OpenClaw

OpenClaw combines an interactive agent with a long-running gateway. This example persists its state in a named volume and maps the gateway only to host loopback.

Set up OpenClaw

Run onboarding

msb run -t --name openclaw-setup --replace \
  --cpus 2 --memory 2G --root-disk 4G \
  --mount-named openclaw-data:/root/.openclaw \
  node:24-bookworm-slim -- sh -lc '
    apt-get update &&
    apt-get install -y --no-install-recommends ca-certificates git &&
    npm install -g openclaw@2026.7.1-2 &&
    exec openclaw onboard --mode local
  '

msb run -t --name openclaw-setup --replace `
  --cpus 2 --memory 2G --root-disk 4G `
  --mount-named openclaw-data:/root/.openclaw `
  node:24-bookworm-slim -- sh -lc '
    apt-get update &&
    apt-get install -y --no-install-recommends ca-certificates git &&
    npm install -g openclaw@2026.7.1-2 &&
    exec openclaw onboard --mode local
  '

Complete the provider and channel prompts. The openclaw-data volume retains the workspace, configuration, credentials, sessions, and gateway state after the setup sandbox is removed.Verify the installed version before removing the setup sandbox:

msb exec openclaw-setup -- openclaw --version

The pinned package reports OpenClaw 2026.7.1-2.

Run the gateway

Generate a token in the host shell:

export OPENCLAW_GATEWAY_TOKEN="$(openssl rand -hex 32)"

$bytes = New-Object byte[] 32
$rng = [Security.Cryptography.RandomNumberGenerator]::Create()
$rng.GetBytes($bytes)
$rng.Dispose()
$env:OPENCLAW_GATEWAY_TOKEN = -join ($bytes | ForEach-Object { $_.ToString('x2') })

Start a fresh gateway sandbox using the persisted state:

msb run -d --name openclaw-gateway --replace \
  --cpus 2 --memory 2G --root-disk 4G \
  -p 127.0.0.1:18789:18789 \
  -e OPENCLAW_GATEWAY_TOKEN="$OPENCLAW_GATEWAY_TOKEN" \
  --mount-named openclaw-data:/root/.openclaw \
  node:24-bookworm-slim -- sh -lc '
    apt-get update &&
    apt-get install -y --no-install-recommends ca-certificates git &&
    npm install -g openclaw@2026.7.1-2 &&
    exec openclaw gateway run --bind lan --port 18789 --auth token
  '

msb run -d --name openclaw-gateway --replace `
  --cpus 2 --memory 2G --root-disk 4G `
  -p 127.0.0.1:18789:18789 `
  -e "OPENCLAW_GATEWAY_TOKEN=$env:OPENCLAW_GATEWAY_TOKEN" `
  --mount-named openclaw-data:/root/.openclaw `
  node:24-bookworm-slim -- sh -lc '
    apt-get update &&
    apt-get install -y --no-install-recommends ca-certificates git &&
    npm install -g openclaw@2026.7.1-2 &&
    exec openclaw gateway run --bind lan --port 18789 --auth token
  '

The gateway listens inside the guest on port 18789, while microsandbox exposes it only at 127.0.0.1:18789 on the host. Follow its output with:

msb logs -f openclaw-gateway

OPENCLAW_GATEWAY_TOKEN is visible to the guest and to processes that can inspect the host command environment. Use the microsandbox secrets workflow for production credentials. Do not change the host bind address to 0.0.0.0 without adding transport security and understanding the exposure.

Clean up

Remove the setup and gateway sandboxes:

msb rm -f openclaw-setup openclaw-gateway

Remove persisted OpenClaw state only when you no longer need it:

msb volume rm openclaw-data

Clear the token from the host shell:

unset OPENCLAW_GATEWAY_TOKEN

Remove-Item Env:OPENCLAW_GATEWAY_TOKEN

Keep openclaw-data if you want the configured agent to survive sandbox replacement.

Agents

CI/CD

Docker

Sandbox Workflows

Automation & Tooling

Data & Observability

Set up OpenClaw

Reference

​Set up OpenClaw

​Reference

Set up OpenClaw

Reference