Tutorial 10 min read 2026-03-13

How to Deploy OpenClaw on a VPS Without Exposing the Dashboard

A practical OpenClaw VPS guide focused on the part beginners get wrong most often: keeping the dashboard private while still making remote access easy.

This is not a copy of the official docs. It is a buyer-friendly deployment article that stays close to the current OpenClaw install and remote-access guidance.

Start with the right mental model

Most OpenClaw VPS tutorials fail in one of two ways:

1. They focus only on "getting it installed" and ignore remote access.
2. They tell you to expose the dashboard on a public IP as if it were a normal SaaS admin panel.

The current OpenClaw docs point in a better direction:

• use a clean Ubuntu LTS VPS
• install with the recommended installer
• run onboarding
• reach the dashboard via SSH tunnel or Tailscale

That is the path you should follow unless you have a strong reason to do something more custom.

What you need before you start

• A VPS running Ubuntu LTS or another modern Debian/Ubuntu
• SSH access to that VPS
• A model API key or the credentials required for the channels you plan to enable
• Enough resources for the role:
• Absolute minimum: 1 vCPU, 1GB RAM, ~500MB disk
• Recommended: 1-2 vCPU and 2GB RAM or more if you want headroom

If you are still choosing a host, use the hosting comparison page first.

Step 1: Pick a clean VPS, not a marketplace image

The installer docs explicitly recommend avoiding third-party one-click marketplace images when possible.

That means:

• choose a clean Ubuntu image
• provision SSH access
• avoid "OpenClaw preinstalled" style shortcuts unless you fully trust and understand them

If you want the least ambiguous path, use DigitalOcean. If you want a more generic VPS workflow, the Hostinger and Vultr guides on this site follow the same clean-Ubuntu approach.

Step 2: Install OpenClaw the recommended way

curl -fsSL https://openclaw.ai/install.sh | bash

If you already manage Node yourself, the docs also support:

npm install -g openclaw@latest
openclaw onboard --install-daemon

Docker still exists as an official alternative install method, but it is not the default recommendation for a first VPS setup.

Step 3: Verify the install before you do anything fancy

openclaw doctor
openclaw status
openclaw dashboard

At this point, the job is not "open ports until the UI shows up." The job is to keep the Gateway healthy and access the UI safely.

Step 4: Choose a remote access pattern

Option A: SSH tunnel

This is still the simplest option for many users:

ssh -N -L 18789:127.0.0.1:18789 user@your-vps

Then open:

http://127.0.0.1:18789/

Option B: Tailscale Serve

If you already use Tailscale and want a smoother long-term setup, OpenClaw now documents Tailscale Serve as a first-class remote-access option.

openclaw gateway --tailscale serve

That keeps the Gateway bound to loopback while Tailscale handles HTTPS and routing inside your tailnet.

What not to do

• Do not expose the Control UI casually on a public IP.
• Do not assume the cheapest 1GB VPS will feel good once you add logs, media, or multiple channels.
• Do not start with a random blog post that skips onboarding or ignores current auth defaults.

Which provider should you choose?

• Choose DigitalOcean if you want the closest thing to a docs-backed cloud path.
• Choose Hostinger if you want a simpler commercial onboarding flow.
• Choose Vultr if region choice matters and you are comfortable with a generic VPS adaptation.

The easiest next step is to use the hosting comparison page, then open the exact guide for your provider.