxxxx

Create a docker-compose.yml file in that directory and write the following:

services:
  # --- OpenClaw main program (Gateway) ---
  openclaw-gateway:
    image: crpi-a1liy20beodq2bdl.cn-beijing.personal.cr.aliyuncs.com/bujic/openclaw:v2026.3.12
    container_name: openclaw-main
    restart: unless-stopped
    init: true
    environment:
      TZ: Asia/Shanghai
      NODE_ENV: production
      HOME: /home/node
      TERM: xterm-256color
      OPENCLAW_GATEWAY_TOKEN: "YOUR_CUSTOM_TOKEN" # replace with your own secure Token
      OPENCLAW_ALLOW_INSECURE_PRIVATE_WS: "true"
      PATH: "/home/node/.openclaw/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
      VOLC_API_KEY: ${VOLC_API_KEY}    # sensitive information injected via environment variables
      LARK_APP_ID: ${LARK_APP_ID}
      LARK_APP_SECRET: ${LARK_APP_SECRET}
    volumes:
      - ./openclaw_data:/home/node/.openclaw
      - ./workspace:/home/node/.openclaw/workspace
    ports:
      - "18789:18789"
      - "18790:18790"
      - "9222:9222" # headless browser port
    command: ["node", "dist/index.js", "gateway", "--bind", "lan", "--port", "18789"]


  # --- Headless browser (Headless Shell) ---
  headless-shell:
    image: crpi-a1liy20beodq2bdl.cn-beijing.personal.cr.aliyuncs.com/bujic/headless-shell:latest
    container_name: headless-shell
    network_mode: "service:openclaw-gateway"
    restart: unless-stopped
    shm_size: "2g"

---

3. Configuration File Setup

Create openclaw.json under the openclaw_data directory. This file configures the model provider, browser connection, and channel information.

Path hint: ./openclaw_data/openclaw.json

{
    "meta": {
        "lastTouchedVersion": "2026.3.12"
    },
    "browser": {
        "enabled": true,
        "attachOnly": true,
        "defaultProfile": "browserless",
        "noSandbox": false,
        "headless": false,
        "ssrfPolicy": {
          "dangerouslyAllowPrivateNetwork": true
        },
        "profiles": {
            "browserless": {
                "cdpUrl": "http://127.0.0.1:9222",
                "color": "#00AA00"
            }
        }
    },
    "models": {
        "mode": "merge",
        "providers": {
            "volcengine": {
                "baseUrl": "https://ark.cn-beijing.volces.com/api/v3",
                "apiKey": "${VOLC_API_KEY}",
                "auth": "api-key",
                "api": "openai-completions",
                "models": [
                    {
                        "id": "doubao-seed-2-0-mini-260215",
                        "name": "doubao"
                    }
                ]
            }
        }
    },
    "channels": {
        "feishu": {
            "enabled": false,
            "appId": "${LARK_APP_ID}",
            "appSecret": "${LARK_APP_SECRET}",
            "connectionMode": "websocket",
            "dmPolicy": "allowlist",
            "allowFrom": [
                "YOUR_USER_ID"
            ],
            "streaming": true,
            "footer": {
                 "elapsed": true,
                 "status": true
            }
        }
    },
    "agents": {
        "defaults": {
            "workspace": "/home/node/.openclaw/workspace",
            "model": {
                "primary": "volcengine/doubao"
            },
            "sandbox": {
                "mode": "off"
            }
        }
    },
    "commands": {
        "native": "auto",
        "nativeSkills": "auto",
        "restart": true,
        "ownerDisplay": "raw"
    },
    "gateway": {
        "mode": "local",
        "controlUi": {
            "dangerouslyAllowHostHeaderOriginFallback": true,
            "allowInsecureAuth": true,
            "dangerouslyDisableDeviceAuth": true
        }
    },
    "plugins": {
        "entries": {
            "feishu": {
                "enabled": false
            },
            "openclaw-lark": {
                "enabled": true
            }
        },
        "installs": {
            "openclaw-lark": {
                "source": "npm",
                "spec": "@larksuite/openclaw-lark",
                "installPath": "/home/node/.openclaw/extensions/openclaw-lark",
                "version": "2026.3.12",
                "resolvedName": "@larksuite/openclaw-lark",
                "resolvedVersion": "2026.3.12",
                "resolvedSpec": "@larksuite/openclaw-lark@2026.3.12",
                "integrity": "sha512-MNcDrerQrO42I09w+M8q6dwnWHMKxOnXSCLG4qNwcekjGeDmA53lIuWJtGMpjTzvDjYkoWnN+8Zg78+FRCSV9w==",
                "shasum": "113a4f9e9802fbb6b8c65677f1ede2c36e823a72",
                "resolvedAt": "2026-03-13T08:59:23.563Z",
                "installedAt": "2026-03-13T08:59:32.378Z"
            }
        }
    }
}

---

4. Starting and Running

1. Start the container: in the terminal, enter the directory and run:

# Start
docker compose up -d

# Stop
docker compose down

2. Enter the CLI management interface: if you need an interactive command line, run:

# Enter the container
docker exec -it openclaw-main  /bin/bash

# Interactive setup wizard
openclaw configure

3. Check the logs:

docker logs -f openclaw-main

4. Web login method

http://127.0.0.1:18789/#token=your-secure-token

5. Install the official Feishu plugin (must be run inside the container)

# Enter the container
docker exec -it openclaw-main  /bin/bash
# Install
npx -y @larksuite/openclaw-lark-tools install
# Update
npx -y @larksuite/openclaw-lark-tools update

---

💡 Tips

• API Key: be sure to replace the values in .env with your own Volcano Engine, Anyrouter, or Feishu keys.
• Token: set OPENCLAW_GATEWAY_TOKEN to a complex string to keep the gateway secure.
• Directory permission issues: these can be fixed by repairing folder ownership; run the following on the host machine:

sudo chown -R 1000:1000 <actual host path>

After that, restart your Docker container.