GCP

Run a persistent OpenClaw Gateway on a GCP Compute Engine VM using Docker, with durable state, baked-in binaries, and safe restart behavior.

If you want "OpenClaw 24/7 for ~$5-12/mo", this is a reliable setup on Google Cloud.

Pricing varies by machine type and region; pick the smallest VM that fits your workload and scale up if you hit OOMs.

- Create a GCP project and enable billing

- Create a Compute Engine VM

- Install Docker (isolated app runtime)

- Start OpenClaw Gateway in Docker

- Persist ''~/.openclaw'' + ''~/.openclaw/workspace'' on host (survives restarts/rebuilds)

- Access Control UI from your laptop via an SSH tunnel

The Gateway can be accessed via:

- SSH port forwarding from your laptop

- Direct port exposure if you manage firewalling and tokens yourself

This guide uses Debian on GCP Compute Engine.

Ubuntu also works; map packages accordingly.

For generic Docker flow, see ''Docker''.

- GCP account (free tier eligible for e2-micro)

- gcloud CLI installed (or use Cloud Console)

- SSH access from your laptop

- Basic comfort with SSH + copy/paste

- ~20-30 minutes

- Docker and Docker Compose

- Model auth credentials

- Optional provider credentials

- WhatsApp QR

- Telegram bot token

- Gmail OAuth

CLI:

gcloud projects create my-openclaw-project --name="OpenClaw Gateway"
gcloud config set project my-openclaw-project

Enable billing at https://console.cloud.google.com/billing (required for Compute Engine).

Enable the Compute Engine API:

gcloud services enable compute.googleapis.com

Console:

1. Go to IAM & Admin > Create Project

2. Name it and create

3. Enable billing for project

4. Navigate to APIs & Services > Enable APIs > search "Compute Engine API" > Enable

CLI:

gcloud compute ssh openclaw-gateway --zone=us-central1-a

Console:

Click "SSH" button next to your VM in the Compute Engine dashboard.

Note: SSH key propagation can take 1-2 minutes after VM creation. If connection is refused, wait and retry.

git clone https://github.com/openclaw/openclaw.git
cd openclaw

This guide assumes you will build a custom image to guarantee binary persistence.

Create ''.env'' in the repository root.

OPENCLAW_IMAGE=openclaw:latest
OPENCLAW_GATEWAY_TOKEN=change-me-now
OPENCLAW_GATEWAY_BIND=lan
OPENCLAW_GATEWAY_PORT=18789

OPENCLAW_CONFIG_DIR=/home/$USER/.openclaw
OPENCLAW_WORKSPACE_DIR=/home/$USER/.openclaw/workspace

GOG_KEYRING_PASSWORD=change-me-now
XDG_CONFIG_HOME=/home/node/.openclaw

Generate strong secrets:

openssl rand -hex 32

Do not commit this file.

Installing binaries inside a running container is a trap.

Anything installed at runtime will be lost on restart.

All external binaries required by skills must be installed at image build time.

The examples below show three common binaries only:

- ''gog'' for Gmail access

- ''goplaces'' for Google Places

- ''wacli'' for WhatsApp

These are examples, not a complete list.

You may install as many binaries as needed using the same pattern.

If you add new skills later that depend on additional binaries, you must:

1. Update the Dockerfile

2. Rebuild the image

3. Restart the containers

Example Dockerfile

FROM node:22-bookworm

RUN apt-get update && apt-get install -y socat && rm -rf /var/lib/apt/lists/*

RUN curl -L https://github.com/steipete/gog/releases/latest/download/gog_Linux_x86_64.tar.gz \
  | tar -xz -C /usr/local/bin && chmod +x /usr/local/bin/gog

RUN curl -L https://github.com/steipete/goplaces/releases/latest/download/goplaces_Linux_x86_64.tar.gz \
  | tar -xz -C /usr/local/bin && chmod +x /usr/local/bin/goplaces
RUN curl -L https://github.com/steipete/wacli/releases/latest/download/wacli_Linux_x86_64.tar.gz \
  | tar -xz -C /usr/local/bin && chmod +x /usr/local/bin/wacli


WORKDIR /app
COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
COPY ui/package.json ./ui/package.json
COPY scripts ./scripts

RUN corepack enable
RUN pnpm install --frozen-lockfile

COPY . .
RUN pnpm build
RUN pnpm ui:install
RUN pnpm ui:build

ENV NODE_ENV=production

CMD ["node","dist/index.js"]

docker compose logs -f openclaw-gateway

Success:

[gateway] listening on ws://0.0.0.0:18789

OpenClaw runs in Docker, but Docker is not the source of truth.

All long-lived state must survive restarts, rebuilds, and reboots.

| Component | Location | Persistence mechanism | Notes |

| Gateway config | ''/home/node/.openclaw/'' | Host volume mount | Includes ''openclaw.json'', tokens |

| Model auth profiles | ''/home/node/.openclaw/'' | Host volume mount | OAuth tokens, API keys |

| Skill configs | ''/home/node/.openclaw/skills/'' | Host volume mount | Skill-level state |

| Agent workspace | ''/home/node/.openclaw/workspace/'' | Host volume mount | Code and agent artifacts |

| WhatsApp session | ''/home/node/.openclaw/'' | Host volume mount | Preserves QR login |

| Gmail keyring | ''/home/node/.openclaw/'' | Host volume + password | Requires ''GOG_KEYRING_PASSWORD'' |

| External binaries | ''/usr/local/bin/'' | Docker image | Must be baked at build time |

| Node runtime | Container filesystem | Docker image | Rebuilt every image build |

| OS packages | Container filesystem | Docker image | Do not install at runtime |

| Docker container | Ephemeral | Restartable | Safe to destroy |

SSH connection refused

SSH key propagation can take 1-2 minutes after VM creation. Wait and retry.

OS Login issues

Check your OS Login profile:

gcloud compute os-login describe-profile

Ensure your account has the required IAM permissions (Compute OS Login or Compute OS Admin Login).

Out of memory (OOM)

If using e2-micro and hitting OOM, upgrade to e2-small or e2-medium:

gcloud compute instances stop openclaw-gateway --zone=us-central1-a

gcloud compute instances set-machine-type openclaw-gateway \
  --zone=us-central1-a \
  --machine-type=e2-small

gcloud compute instances start openclaw-gateway --zone=us-central1-a

- Set up messaging channels: ''Channels''

- Pair local devices as nodes: ''Nodes''

- Configure the Gateway: ''Gateway configuration''