How can I run locally through Docker, and keep myself safe?? I have absolutely no idea what Im doing | Friends of the Crustacean 🦞🤝 | Page 1

alpine wingBOT Feb 16, 2026, 6:57 PM

#

To help others find answers, you can mark your question as solved via Right click solution message -> Apps -> ✅ Mark Solution

lean ruinBOT Feb 16, 2026, 7:01 PM

#

If you’re trying to run OpenClaw locally in Docker and not accidentally expose it to the internet, this is the simplest “safe-ish” path.

Docs (worth skimming): https://docs.openclaw.ai/install/docker

1) Quick start (Docker)

From a terminal:

git clone https://github.com/openclaw/openclaw.git
cd openclaw
./docker-setup.sh

When it finishes, open:

http://127.0.0.1:18789/

#

If the Control UI asks for a token, use the one the script printed (it also writes it into the repo’s .env).

2) The main safety rules (don’t skip these)

Treat the gateway token like a password. Don’t paste it in Discord screenshots/logs.
Don’t expose port 18789 to the public internet. If you’re on a VPS, do not just open firewall/ports “to make it work”.
Keep mounts minimal. If you add OPENCLAW_EXTRA_MOUNTS, prefer :ro for anything you don’t need to write.

If you want “local-only” access

Docker’s default compose port mapping will bind on all interfaces unless you pin it.

Pick one (reply with a number):

I only want this on my own computer (recommended for beginners). I’ll show you the exact docker-compose.yml change to bind to 127.0.0.1 only.
LAN access is fine (other devices on your Wi‑Fi could reach it, but they still need the token).
I need remote access → safest is SSH tunnel or Tailscale Serve, not “open a public port”. (FAQ has the exact commands: https://docs.openclaw.ai/help/faq#how-do-i-authenticate-the-dashboard-token-on-localhost-vs-remote)

3) Two quick questions so I don’t give you the wrong steps

#

Are you on Mac, Windows, or Linux?
Is this running on your own machine or a VPS/server?

thick mango Feb 16, 2026, 7:56 PM

#

windows with docker.desktop

lean ruinBOT Feb 16, 2026, 7:57 PM

#

On Windows, the “safe + least pain” way is: Docker Desktop + WSL2, and make sure the gateway port is bound to localhost only.

Docs: https://docs.openclaw.ai/install/docker (and Windows note in FAQ: https://docs.openclaw.ai/help/faq#windows-install-says-git-not-found-or-openclaw-not-recognized)

Recommended Windows flow (WSL2)

Install Docker Desktop and enable WSL2 integration (Docker Desktop settings → Resources → WSL integration).
Open WSL (Ubuntu) and run:

sudo apt update
sudo apt install -y git
git clone https://github.com/openclaw/openclaw.git
cd openclaw
./docker-setup.sh

Open the UI on your Windows browser:

#

http://127.0.0.1:18789/

“Keep myself safe” (most important bit)

Make the Docker ports local-only

In docker-compose.yml, change the ports: entries to include 127.0.0.1: so it can’t be reached from other devices:

ports:
  - "127.0.0.1:${OPENCLAW_GATEWAY_PORT:-18789}:18789"
  - "127.0.0.1:${OPENCLAW_BRIDGE_PORT:-18790}:18790"

Then restart:

docker compose up -d

#

Quick sanity check:

docker ps

You want to see 127.0.0.1:18789->18789/tcp (not 0.0.0.0:18789->...).

Also:

Never paste your gateway token into Discord/screenshots. Treat it like a password.
Don’t port-forward 18789 on your router.

One question so I don’t steer you wrong

Are you trying to access this only from your own PC, or do you also want to access it from another device (phone/laptop) on your network / remotely?

#

Cool — Windows + Docker Desktop works, but the smoothest way is to run the setup inside WSL2 (still using Docker Desktop underneath).

Docs: https://docs.openclaw.ai/install/docker

1) One-time setup (Windows)

Install WSL2 + Ubuntu (Microsoft Store).
In Docker Desktop:
- Settings → General: “Use the WSL 2 based engine” = ON
- Settings → Resources → WSL Integration: enable your Ubuntu distro

2) Install OpenClaw via Docker (from Ubuntu/WSL)

Open “Ubuntu” and run:

sudo apt update
sudo apt install -y git

#

git clone https://github.com/openclaw/openclaw.git
cd openclaw
./docker-setup.sh

When it’s done, open on Windows:

http://127.0.0.1:18789/

3) “Keep myself safe” (most important)

By default, Docker can publish ports in a way that’s reachable from your LAN. To force local-only access, edit docker-compose.yml and change the ports to bind to 127.0.0.1:

ports:
  - "127.0.0.1:${OPENCLAW_GATEWAY_PORT:-18789}:18789"

#

  - "127.0.0.1:${OPENCLAW_BRIDGE_PORT:-18790}:18790"

Then restart:

docker compose up -d

Also: don’t share/screenshot your gateway token (treat it like a password).

Quick question

Do you want to access the UI only on this PC, or also from your phone/other devices (LAN/remote)? That changes the “safe” recommendation.

thick mango Feb 16, 2026, 8:06 PM

#

also from other devices, but i dont need to rush into that yet.

when trying to launch openclaw i get this error
"Service: Scheduled Task (registered)
File logs: ~\AppData\Local\Temp\openclaw\openclaw-2026-02-16.log
Command: C:\Program Files\nodejs\node.exe C:\Users\thor\AppData\Roaming\npm\node_modules\openclaw\dist\index.js gateway --port 18789
Service env: OPENCLAW_GATEWAY_PORT=18789

Config (cli): ~.openclaw\openclaw.json
Config (service): ~.openclaw\openclaw.json

Gateway: bind=loopback (127.0.0.1), port=18789 (service args)
Probe target: ws://127.0.0.1:18789
Dashboard: http://127.0.0.1:18789/
Probe note: Loopback-only gateway; only local clients can connect.

Runtime: stopped (state Ready, last run time 2/16/2026 3:02:18 PM)
RPC probe: failed
RPC target: ws://127.0.0.1:18789
gateway url override requires explicit credentials
Fix: pass --token or --password (or gatewayToken in tools).
Config: C:\Users\thor.openclaw\openclaw.json

Service is loaded but not running (likely exited immediately).
File logs: C:\Users\thor\AppData\Local\Temp\openclaw\openclaw-2026-02-16.log
Logs: schtasks /Query /TN "OpenClaw Gateway" /V /FO LIST

Troubles: run openclaw status
Troubleshooting: https://docs.openclaw.ai/troubleshooting
PS C:\Users\thor>"

lean ruinBOT Feb 16, 2026, 8:09 PM

#

That output is actually two separate things:

The gateway service is installed (Scheduled Task) but it’s not staying running (“exited immediately”).
The status probe is failing with: gateway url override requires explicit credentials (that’s just the probe step, not the root cause of the service dying).

The next step is to look at the gateway crash log.

Step 1 — paste the log tail (most important)

In PowerShell, run:

Get-Content -Tail 120 "$env:LOCALAPPDATA\Temp\openclaw\openclaw-2026-02-16.log"

Paste the output here in a code block. (Redact any token/password if it appears.)

That log will usually show the real reason (common ones are: gateway.mode not set to local, port already in use, missing env, etc).

#

Step 2 — quick sanity checks

Also paste the output of these:

openclaw --version
node -v
openclaw config get gateway.mode

If `gateway.mode` is missing / not `"local"`

That’s a very common cause of “service exits immediately”. Fix is to run onboarding/configure once:

openclaw onboard
# or
openclaw configure

#

(After that, try openclaw gateway start again.)

About “other devices later”

When you’re ready, the safest approach is usually Tailscale Serve or an SSH tunnel (so you don’t have to open LAN/public ports). But we can keep everything loopback-only for now.

Send the log tail and those three command outputs and I’ll tell you exactly what to fix.

thick mango Feb 16, 2026, 8:14 PM

#

"
Restarted Scheduled Task: OpenClaw Gateway
PS C:\Users\thor> openclaw gateway status

🦞 OpenClaw 2026.2.15 (3fe22ea) — Shell yeah—I'm here to pinch the toil and leave you the glory.

│
◇
Service: Scheduled Task (registered)
File logs: ~\AppData\Local\Temp\openclaw\openclaw-2026-02-16.log
Command: C:\Program Files\nodejs\node.exe C:\Users\thor\AppData\Roaming\npm\node_modules\openclaw\dist\index.js gateway --port 18789
Service env: OPENCLAW_GATEWAY_PORT=18789

Config (cli): ~.openclaw\openclaw.json
Config (service): ~.openclaw\openclaw.json

Gateway: bind=loopback (127.0.0.1), port=18789 (service args)
Probe target: ws://127.0.0.1:18789
Dashboard: http://127.0.0.1:18789/
Probe note: Loopback-only gateway; only local clients can connect.

Runtime: stopped (state Ready, last run time 2/16/2026 3:02:18 PM)
RPC probe: failed
RPC target: ws://127.0.0.1:18789
gateway url override requires explicit credentials
Fix: pass --token or --password (or gatewayToken in tools).
Config: C:\Users\thor.openclaw\openclaw.json

Service is loaded but not running (likely exited immediately).
File logs: C:\Users\thor\AppData\Local\Temp\openclaw\openclaw-2026-02-16.log
Logs: schtasks /Query /TN "OpenClaw Gateway" /V /FO LIST

Troubles: run openclaw status
Troubleshooting: https://docs.openclaw.ai/troubleshooting
PS C:\Users\thor> Service: Scheduled Task (registered)
registered : The term 'registered' is not recognized as the name of a cmdlet, function, script file, or operable
program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:26

Service: Scheduled Task (registered)
```
                     ~~~~~~~~~~
```
- CategoryInfo : ObjectNotFound: (registered:String) [], CommandNotFoundException
- FullyQualifiedErrorId : CommandNotFoundException

PS C:\Users\thor> File logs: ~\AppData\Local\Temp\openclaw\openclaw-2026-02-16.log
File : The term 'File' is not recognized as the name of a cmdlet, function, script file, or operable program. Check
the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1

File logs: ~\AppData\Local\Temp\openclaw\openclaw-2026-02-16.log

  + CategoryInfo          : ObjectNotFound: (File:String) [], CommandNotFoundException
  + FullyQualifiedErrorId : CommandNotFoundException

PS C:\Users\thor> Command: C:\Program Files\nodejs\node.exe C:\Users\thor\AppData\Roaming\npm\node_modules\openclaw\dist\index.js gateway --port 18789
Command: : The term 'Command:' is not recognized as the name of a cmdlet, function, script file, or operable program.
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1

Command: C:\Program Files\nodejs\node.exe C:\Users\thor\AppData\Roami ...

  + CategoryInfo          : ObjectNotFound: (Command::String) [], CommandNotFoundException
  + FullyQualifiedErrorId : CommandNotFoundException

PS C:\Users\thor> Service env: OPENCLAW_GATEWAY_PORT=18789
Get-Service : A positional parameter cannot be found that accepts argument 'OPENCLAW_GATEWAY_PORT=18789'.
At line:1 char:1

Service env: OPENCLAW_GATEWAY_PORT=18789

  + CategoryInfo          : InvalidArgument: (:) [Get-Service], ParameterBindingException
  + FullyQualifiedErrorId : PositionalParameterNotFound,Microsoft.PowerShell.Commands.GetServiceCommand

PS C:\Users\thor>
PS C:\Users\thor> Config (cli): ~.openclaw\openclaw.json

cmdlet Clear-Item at command pipeline position 1
Supply values for the following parameters:
Path[0]:"

is there any token or password in here?

lean ruinBOT Feb 16, 2026, 8:16 PM

#

Nope — in what you pasted there’s no token/password value shown. It only mentions that a token/password would be needed to do an RPC probe if you’re using a “URL override”.

The only “sensitive-ish” thing in your paste is just your Windows username + file paths.

Also: the lines like

Service: Scheduled Task (registered)
File logs: ...
Command: ...

are not commands — they’re just status output. When you copied them back into PowerShell, PowerShell tried to execute Service: / File / Command: as commands, which is why you got all those “term is not recognized” errors.

What I need next (this will show the real crash reason)

Run this exactly in PowerShell and paste the output:

#

Get-Content -Tail 200 "$env:LOCALAPPDATA\Temp\openclaw\openclaw-2026-02-16.log"

If you see a long random-looking token in the log, redact it before posting.

Bonus: avoid the confusing “probe” error for now

This will show service state without trying to RPC-probe:

openclaw gateway status --no-probe

One important note

You originally said “Windows with Docker Desktop” — but this status output is from a native Windows install (Scheduled Task + node.exe), not the Docker Compose flow.

That’s fine, but it changes what we troubleshoot. Which one are you trying to run right now?

#

Native Windows OpenClaw (Scheduled Task)
Docker Compose / WSL2 flow

Reply with 1 or 2, and paste the log tail.

thick mango Feb 16, 2026, 8:22 PM

#

lean ruin 1) Native Windows OpenClaw (Scheduled Task) 2) Docker Compose / WSL2 flow Rep...

docker compose, i want to make sure the AI has no access to any files on my computer and the reult of the powershell command returns too much to past back to you.

lean ruinBOT Feb 16, 2026, 8:25 PM

#

If you’re doing Docker Compose, don’t use openclaw gateway status / the Windows Scheduled Task output at all — that’s the native Windows service, not the container.

A) “AI has no access to my files” — what’s actually true in Docker

In Docker, the container can only see:

what’s inside the image, plus
whatever you mount into it (volumes/bind mounts)

In the default OpenClaw docker-compose.yml, it mounts only two things:

${OPENCLAW_CONFIG_DIR}:/home/node/.openclaw
${OPENCLAW_WORKSPACE_DIR}:/home/node/.openclaw/workspace

So it does not automatically get access to your whole C: drive unless you mount it.

If you want zero access to your Windows files (strong isolation)

Use named Docker volumes instead of Windows folder bind mounts:

#

Open the repo’s .env (created by docker-setup.sh)
Set these two lines to simple names (no paths):

OPENCLAW_CONFIG_DIR=openclaw_config
OPENCLAW_WORKSPACE_DIR=openclaw_workspace

Then restart:

docker compose up -d

Now OpenClaw’s state/workspace live in Docker-managed volumes, not in C:\Users\....

Also: do not set OPENCLAW_EXTRA_MOUNTS unless you explicitly want to share a folder.

#

B) Logs are too big — give me the “error-only” slice

From the openclaw repo folder (same place as docker-compose.yml), run ONE of these and paste the output:

Option 1 (usually perfect)

docker compose logs --tail 120 openclaw-gateway

Option 2 (filter to errors, PowerShell-friendly)

docker compose logs --tail 400 openclaw-gateway `
  | Select-String -Pattern "error|fatal|exception|EADDRINUSE|refus|blocked" -CaseSensitive:$false `
  | Select-Object -First 80

That should be small enough to paste.

#

C) One important cleanup question

Did you also install the native Windows gateway earlier (the Scheduled Task “OpenClaw Gateway”)?

If yes, it can cause confusion/port conflicts later, and you’ll want to remove it once Docker is working.
If no, ignore.

Paste the docker compose logs ... output and I’ll tell you exactly what’s failing in the container.

thick mango Feb 16, 2026, 8:27 PM

#

where do i find this the default OpenClaw docker-compose.yml, it mounts only two things:

${OPENCLAW_CONFIG_DIR}:/home/node/.openclaw
${OPENCLAW_WORKSPACE_DIR}:/home/node/.openclaw/workspace

So it does not automatically get access to your whole C: drive unless you mount it.

If you want zero access to your Windows files (strong isolation)
Use named Docker volumes instead of Windows folder bind mounts:

Open the repo’s .env (created by docker-setup.sh)
Set these two lines to simple names (no paths):

OPENCLAW_CONFIG_DIR=openclaw_config
OPENCLAW_WORKSPACE_DIR=openclaw_workspace

lean ruinBOT Feb 16, 2026, 8:28 PM

#

They’re both in the OpenClaw repo folder (the same directory you cloned and where you run docker compose ...).

If you cloned OpenClaw on Windows (PowerShell)

Go to the folder you cloned into, e.g.:

cd $env:USERPROFILE\openclaw
dir

You should see:

docker-compose.yml
(after running the setup) .env

Open them with:

#

notepad .env
notepad docker-compose.yml

If .env doesn’t exist yet, that just means it hasn’t been created by the setup script/run — you can create it yourself as a plain text file named .env in that same folder.

If you cloned inside WSL2 (Ubuntu)

In your Ubuntu terminal:

cd ~/openclaw
ls -la
nano .env
nano docker-compose.yml

#

If you can’t remember where you cloned it

PowerShell “search for it”:

Get-ChildItem -Path $env:USERPROFILE -Recurse -Filter docker-compose.yml -ErrorAction SilentlyContinue |
  Select-Object -First 5 FullName

Once you’ve found the repo root, edit .env there and set:

OPENCLAW_CONFIG_DIR=openclaw_config
OPENCLAW_WORKSPACE_DIR=openclaw_workspace

Then run docker compose up -d from that same folder.

thick mango Feb 16, 2026, 8:32 PM

#

you know what, obviously i have done some incorrect steps. can you explain how to get openclaw running on dockker desktop with strong isolation and running locally from scratch

lean ruinBOT Feb 16, 2026, 8:33 PM

#

Here’s the “clean, correct” way to run OpenClaw on Windows + Docker Desktop, locally only, with strong file isolation (no access to your C: drive).

The core idea: containers can only see what you mount. So we’ll use named Docker volumes (stored inside Docker’s VM), not Windows folder mounts.

Docs (Docker): https://docs.openclaw.ai/install/docker

0) Prereqs (Windows)

Install Docker Desktop
Install WSL2 + Ubuntu (recommended, makes the Docker setup painless)
In Docker Desktop:
- “Use the WSL 2 based engine” = ON
- WSL Integration for your Ubuntu distro = ON

#

1) Clone OpenClaw (inside WSL/Ubuntu)

Open Ubuntu (WSL) and run:

sudo apt update
sudo apt install -y git
git clone https://github.com/openclaw/openclaw.git
cd openclaw

2) Strong isolation: use named Docker volumes (NOT Windows folders)

In that same WSL terminal, set these env vars before running the setup:

#

export OPENCLAW_CONFIG_DIR=openclaw_config
export OPENCLAW_WORKSPACE_DIR=openclaw_workspace

These names (no slashes like / or C:\) make Docker treat them as named volumes, not host paths.

3) Run the Docker setup

Still in the repo root:

./docker-setup.sh

It will build the image, run onboarding, and start the gateway.

#

Afterwards open (on Windows):

http://127.0.0.1:18789/

4) Keep it “local-only” (not reachable from other devices)

Edit the repo’s docker-compose.yml and change ports to bind to localhost only:

ports:
  - "127.0.0.1:${OPENCLAW_GATEWAY_PORT:-18789}:18789"
  - "127.0.0.1:${OPENCLAW_BRIDGE_PORT:-18790}:18790"

Then restart the container (from the repo folder):

#

docker compose up -d

Now it’s only accessible from the same PC.

5) What NOT to do (to keep file isolation strong)

Don’t set OPENCLAW_EXTRA_MOUNTS
Don’t add any mounts like C:\Users\...:/...
Don’t mount your whole home folder “for convenience”

If you don’t mount it, the agent can’t see it.

#

Quick checks (optional)

From the repo folder:

docker compose ps
docker compose logs --tail 80 openclaw-gateway

One question (so I tailor the “later” plan)

When you eventually want “other devices”, do you mean:

Other devices on your home Wi‑Fi/LAN, or
Remote access from anywhere (phone on cellular, etc.)?

(We can keep it safe; the recommendation differs.)

thick mango Feb 16, 2026, 8:34 PM

#

why should i Clone OpenClaw (inside WSL/Ubuntu) if i am on windows 11

lean ruinBOT Feb 16, 2026, 8:34 PM

#

Because Docker Desktop on Windows is really running Linux containers under the hood (WSL2/VM), and OpenClaw’s Docker flow is written for a Linux-like shell.

Why WSL2 (Ubuntu) is recommended even on Windows 11

docker-setup.sh is a Bash script. In WSL it “just runs”. In pure PowerShell you’ll hit friction.
Fewer path / permission / line-ending issues. Windows paths + Docker mounts can get weird fast.
Strong isolation is easier to reason about. You’re much less likely to accidentally share C:\... with the container when you operate from a Linux environment and use named volumes.
It matches how the project is tested/documented. Windows is supported, but most “it doesn’t work” cases are from Windows-native quirks.

But you don’t have to use WSL

You have 3 workable options — pick one:

Recommended: Clone + run from WSL2 Ubuntu (most reliable).
Clone on Windows, then run the script from Git Bash (still okay, but more gotchas).
Skip the script and do the manual Docker commands (more steps, but works anywhere):
- docker build -t openclaw:local -f Dockerfile .
- docker compose run --rm openclaw-cli onboard
- docker compose up -d openclaw-gateway

#

(From https://docs.openclaw.ai/install/docker)

If your goal is “running locally with strong isolation”, option 1 is the one that tends to get you there with the least pain.

Which option do you want to do: 1, 2, or 3?

thick mango Feb 16, 2026, 8:35 PM

#

will Clone + run from WSL2 Ubuntu (most reliable). work in docker?

lean ruinBOT Feb 16, 2026, 8:36 PM

#

Yes — that’s the recommended combo on Windows:

WSL2 Ubuntu = where you run the commands (git clone, bash scripts, etc.)
Docker Desktop = actually runs the containers (via WSL2 engine)
Your Ubuntu terminal will talk to Docker Desktop through the Docker integration

So you get: Linux tooling + Windows Docker Desktop.

What you need to verify first (2 quick checks)

In Docker Desktop:
- Settings → General → Use the WSL 2 based engine = ON
- Settings → Resources → WSL Integration → enable your Ubuntu distro
In Ubuntu (WSL) run:

#

docker version
docker compose version

If those print versions, you’re good.

Then the “strong isolation + local only” path (recap)

In Ubuntu:

sudo apt update
sudo apt install -y git
git clone https://github.com/openclaw/openclaw.git
cd openclaw

#

# named volumes (no Windows file access)
export OPENCLAW_CONFIG_DIR=openclaw_config
export OPENCLAW_WORKSPACE_DIR=openclaw_workspace

./docker-setup.sh

After it starts, open on Windows:

http://127.0.0.1:18789/

If you want, paste the output of docker version and docker compose version if either errors and I’ll tell you what to toggle.

thick mango Feb 16, 2026, 8:44 PM

#

when trying to clone the github.com/openclaw.git into openclaw the remote: Not found and fatal: repository 'https://github.com/openclaw.git/' not found

lean ruinBOT Feb 16, 2026, 8:44 PM

#

That error is just the URL — you’re cloning the org root (openclaw.git), but the repo is openclaw/openclaw.

Use this instead (in WSL/Ubuntu):

git clone https://github.com/openclaw/openclaw.git
cd openclaw

(or without .git is fine too:)

git clone https://github.com/openclaw/openclaw

If you want to sanity-check the URL before cloning:

#

git ls-remote https://github.com/openclaw/openclaw.git

Once it’s cloned, you should see docker-setup.sh and docker-compose.yml in that folder.

thick mango Feb 16, 2026, 8:58 PM

#

ok i think i am doing the right thing now lol.

'Building 571.0s (19/20) docker:default
=> [auth] library/node:pull token for registry-1.docker.io 0.0s
=> [internal] load .dockerignore 0.1s
=> => transferring context: 891B 0.0s
=> [ 1/14] FROM docker.io/library/node:22-bookworm@sha256:379c51ac7bbf9bffe16769cfda3eb027d59d9c66ac314383da3fcf 0.1s
=> => resolve docker.io/library/node:22-bookworm@sha256:379c51ac7bbf9bffe16769cfda3eb027d59d9c66ac314383da3fcf71 0.0s
=> [internal] load build context 1.3s
=> => transferring context: 38.94MB 1.2s
=> CACHED [ 2/14] RUN curl -fsSL https://bun.sh/install | bash 0.0s
=> CACHED [ 3/14] RUN corepack enable 0.0s
=> CACHED [ 4/14] WORKDIR /app 0.0s
=> CACHED [ 5/14] RUN if [ -n "" ]; then apt-get update && DEBIAN_FRONTEND=noninteractive apt-get in 0.0s
=> [ 6/14] COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./ 0.4s
=> [ 7/14] COPY ui/package.json ./ui/package.json 0.1s
=> [ 8/14] COPY patches ./patches 0.1s
=> [ 9/14] COPY scripts ./scripts 0.2s
=> [10/14] RUN pnpm install --frozen-lockfile 32.2s
=> [11/14] COPY . . 2.1s
=> [12/14] RUN pnpm build 25.0s
=> [13/14] RUN pnpm ui:build 2.8s
=> [14/14] RUN chown -R node:node /app 364.3s
=> exporting to image 141.7s
=> => exporting layers 59.7s
=> => exporting manifest sha256:a8ce2eb9047cfe181b7acec77e22b493e04dd47c344c2c15178bd3154a7b6df2 0.0s
=> => exporting config sha256:11480fe3d5ab2d40edeffdb9c4e4ff58b06c0e76f98403d8cdf536ebcf2ffd3d 0.0s
=> => exporting attestation manifest sha256:b67ecb57f31306c2c61a04c8582d5ef03e372603e82130dcb37553dc948ded4b 0.1s
=> => exporting manifest list sha256:b5a9e86a5e1732bfa5cdf13a9e48b4961c6faa616b46b9543b6622bbe09d7307 0.0s
=> => naming to docker.io/library/openclaw:local 0.0s
=> => unpacking to docker.io/library/openclaw:local'

and it looks like copying that cancled the install?

"ERROR: failed to build: failed to solve: Canceled: context canceled"

lean ruinBOT Feb 16, 2026, 8:59 PM

#

That build output looks normal up until the very end — the key line is:

ERROR: failed to build: failed to solve: Canceled: context canceled

That almost always means the build got interrupted (you hit Ctrl+C, the terminal closed, WSL/Docker restarted, laptop slept, Docker Desktop restarted, etc.). Copy/paste itself doesn’t cancel it, but clicking in some terminals or accidentally sending an interrupt can.

Good news: most layers are now cached, so the next run is usually much faster.

1) Re-run the setup (safe to retry)

From the repo root in WSL:

export OPENCLAW_CONFIG_DIR=openclaw_config
export OPENCLAW_WORKSPACE_DIR=openclaw_workspace
./docker-setup.sh

#

If it cancels again, run the build step alone so we can isolate it:

docker build -t openclaw:local -f Dockerfile .

2) Quick checks if it keeps canceling

Run these and paste just the output (they’re short):

docker compose version
docker info | head -n 25

Common causes:

Docker Desktop restarted mid-build
WSL distro got shut down (wsl --shutdown) or PC slept

#

Not enough disk space (Docker sometimes bails weirdly)

3) Strong isolation reminder (you’re still on track)

Before/when it succeeds, make sure you’re not mounting Windows folders:

keep OPENCLAW_CONFIG_DIR=openclaw_config
keep OPENCLAW_WORKSPACE_DIR=openclaw_workspace
don’t set OPENCLAW_EXTRA_MOUNTS

Reply with: did you press Ctrl+C / did Docker Desktop restart / did your machine sleep? If not, paste docker info | head -n 25 and we’ll pinpoint why it’s being canceled.

thick mango Feb 16, 2026, 9:17 PM

#

ok i think it worked, it says onboarding (interactive)
when prompted:
gateway bind: lan
gateway auth: token
gateway token: **************
tailscaleexposure:off
install gateway daemon:no
and a bunch of variable is not set defaulting to a blanak string
then
service "openclaw-gateway" refers to undefined volume openclaw conffig invalid compose project

lean ruinBOT Feb 16, 2026, 9:18 PM

#

That error is because you set OPENCLAW_CONFIG_DIR=openclaw_config (a named volume), but docker-compose.yml doesn’t declare that volume at the bottom — so Compose says “undefined volume”.

Those “variable is not set, defaulting to blank” warnings are fine (usually optional provider env vars like Claude session keys).

Fix (keeps strong isolation: no Windows file mounts)

1) Make sure your repo `.env` has exactly:

(in the openclaw repo folder)

OPENCLAW_CONFIG_DIR=openclaw_config
OPENCLAW_WORKSPACE_DIR=openclaw_workspace

2) Edit `docker-compose.yml` and add this at the very bottom:

#

volumes:
  openclaw_config:
  openclaw_workspace:

That’s the missing piece.

3) Bring it up again (from the repo folder, in WSL)

docker compose up -d openclaw-gateway

If you still need to re-run onboarding:

docker compose run --rm openclaw-cli onboard --no-install-daemon

#

Extra: keep it local-only on your PC

Even with gateway bind: lan, you can still keep it not reachable from your LAN by binding the published ports to localhost:

ports:
  - "127.0.0.1:${OPENCLAW_GATEWAY_PORT:-18789}:18789"
  - "127.0.0.1:${OPENCLAW_BRIDGE_PORT:-18790}:18790"

Sanity check (optional)

docker compose ps

If you paste your current docker-compose.yml volumes: section (just that part), I can tell you exactly where to insert the volumes: block.

thick mango Feb 16, 2026, 9:25 PM

#

can you explain more throughly how to find my repo and .env and docker-compose.yml and how to do all that

lean ruinBOT Feb 16, 2026, 9:26 PM

#

Yep — let’s do this super step-by-step, from “where even is my repo” to “edit the right files” to “restart Docker”.

I’ll assume you’re using WSL2 Ubuntu + Docker Desktop (recommended).

1) Find your OpenClaw repo folder (in WSL/Ubuntu)

Open Ubuntu (WSL) and run:

cd ~
ls

You’re looking for a folder named openclaw.

#

If you see `openclaw`

Go into it:

cd ~/openclaw
pwd
ls -la

You should see files like:

docker-setup.sh
docker-compose.yml
Dockerfile

If you DON’T see `openclaw`

Search for it:

#

find ~ -maxdepth 3 -type d -name openclaw 2>/dev/null

If it prints something like /home/<you>/openclaw, then:

cd /home/<you>/openclaw

2) Find (or create) the `.env` file

From inside the repo root (~/openclaw), run:

#

ls -la .env docker-compose.yml

If .env exists: great.
If it says .env is missing: that’s okay — you can create it.

Create/edit it with:

nano .env

(controls: Ctrl+O to save, Enter, then Ctrl+X to exit)

Add these lines (IMPORTANT: no spaces):

#

OPENCLAW_CONFIG_DIR=openclaw_config
OPENCLAW_WORKSPACE_DIR=openclaw_workspace

Verify there are no accidental spaces/typos

Run:

grep -n "OPENCLAW_CONFIG_DIR\|OPENCLAW_WORKSPACE_DIR" .env

It should show exactly those two lines. If you had something like openclaw conffig (with a space), Docker Compose will treat that as an invalid/undefined volume name and blow up.

3) Edit `docker-compose.yml` to declare the named volumes

#

Open the compose file:

nano docker-compose.yml

Scroll to the very bottom of the file and add:

volumes:
  openclaw_config:
  openclaw_workspace:

Save + exit.

This fixes the error you saw:

#

service "openclaw-gateway" refers to undefined volume ... invalid compose project

4) (Optional but recommended) Keep it LOCAL-only on your PC

In docker-compose.yml, change the ports: entries to bind to localhost:

ports:
  - "127.0.0.1:${OPENCLAW_GATEWAY_PORT:-18789}:18789"
  - "127.0.0.1:${OPENCLAW_BRIDGE_PORT:-18790}:18790"

This prevents other devices on your LAN from hitting the gateway.

#

5) Restart the stack

From the repo root:

docker compose down
docker compose up -d openclaw-gateway

Check it’s running:

docker compose ps

6) “Strong isolation” (what this achieves)

#

With the named-volume setup above:

OpenClaw does not get access to your Windows files (like C:\Users\...) because nothing from Windows is mounted.
Its config + workspace live inside Docker-managed volumes (openclaw_config, openclaw_workspace).

If you want, run this to confirm what’s mounted:

docker inspect $(docker compose ps -q openclaw-gateway) --format '{{json .Mounts}}' | head -c 2000

If you paste the output of just these two commands (they’re short), I can confirm you’re in the right folder and the .env values are clean:

pwd

#

ls -la docker-compose.yml .env

thick mango Feb 16, 2026, 10:12 PM

#

can you give me an example of how it is supposed to look? i am afraid i am putting it in the wrong spot, there is already a volumes:openclawconfix&openclawworkspace

lean ruinBOT Feb 16, 2026, 10:13 PM

#

Yep — this is a YAML “spacing + names must match” situation.

What it should look like (example)

docker-compose.yml should have (somewhere under each service):

services:
  openclaw-gateway:
    volumes:
      - ${OPENCLAW_CONFIG_DIR}:/home/node/.openclaw
      - ${OPENCLAW_WORKSPACE_DIR}:/home/node/.openclaw/workspace

…and then at the very bottom of the file (top-level, same indentation as services:), you should have:

#

volumes:
  openclaw_config:
  openclaw_workspace:

That’s it. Two important details:

volumes: must be on its own line
the volume names must be exactly the same strings you’re using in .env

If you already have a `volumes:` section

That’s fine — you don’t add another one. You just make sure it contains the right names.

Common “wrong” version I’ve seen (this breaks Compose)

Something like:

#

volumes:openclawconfix&openclawworkspace

That is not valid YAML for docker-compose. It must be multiline like the example above.

Name mismatch check (most likely your issue)

You wrote: “there is already a volumes: openclawconfix & openclawworkspace”

If your file currently has:

volumes:
  openclawconfix:

#

  openclawworkspace:

…then either:

Option A (recommended): rename them to match the `.env` values

Make it:

volumes:
  openclaw_config:
  openclaw_workspace:

…and in .env set:

#

OPENCLAW_CONFIG_DIR=openclaw_config
OPENCLAW_WORKSPACE_DIR=openclaw_workspace

Option B: keep your existing names, but match `.env` to them

If you want to keep:

volumes:
  openclawconfix:
  openclawworkspace:

Then .env must be:

#

OPENCLAW_CONFIG_DIR=openclawconfix
OPENCLAW_WORKSPACE_DIR=openclawworkspace

If you paste just the bottom ~20 lines of your docker-compose.yml (starting a bit above volumes:), I can tell you exactly what to change.

thick mango Feb 16, 2026, 10:40 PM

#

like this?
\services:
openclaw-gateway:
image: ${OPENCLAW_IMAGE:-openclaw:local}
environment:
HOME: /home/node
TERM: xterm-256color
OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
CLAUDE_AI_SESSION_KEY: ${CLAUDE_AI_SESSION_KEY}
CLAUDE_WEB_SESSION_KEY: ${CLAUDE_WEB_SESSION_KEY}
CLAUDE_WEB_COOKIE: ${CLAUDE_WEB_COOKIE}
volumes:
- ${OPENCLAW_CONFIG_DIR}:/home/node/.openclaw
- ${OPENCLAW_WORKSPACE_DIR}:/home/node/.openclaw/workspace
openclaw_config:
openclaw_workspace:

ports:
  - "${OPENCLAW_GATEWAY_PORT:-18789}:18789"
  - "${OPENCLAW_BRIDGE_PORT:-18790}:18790"
init: true
restart: unless-stopped
command:
  [
    "node",
    "dist/index.js",
    "gateway",

lean ruinBOT Feb 16, 2026, 10:42 PM

#

Not quite — you put openclaw_config: / openclaw_workspace: in the middle of the openclaw-gateway service, which breaks the YAML structure.

Those volume definitions must be a top-level block called volumes: (same indentation level as services:), usually at the very bottom of docker-compose.yml.

What the `openclaw-gateway` part should look like

(Notice ports: stays inside the service, right after volumes:)

services:
  openclaw-gateway:
    image: ${OPENCLAW_IMAGE:-openclaw:local}
    environment:
      HOME: /home/node
      TERM: xterm-256color
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
    volumes:

#

      - ${OPENCLAW_CONFIG_DIR}:/home/node/.openclaw
      - ${OPENCLAW_WORKSPACE_DIR}:/home/node/.openclaw/workspace
    ports:
      - "${OPENCLAW_GATEWAY_PORT:-18789}:18789"
      - "${OPENCLAW_BRIDGE_PORT:-18790}:18790"

What the bottom of the file should look like

(Add this at the very end of docker-compose.yml)

volumes:
  openclaw_config:
  openclaw_workspace:

#

And your `.env` should match those names exactly

OPENCLAW_CONFIG_DIR=openclaw_config
OPENCLAW_WORKSPACE_DIR=openclaw_workspace

Fix steps

Remove the stray lines you inserted here (these do not belong there):

openclaw_config:
openclaw_workspace:

Add the proper top-level volumes: block at the bottom (shown above).
Validate the YAML (this is a great sanity check):

#

docker compose config

If that command prints a full resolved config without errors, your compose file is structurally OK.

If you paste the last ~30 lines of your docker-compose.yml (from the end upward), I can tell you if the volumes: block is in the right place.

thick mango Feb 16, 2026, 11:09 PM

#

how do i save the file? it says ^S but when i do that is say ^S is un bound

lean ruinBOT Feb 16, 2026, 11:09 PM

#

That depends on which editor you’re in.

If you’re in nano

At the bottom it will say something like ^O Write Out.

To save:

Ctrl + O (that’s the letter O, not zero)
Press Enter to confirm the filename
Ctrl + X to exit

If you’re in vim / neovim

Press Esc
Type: :wq
Press Enter

Quick check

What do you see at the bottom/status line of the editor? Reply with either:

#

“I see ^O Write Out” (nano)
“I see -- INSERT -- or it looks like vim”

thick mango Feb 16, 2026, 11:19 PM

#

"thor@DESKTOP-2HNAR5T:~/openclaw$ docker-compose.yml
docker-compose.yml: command not found
thor@DESKTOP-2HNAR5T:~/openclaw$ nano docker-compose.yml
thor@DESKTOP-2HNAR5T:~/openclaw$ docker compose down
WARN[0000] The "CLAUDE_AI_SESSION_KEY" variable is not set. Defaulting to a blank string.
WARN[0000] The "CLAUDE_WEB_SESSION_KEY" variable is not set. Defaulting to a blank string.
WARN[0000] The "CLAUDE_WEB_COOKIE" variable is not set. Defaulting to a blank string.
WARN[0000] The "CLAUDE_AI_SESSION_KEY" variable is not set. Defaulting to a blank string.
WARN[0000] The "CLAUDE_WEB_SESSION_KEY" variable is not set. Defaulting to a blank string.
WARN[0000] The "CLAUDE_WEB_COOKIE" variable is not set. Defaulting to a blank string.
validating /home/thor/openclaw/docker-compose.yml: additional properties 'openclaw_workspace' not allowed
thor@DESKTOP-2HNAR5T:~/openclaw$" when i try to do docker compose down

lean ruinBOT Feb 16, 2026, 11:20 PM

#

That’s progress — the warnings about CLAUDE_* being unset are fine (you can ignore them if you’re not using those auth methods).

The real problem is this line:

additional properties 'openclaw_workspace' not allowed

That means your docker-compose.yml is invalid YAML/Compose structure — almost certainly because openclaw_workspace: is sitting at the top-level without being under a volumes: block (or it’s indented wrong).

1) First: saving in nano

When you’re editing docker-compose.yml in nano:

Ctrl + O (write out / save)
press Enter (confirm filename)
Ctrl + X (exit)

(^S being “unbound” is normal in many terminals — ignore it.)

#

2) Fix the compose file structure

In ~/openclaw/docker-compose.yml, the bottom of the file should look like this:

services:
  openclaw-gateway:
    # ...
  openclaw-cli:
    # ...

volumes:
  openclaw_config:
  openclaw_workspace:

Important:

volumes: must be all the way left (no spaces in front)

#

openclaw_config: and openclaw_workspace: must be indented two spaces

What you currently have is effectively like:

services:
  ...
openclaw_workspace:

…and Compose rejects that.

3) Quick way to see what’s wrong (pasteable)

Run this in WSL and paste the output:

#

tail -n 40 docker-compose.yml

(That’s usually enough to spot the indentation issue immediately.)

4) Validate + try again

After fixing/saving:

docker compose config   # validates YAML/compose structure
docker compose down
docker compose up -d openclaw-gateway

If docker compose config still errors, paste its error + the tail -n 40 output and I’ll tell you exactly what line to change.

thick mango Feb 16, 2026, 11:23 PM

#

services:
openclaw-gateway:
image: ${OPENCLAW_IMAGE:-openclaw:local}
environment:
HOME: /home/node
TERM: xterm-256color
OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
CLAUDE_AI_SESSION_KEY: ${CLAUDE_AI_SESSION_KEY}
CLAUDE_WEB_SESSION_KEY: ${CLAUDE_WEB_SESSION_KEY}
CLAUDE_WEB_COOKIE: ${CLAUDE_WEB_COOKIE}
volumes:
- ${OPENCLAW_CONFIG_DIR}:/home/node/.openclaw
- ${OPENCLAW_WORKSPACE_DIR}:/home/node/.openclaw/workspace
ports:
- "127.0.0.1:${OPENCLAW_GATEWAY_PORT:-18789}:18789"
- "127.0.0.1:${OPENCLAW_BRIDGE_PORT:-18790}:18790"
init: true
restart: unless-stopped
command:
[
"node",
"dist/index.js",
"gateway",
"--bind",
"${OPENCLAW_GATEWAY_BIND:-lan}",
"--port",
"18789",
]

openclaw-cli:
image: ${OPENCLAW_IMAGE:-openclaw:local}
environment:
HOME: /home/node
TERM: xterm-256color
OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
BROWSER: echo
CLAUDE_AI_SESSION_KEY: ${CLAUDE_AI_SESSION_KEY}
CLAUDE_WEB_SESSION_KEY: ${CLAUDE_WEB_SESSION_KEY}
CLAUDE_WEB_COOKIE: ${CLAUDE_WEB_COOKIE}
volumes:
- ${OPENCLAW_CONFIG_DIR}:/home/node/.openclaw
- ${OPENCLAW_WORKSPACE_DIR}:/home/node/.openclaw/workspace
stdin_open: true
tty: true
init: true
entrypoint: ["node", "dist/index.js"]
volumes:
openclaw_config:
openclaw_workspace:

thjis is my docker-compose.yml, how do i fix it?

lean ruinBOT Feb 16, 2026, 11:24 PM

#

Your file is almost correct — the only problem is the indentation in the volumes: section at the bottom.

Right now you have:

volumes:
 openclaw_config:
openclaw_workspace:

Because openclaw_workspace: is not indented, Docker Compose treats it as a random top-level key and throws:

additional properties 'openclaw_workspace' not allowed

Fix (edit the bottom of `docker-compose.yml`)

Open it:

#

nano docker-compose.yml

Go to the very bottom and change your volumes block to exactly this (note the two spaces):

volumes:
  openclaw_config:
  openclaw_workspace:

Then save + exit nano:

Ctrl + O (save)
Enter (confirm)
Ctrl + X (exit)

#

Validate it (fast sanity check)

Run:

docker compose config

If that prints a big resolved config (no error), you’re good.

Then restart

docker compose down
docker compose up -d openclaw-gateway

One more check: your `.env` must match the names

In ~/openclaw/.env make sure these two lines exist:

#

OPENCLAW_CONFIG_DIR=openclaw_config
OPENCLAW_WORKSPACE_DIR=openclaw_workspace

If you want, paste the output of:

tail -n 5 docker-compose.yml

after you edit, and I’ll confirm it’s perfect.

thick mango Feb 16, 2026, 11:25 PM

#

thor@DESKTOP-2HNAR5T:~/openclaw$ docker compose down
WARN[0000] The "CLAUDE_AI_SESSION_KEY" variable is not set. Defaulting to a blank string.
WARN[0000] The "CLAUDE_WEB_SESSION_KEY" variable is not set. Defaulting to a blank string.
WARN[0000] The "CLAUDE_WEB_COOKIE" variable is not set. Defaulting to a blank string.
WARN[0000] The "CLAUDE_WEB_SESSION_KEY" variable is not set. Defaulting to a blank string.
WARN[0000] The "CLAUDE_WEB_COOKIE" variable is not set. Defaulting to a blank string.
WARN[0000] The "CLAUDE_AI_SESSION_KEY" variable is not set. Defaulting to a blank string.
services must be a mapping
thor@DESKTOP-2HNAR5T:~/openclaw$

#

thor@DESKTOP-2HNAR5T:~/openclaw$ tail -n 5 docker-compose.yml
init: true
entrypoint: ["node", "dist/index.js"]
volumes:
openclaw_config:
openclaw_workspace:
thor@DESKTOP-2HNAR5T:~/openclaw$

lean ruinBOT Feb 16, 2026, 11:27 PM

#

services must be a mapping means Docker Compose can’t parse your docker-compose.yml anymore (it’s malformed YAML). This usually happens from one stray character (like a leading \), or indentation getting messed up.

Step 1: Check the very first line for weird characters

In WSL, run:

cd ~/openclaw
head -n 5 docker-compose.yml | cat -A

You want the first line to be exactly:

services:

(no leading spaces, no \services:)

#

Easiest fix (recommended): restore the original file, then re-apply the 2 safe edits

Because you already edited the file a few times, the cleanest is:

Step 2: Reset `docker-compose.yml` back to how the repo shipped it

cd ~/openclaw
git restore docker-compose.yml
# (older git: git checkout -- docker-compose.yml)

Step 3: Re-apply ONLY these two edits

Edit A) Make ports local-only (127.0.0.1)

#

nano docker-compose.yml

Find the ports: section under openclaw-gateway and make it:

ports:
  - "127.0.0.1:${OPENCLAW_GATEWAY_PORT:-18789}:18789"
  - "127.0.0.1:${OPENCLAW_BRIDGE_PORT:-18790}:18790"

Save in nano: Ctrl+O, Enter, Ctrl+X

Edit B) Add named volumes (for strong isolation) at the VERY bottom

At the bottom of the file, add:

#

volumes:
  openclaw_config:
  openclaw_workspace:

(Important: volumes: must start at the far left, and the two names are indented by two spaces.)

Save again.

Step 4: Make sure your `.env` matches the volume names

Edit .env in the repo root:

#

nano .env

Make sure it contains:

OPENCLAW_CONFIG_DIR=openclaw_config
OPENCLAW_WORKSPACE_DIR=openclaw_workspace

Save: Ctrl+O, Enter, Ctrl+X

Step 5: Validate + start

Validate YAML first:

#

docker compose config

If that prints a big config (no errors), then:

docker compose down
docker compose up -d openclaw-gateway

If `git restore docker-compose.yml` fails

Paste the output of:

#

ls -la

and I’ll tell you how to reset it manually.

Also: those CLAUDE_* variable is not set warnings are fine to ignore.

#

That bottom part looks perfect now:

volumes:
  openclaw_config:
  openclaw_workspace:

So the “services must be a mapping” error is almost certainly caused by something near the top of the file (most commonly an accidental \services: or bad indentation on the first line).

1) Check the first ~10 lines exactly (including hidden characters)

Run:

head -n 12 docker-compose.yml | cat -A

#

You want it to start like this (no leading spaces, no backslashes):

services:$
  openclaw-gateway:$

If you see anything like \services: or weird characters before services:, that’s the bug.

2) Fastest clean fix: restore the file, then re-add your two edits

Since you’ve already confirmed the volumes: block is correct, I’d just reset the compose file and reapply edits cleanly:

git restore docker-compose.yml

Then re-do only:

#

the ports: change to 127.0.0.1:...
the bottom volumes: block

After that, validate:

docker compose config

3) If you don’t want to restore, paste the top

If you’d rather not reset, paste the output of:

head -n 25 docker-compose.yml

and I’ll point at the exact line/indent that’s breaking the YAML.

thick mango Feb 16, 2026, 11:33 PM

#

thor@DESKTOP-2HNAR5T:~/openclaw$ head -n 5 docker-compose.yml
services:
openclaw-gateway:
image: ${OPENCLAW_IMAGE:-openclaw:local}
environment:
HOME: /home/node
thor@DESKTOP-2HNAR5T:~/openclaw$

#

services:
openclaw-gateway:
image: ${OPENCLAW_IMAGE:-openclaw:local}
environment:
HOME: /home/node
TERM: xterm-256color
OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
CLAUDE_AI_SESSION_KEY: ${CLAUDE_AI_SESSION_KEY}
CLAUDE_WEB_SESSION_KEY: ${CLAUDE_WEB_SESSION_KEY}
CLAUDE_WEB_COOKIE: ${CLAUDE_WEB_COOKIE}
volumes:
- ${OPENCLAW_CONFIG_DIR}:/home/node/.openclaw
- ${OPENCLAW_WORKSPACE_DIR}:/home/node/.openclaw/workspace
ports:
- "127.0.0.1:${OPENCLAW_GATEWAY_PORT:-18789}:18789"
- "127.0.0.1${OPENCLAW_BRIDGE_PORT:-18790}:18790"
init: true
restart: unless-stopped
command:
[
"node",
"dist/index.js",
"gateway",
"--bind",
"${OPENCLAW_GATEWAY_BIND:-lan}",
"--port",
"18789",
]

openclaw-cli:
image: ${OPENCLAW_IMAGE:-openclaw:local}
environment:
HOME: /home/node
TERM: xterm-256color
OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
BROWSER: echo
CLAUDE_AI_SESSION_KEY: ${CLAUDE_AI_SESSION_KEY}
CLAUDE_WEB_SESSION_KEY: ${CLAUDE_WEB_SESSION_KEY}
CLAUDE_WEB_COOKIE: ${CLAUDE_WEB_COOKIE}
volumes:
- ${OPENCLAW_CONFIG_DIR}:/home/node/.openclaw
- ${OPENCLAW_WORKSPACE_DIR}:/home/node/.openclaw/workspace
stdin_open: true
tty: true
init: true
entrypoint: ["node", "dist/index.js"]
volumes:
openclaw_config:
openclaw_workspace:

#

what is wrong because i did it how you explained and i keep getting errors

lean ruinBOT Feb 16, 2026, 11:36 PM

#

Top of the file looks good, and your volumes: block at the bottom looked good too — so the remaining cause of:

services must be a mapping

is usually: you have another top‑level key somewhere that’s not indented right (or a duplicated services: later in the file).

Let’s quickly find what Docker Compose thinks the top-level keys are.

Run these in ~/openclaw and paste the output:

cd ~/openclaw

# shows every line that starts at column 1 (top-level YAML keys)
grep -n '^[^[:space:]]' docker-compose.yml

#

# check if services: appears more than once
grep -n '^services:' docker-compose.yml

# ask docker to validate and show a more specific error
docker compose -f docker-compose.yml config

What we want for the first command is basically just:

services:
volumes:

If you see anything else at the far left (like openclaw_workspace: or openclaw_config: or ports: with no indentation), that’s the line to delete/indent.

(And yep: the CLAUDE_* variable is not set warnings are harmless.)

#

Yep — that’s almost perfect. There’s one typo that will break the port mapping:

You currently have:

- "127.0.0.1${OPENCLAW_BRIDGE_PORT:-18790}:18790"

It’s missing a colon after 127.0.0.1. Fix it to:

- "127.0.0.1:${OPENCLAW_BRIDGE_PORT:-18790}:18790"

So your ports: block should be:

#

ports:
  - "127.0.0.1:${OPENCLAW_GATEWAY_PORT:-18789}:18789"
  - "127.0.0.1:${OPENCLAW_BRIDGE_PORT:-18790}:18790"

Then validate + run

From ~/openclaw:

docker compose config
docker compose down
docker compose up -d openclaw-gateway

If docker compose config still errors, paste just the error line it prints (no need to paste the whole file again).

#

Something specific is wrong, but I can’t tell which error you’re seeing right now because “errors” could be YAML parse, port syntax, missing .env, or a port conflict.

Let’s make this deterministic.

1) First: run the validator (it prints the exact line it hates)

From inside the repo folder (~/openclaw):

cd ~/openclaw
docker compose config

Copy/paste only the error output (usually just a few lines).

2) Quick sanity checks (most common causes)

A) You’re running compose from the wrong folder (so `.env` isn’t loaded)

#

Run:

pwd
ls -la .env docker-compose.yml

If .env isn’t in the same folder, Compose won’t pick up OPENCLAW_CONFIG_DIR / OPENCLAW_WORKSPACE_DIR.

B) Your port line has a tiny typo (I saw this once in your paste)

Make sure the second port line is exactly:

- "127.0.0.1:${OPENCLAW_BRIDGE_PORT:-18790}:18790"

(there must be a : after 127.0.0.1)

#

C) `.env` must match your named volumes exactly

In ~/openclaw/.env you want:

OPENCLAW_CONFIG_DIR=openclaw_config
OPENCLAW_WORKSPACE_DIR=openclaw_workspace

3) If you want the fastest “back to known-good” reset

This undoes any accidental YAML damage, then you re-apply only the two small edits:

cd ~/openclaw
git restore docker-compose.yml

Then re-add:

#

ports bound to 127.0.0.1:...
the bottom volumes: block

Post the output of docker compose config and I’ll tell you exactly what to change (line-by-line).

thick mango Feb 16, 2026, 11:41 PM

#

i think that fixed it, shows 4 created and checkmarks up 4/4 what do i do next?

lean ruinBOT Feb 16, 2026, 11:41 PM

#

Nice — if docker compose up -d shows 4/4 with checkmarks, the containers are up.

Next steps

1) Verify it’s running

From ~/openclaw:

docker compose ps

You want openclaw-gateway to say something like Up.

2) Open the Control UI (on your Windows browser)

Go to:

http://127.0.0.1:18789/

#

(You bound it to 127.0.0.1, so it will only work on this PC — that’s what you want for “local-only”.)

3) Connect/authenticate

In the UI, if it says “unauthorized” / “needs token”:

paste the gateway token that docker-setup.sh printed earlier (it’s also stored in the repo .env as OPENCLAW_GATEWAY_TOKEN=...).

In WSL you can print it like this:

cd ~/openclaw
grep OPENCLAW_GATEWAY_TOKEN .env

(Do not paste the token publicly anywhere else.)

4) Confirm the gateway logs look healthy (optional but useful)

#

docker compose logs --tail 80 openclaw-gateway

If you tell me what you want to do first (Discord? Telegram? just chat in the UI?), I can point you at the safest next step. Also: glad that helped — if this fixed it, please mark the solution in Discord (right‑click the solution message → Apps → ✅ Mark Solution) so Answer Overflow indexes it.

thick mango Feb 16, 2026, 11:43 PM

#

when doing docker compose ps i get "thor@DESKTOP-2HNAR5T:~/openclaw$ docker compose ps
WARN[0000] The "CLAUDE_WEB_COOKIE" variable is not set. Defaulting to a blank string.
WARN[0000] The "CLAUDE_AI_SESSION_KEY" variable is not set. Defaulting to a blank string.
WARN[0000] The "CLAUDE_WEB_SESSION_KEY" variable is not set. Defaulting to a blank string.
WARN[0000] The "CLAUDE_WEB_SESSION_KEY" variable is not set. Defaulting to a blank string.
WARN[0000] The "CLAUDE_WEB_COOKIE" variable is not set. Defaulting to a blank string.
WARN[0000] The "CLAUDE_AI_SESSION_KEY" variable is not set. Defaulting to a blank string.
NAME IMAGE COMMAND SERVICE CREATED STATUS PORTS
openclaw-openclaw-gateway-1 openclaw:local "docker-entrypoint.s…" openclaw-gateway 2 minutes ago Restarting (1) 34 seconds ago
thor@DESKTOP-2HNAR5T:~/openclaw$"

but i dont see any 'up' and when trying to access the ip address through opera browser it says the site cannot be reached

lean ruinBOT Feb 16, 2026, 11:44 PM

#

Those CLAUDE_* variable is not set warnings are harmless (you can ignore them). The real issue is:

openclaw-openclaw-gateway-1 is Restarting (1) → the gateway process is crashing on startup, so the browser can’t connect.

Two very common causes here are (a) missing/blank gateway token env var, or (b) a real crash shown in logs.

1) First: check your `.env` actually has a token (not blank)

From ~/openclaw in WSL:

cd ~/openclaw
grep -n "OPENCLAW_GATEWAY_TOKEN\|OPENCLAW_GATEWAY_BIND" .env

You should see something like:

OPENCLAW_GATEWAY_TOKEN=... (a long hex string, not empty)

#

OPENCLAW_GATEWAY_BIND=lan (or whatever)

If OPENCLAW_GATEWAY_TOKEN is missing or empty, the gateway will refuse to start when bind is lan.

2) Get the crash reason (last ~120 lines)

docker compose logs --tail 120 openclaw-gateway

Paste that output here (it should be short).

3) Small note about the URL

Because you bound ports to 127.0.0.1:..., you must open:

http://127.0.0.1:18789/

Not your machine’s LAN IP. (But even 127.0.0.1 won’t work until the container stops restarting.)

#

If you paste the output of (1) and (2), I can tell you exactly what to change.

thick mango Feb 17, 2026, 5:36 PM

#

ok i am back, my computer shut down between our last message. how can i pick up where we left off?

thick mango Feb 17, 2026, 6:00 PM

#

im trying to copy and paste from the ubuntu terminal but it wont let me, says up/2/ when i run compose up -d openclawgateway but i still get nothing when accessing the IP in a browser

lean ruinBOT Feb 17, 2026, 6:03 PM

#

For Ubuntu terminal copy/paste:

Paste: Ctrl + Shift + V (regular Ctrl+V usually won’t work in terminals)
Copy: Ctrl + Shift + C
Also works: highlight text (copies), then middle‑click (pastes) on Linux.
If you’re in a web-based console (Hetzner/Oracle/etc), it may have its own copy/paste buttons—Ctrl+Shift+V still often works though.

About the Docker output: Running 2/2 (what you’re seeing as “up/2/”) is good — it means both containers started.

The “I get nothing in the browser” part is usually one of these:

1) Wrong URL (missing the port)

The Gateway UI is on port 18789, so use one of:

On the same machine: http://127.0.0.1:18789/
From another machine: http://<SERVER_IP>:18789/ (note the :18789)

If you browse to just the IP (no port), your browser tries port 80 and you’ll get “nothing”.

#

2) Confirm the container is actually publishing the port

Run (from the folder with docker-compose.yml):

docker compose ps

You should see something like 0.0.0.0:18789->18789/tcp for openclaw-gateway.

3) Grab the dashboard link + token (common “unauthorized” / “pairing required” issue)

docker compose run --rm openclaw-cli dashboard --no-open

If it says pairing required:

docker compose run --rm openclaw-cli devices list
docker compose run --rm openclaw-cli devices approve <requestId>

#

4) If still dead: paste logs

docker compose logs --tail=200 openclaw-gateway

If you tell me:

the exact URL you’re opening, and
the output of docker compose ps
…I can pinpoint whether it’s just the port, auth/pairing, or port exposure/firewall.

Docs reference (Docker flow): https://docs.openclaw.ai/install/docker

thick mango Feb 17, 2026, 6:08 PM

#

how do i find and navigate to the directory with docker-compose.yml and back?

lean ruinBOT Feb 17, 2026, 6:14 PM

#

Use these basics:

Where am I?

pwd
ls

Navigate

Go into a folder:
```
cd someFolder
```
Go up one level:
```
cd ..
```

#

Go to your home folder:
```
cd ~
```
Go back to the previous directory:
```
cd -
```

Find the folder that contains `docker-compose.yml`

If you don’t remember where it is, search your home directory:

find ~ -name docker-compose.yml 2>/dev/null

If it prints something like:
/home/you/openclaw/docker-compose.yml

#

…then jump to that directory with:

cd /home/you/openclaw

Or, copy the full path and do this (auto “cd to the file’s folder”):

cd "$(dirname "$(find ~ -name docker-compose.yml 2>/dev/null | head -n 1)")"

Tip: you can run compose from anywhere (optional)

If you know the path, you can do:

docker compose -f /home/you/openclaw/docker-compose.yml ps

If you paste the output of:

#

pwd
ls
find ~ -name docker-compose.yml 2>/dev/null | head

…I can tell you exactly which cd ... to run.

thick mango Feb 17, 2026, 7:38 PM

#

lean ruinBOT Feb 17, 2026, 7:39 PM

#

If “+” means “cool, what next?” then once you’ve cd’d into the folder that has docker-compose.yml, run:

ls
docker compose ps
docker compose logs --tail=100 openclaw-gateway

If “+” means “I still can’t find it”, paste the output of:

pwd
ls
find ~ -maxdepth 4 -name docker-compose.yml 2>/dev/null

and I’ll tell you the exact cd ... command to run.

#

Tiny navigation pro-tips:

cd <first letters><TAB> autocompletes folder names
cd - toggles between current/previous directory
ls -la shows hidden files (sometimes compose files are in a repo you didn’t notice)

thick mango Feb 17, 2026, 8:04 PM

#

when trying to run docker compose logs it gives me missing config run 'openclaw setup' or set gateway.mode=local

lean ruinBOT Feb 17, 2026, 8:23 PM

#

That error text (missing config… run 'openclaw setup' or set gateway.mode=local) is coming from the OpenClaw CLI, not from Docker itself.

Two common causes:

A) You accidentally ran `openclaw logs` (host CLI), not `docker compose logs`

If you’re doing the Docker setup, you usually don’t run openclaw … on the host at all. Use the CLI inside the compose project instead:

docker compose logs --tail=200 openclaw-gateway

(important: service name is openclaw-gateway with a hyphen)

B) You’re not in the folder that has `docker-compose.yml`

If you run docker compose … in the wrong directory, Docker can’t find the compose config and things get confusing.

Check:

#

pwd
ls
ls docker-compose.yml

If you haven’t done the Docker onboarding yet

From the repo root (the folder with docker-setup.sh), run:

./docker-setup.sh

or manual:

docker compose run --rm openclaw-cli onboard
docker compose up -d openclaw-gateway

thick mango Feb 17, 2026, 8:53 PM

#

ok i did ls docker compose and it just wrote docker compose, when doing the --tail command it gives the same set gateway mode errors

lean ruinBOT Feb 17, 2026, 8:56 PM

#

You’re mixing up two totally different things:

docker compose ... = a command
docker-compose.yml (or compose.yml) = a file

So when you typed ls docker compose, you asked Linux to list two paths named docker and compose — not the compose YAML file.

1) Check if the compose file exists in your current folder

Run exactly one of these:

ls -la docker-compose.yml
ls -la compose.yml
ls -la docker-compose.yaml
ls -la compose.yaml

#

If all say “No such file”, you’re in the wrong directory.

2) Find where the compose file is

Search your home directory for it:

find ~ -maxdepth 6 \( -iname "docker-compose.yml" -o -iname "compose.yml" -o -iname "docker-compose.yaml" -o -iname "compose.yaml" \) 2>/dev/null

If it prints e.g.:
/home/you/openclaw/docker-compose.yml

Then do:

cd /home/you/openclaw

#

3) Once you’re in the right folder, Docker logs should work

docker compose ps
docker compose logs --tail=200 openclaw-gateway

Why you’re seeing the “set gateway.mode=local” error

That message is from the OpenClaw CLI (host), not from Docker. It usually means the command you actually ran was openclaw logs ... (or something invoking openclaw), or you’re not actually running Docker Compose against a real compose file.

Quick check: what is “docker” on your machine?

Paste output of:

which docker
docker --version
docker compose version
pwd

#

ls -la

With that, I can tell you exactly what folder you’re in and what to cd into.

thick mango Feb 17, 2026, 9:09 PM

#

I AM IN THE DOCKER FOLDER HOW DO I FIX THE "missing config. run 'openclaw setup' or set gateway.mode=local (or pass --allow-unconfigured)."

#

wait maybe i am not

lean ruinBOT Feb 17, 2026, 9:15 PM

#

That message is OpenClaw complaining it has no config yet. It means the Gateway/CLI is starting before you’ve run the Docker onboarding, so there’s no ~/.openclaw/config/openclaw.json (or equivalent) mounted/created.

Fix = run the onboarding once via the CLI container, then start the gateway container.

1) Make sure you’re using the right service names

From the folder that has the compose file, run:

docker compose config --services

You should see something like openclaw-cli and openclaw-gateway.

2) Run onboarding (this creates the config)

docker compose run --rm openclaw-cli onboard

3) Start the gateway

#

Yeah—this is exactly what it smells like. Let’s prove it in 30 seconds.

1) Check what folder you’re actually in

Run:

pwd
ls -la

In the “right” folder you should see one of these files:

docker-compose.yml or compose.yml
(and often docker-setup.sh if you’re in the OpenClaw repo root)

2) Find the compose file on your machine

Run:

#

docker compose up -d openclaw-gateway

4) Now logs should work

docker compose logs -f --tail=200 openclaw-gateway

5) Get the dashboard link (and token flow)

docker compose run --rm openclaw-cli dashboard --no-open

If you still get the exact same “missing config…” error when running docker compose logs ..., paste the output of these (it’ll reveal what command is actually running):

#

find ~ -maxdepth 6 \( -iname "docker-compose.yml" -o -iname "compose.yml" \) 2>/dev/null

It will print one (or more) full paths. Pick the one that looks like the OpenClaw repo, then:

cd /the/path/that/contains/the/file

Confirm:

ls -la docker-compose.yml compose.yml 2>/dev/null

3) Once you’re in the correct folder

Then these will work:

#

type docker
docker compose version
docker compose config --services

#

docker compose config --services
docker compose run --rm openclaw-cli onboard
docker compose up -d openclaw-gateway

Paste the output of steps (1) and (2) and I’ll tell you the exact cd ... to run.

thick mango Feb 17, 2026, 9:57 PM

#

ok i have the openclaw onboarding on my ubuntu terminal, i am choosing manual setup mode. can you explain what to choose and why? and also how do i open my network port to access it through the browser, and what are the dangers of all of these steps?

lean ruinBOT Feb 17, 2026, 10:00 PM

#

If you’re not 100% sure what you need yet, don’t do “manual” — hit back and choose QuickStart. It defaults to the safest setup (local-only), and you can widen access later once everything works.

That said, here’s how to think about the manual choices, and what’s dangerous.

Step 0: what’s your goal? (pick one)

Only this Ubuntu machine will access the UI
Other devices on your home LAN (phone/laptop) should access it
Access from anywhere (remote)

Your answers in the wizard depend on this.

What to choose in the wizard (and why)

Gateway mode

Choose gateway.mode = "local"
(“remote” is only if you already have a gateway running somewhere else.)

#

Bind address (`gateway.bind`)

Option 1 (safest): loopback
Only accessible on the same machine at http://127.0.0.1:18789/. No firewall/port opening needed.
Option 2 (LAN): lan
Accessible from your network at http://<ubuntu-lan-ip>:18789/ (still needs auth; see below).
Option 3 (remote, recommended way): keep loopback and use Tailscale Serve (see below).
This gives you HTTPS + identity headers and avoids “raw internet port” exposure.

Auth

Pick Token auth (gateway.auth.mode = "token") and let it generate a long random token.
Do not disable auth. Treat the token like a password.

Tailscale (if you chose goal #3)

Prefer Tailscale Serve (gateway.tailscale.mode = "serve") over opening ports.
Avoid Funnel unless you really mean “public internet”. Funnel is the “make it public” button.

How to “open the port” for browser access (Ubuntu)

#

There are two layers:

A) Docker must publish the port

Your compose must expose it (commonly 18789:18789). Check with:

docker compose ps

You want to see something like 0.0.0.0:18789->18789/tcp.

B) The host firewall must allow it (only if firewall is on)

First check (read-only):

sudo ufw status

If UFW is active and you want LAN access, allow LAN only (example for a typical home subnet):

#

sudo ufw allow from 192.168.1.0/24 to any port 18789 proto tcp

If you’re on a VPS, there may also be a cloud firewall / security group you must open—tell me if this is a home PC or a server.

The dangers (high level, but real)

Exposing the Gateway to more networks increases the chance someone can reach your “AI control plane”. If compromised, it can potentially drive tools / read files / run commands depending on your setup.
LAN bind over plain HTTP can also be awkward because the Control UI prefers a secure context (HTTPS or localhost) for device identity. That’s why SSH tunnel or Tailscale Serve is usually nicer/safer than “open a raw port”.
Port-forwarding on your router (public internet) is the big footgun. Even with a token, it’s not a great idea unless you really know what you’re doing (and then you’d typically put it behind a VPN or a reverse proxy + HTTPS + tight firewall rules).

Docs that match what we’re discussing:

Wizard: https://docs.openclaw.ai/start/wizard
Docker: https://docs.openclaw.ai/install/docker
Security: https://docs.openclaw.ai/gateway/security

If you reply with 1 / 2 / 3 (your goal) + whether this Ubuntu box is home PC or VPS, I’ll tell you the exact safest choices for each wizard screen.

thick mango Feb 17, 2026, 10:40 PM

#

my goal is 3, but i am fine starting in QuickStart mode. also do i use my chatgpt pro subscription and how do i add it

lean ruinBOT Feb 17, 2026, 10:41 PM

#

If your goal is (3) access from anywhere, starting in QuickStart is the right move. Get it working locally-first, then make it reachable remotely in the safest way.

1) QuickStart: what to pick

In QuickStart, you generally want:

Gateway mode: local
Auth: token (auto-generated) → keep it secret
Port: default 18789
Bind: ideally loopback (safer; then you use a tunnel/VPN for remote)

That baseline keeps the Gateway off the public internet while you learn.

2) Remote browser access: safest options (pick one)

Reply with 1 / 2 / 3 and I’ll tailor the exact steps for your setup.

SSH tunnel (recommended beginner-safe)
No firewall changes, no public port. You SSH into the Ubuntu box and forward the UI:
- You keep the gateway effectively “local-only”

#

You open the UI on your laptop at http://127.0.0.1:18789

Tailscale (recommended “real” remote access)
Also no public port-forwarding. Access over your private tailnet (often with HTTPS via Serve, depending on how you deploy).
Open the port on the internet (least recommended)
You bind to LAN/public and open firewall rules. Danger: anyone on the internet can hit your Gateway and start probing it. If you do this, you must:
- keep auth on (token/password)
- restrict firewall to your IP(s)
- avoid router port-forwarding unless you really understand it

Security context note: the Control UI behaves best on localhost or HTTPS. Raw http://public-ip:18789 is more brittle and increases risk. (Docs: https://docs.openclaw.ai/gateway/security)

3) “Do I use my ChatGPT Pro subscription? How do I add it?”

ChatGPT Pro (subscription) is not the same thing as an OpenAI API key.

You have two OpenAI paths in OpenClaw:

#

OpenAI API key (usage-based billing)
You paste OPENAI_API_KEY from the OpenAI Platform.
OpenAI Code (Codex) subscription via ChatGPT sign-in (OAuth)
This is the “use my subscription” style flow. In the wizard, choose the OpenAI Codex / ChatGPT sign-in option.
Docs: https://docs.openclaw.ai/providers/openai

If you’re running onboarding in Docker/headless, the OAuth callback can be weird — you may need to copy the final redirect URL and paste it back into the wizard (that’s expected; it’s in the Docker docs).

Biggest dangers to understand (plain English)

Exposing the Gateway publicly is like exposing a remote-control panel for an AI that can potentially run tools. Don’t do that casually.
Even on LAN, treat it as sensitive: use strong auth, keep allowlists tight, don’t make DMs “open”, and run openclaw security audit --deep once you’re up.

Now: are you on a home Ubuntu machine or a VPS, and do you have SSH access to it from your laptop? (Then pick 1/2/3 above.)

thick mango Feb 17, 2026, 11:02 PM

#

i dony see "openai code (codex) subscription via chatgpt sign in (oauth)" option

lean ruinBOT Feb 17, 2026, 11:05 PM

#

You won’t see that option with that exact wording. In the wizard it’s usually labeled more like:

“OpenAI Code subscription (OAuth)” (this is the ChatGPT-sign-in flow), or
“OpenAI Code subscription (Codex CLI reuse)” (only shows if you already have ~/.codex/auth.json)

A couple reasons you might not be seeing it:

You’re still in QuickStart / minimal auth list
QuickStart sometimes shows fewer auth choices. Switch to the manual/advanced flow for the full matrix.
The menu is scrollable (terminal UI)
Try:
- use arrow keys + PageDown, or
- start typing openai to filter (many prompts support type-to-search).
You’re on an older OpenClaw version
Please paste:

#

   openclaw --version

(If you’re in the Docker flow, run it via the CLI container:)

docker compose run --rm openclaw-cli --version

Important clarification about “ChatGPT Pro”

ChatGPT Pro (subscription) does not give you an OpenAI API key. So:

If you want to use your subscription inside OpenClaw, that’s specifically via OpenAI Code (Codex) OAuth.
If you want regular OpenAI API models (GPT via API), you’ll still need an OpenAI API key.

You can also add Codex after onboarding

Even if you skip it in the wizard, you can finish onboarding first, then run:

#

Host install:

openclaw models auth login --provider openai-codex

Docker install:

docker compose run --rm openclaw-cli models auth login --provider openai-codex

After that, openclaw models status will show whether it’s wired up.

Paste your openclaw --version and tell me whether you’re doing Docker or non-Docker onboarding, and I’ll tell you exactly where that option should appear in your flow.

thick mango Feb 17, 2026, 11:42 PM

#

can i use ollama instead of chatgpt? and if so can you explain how. also port forwarding???

lean ruinBOT Feb 17, 2026, 11:43 PM

#

Yes — you can use Ollama instead of ChatGPT/OpenAI. OpenClaw can talk to Ollama via Ollama’s OpenAI‑compatible API.

The one gotcha: you’re running OpenClaw in Docker, so 127.0.0.1:11434 inside the container is not your host’s Ollama. You must make Ollama reachable from the container.

The safe “get it working” path

1) Finish onboarding without OpenAI/Codex

In the wizard, pick Skip (or anything minimal) for model/auth just to complete setup and get the dashboard working.

2) Install + run Ollama on the Ubuntu host

Make sure Ollama is running and listening on port 11434 (default). (Ollama docs: https://ollama.ai)

3) Point OpenClaw (in Docker) at the host’s Ollama

Two common options:

Option A (recommended): use host.docker.internal

Configure OpenClaw’s Ollama provider base URL as:
http://host.docker.internal:11434/v1

#

On Linux you usually also need Docker to map that name to the host gateway via compose:
extra_hosts: ["host.docker.internal:host-gateway"]

Option B: run Ollama as another container on the same compose network

Then you can use a base URL like http://ollama:11434/v1 (service name).

4) Enable the Ollama provider in OpenClaw

Ollama “API key” is just an opt-in flag; it can be any string.

In Docker, you’d run commands via the CLI container, e.g.:

set the opt-in key:
- models.providers.ollama.apiKey = "ollama-local"
set models.providers.ollama.baseUrl to your chosen URL (...11434/v1)
then set your default model to ollama/<model-id> (pick one you’ve installed in Ollama)

Full doc (has exact snippets): https://docs.openclaw.ai/providers/ollama

#

Reality check (so expectations are right)

Local models can be less reliable at tool-calling/agent behavior than the best hosted models.
You still want to keep remote access VPN/tunnel-based (SSH tunnel or Tailscale), not “open a public port”.

If you tell me which setup you want:

Ollama on host + OpenClaw in Docker, or
Ollama in Docker too
…I’ll give you the exact minimal compose/config changes for that option.

thick mango Feb 18, 2026, 12:55 AM

#

ok how do i onboard openclaw from nothing open

lean ruinBOT Feb 18, 2026, 12:55 AM

#

To onboard OpenClaw from zero on Ubuntu using Docker, do this (copy/paste in order):

0) Prereqs

docker --version
docker compose version
git --version

1) Get the OpenClaw repo (this is where `docker-compose.yml` lives)

cd ~
git clone https://github.com/openclaw/openclaw.git
cd openclaw

Confirm you’re in the right place:

#

ls -ლა docker-compose.yml docker-setup.sh

2) Run the Docker onboarding (recommended path)

./docker-setup.sh

That script builds the image, runs onboarding, writes a token to .env, and starts the gateway.

3) Verify the gateway container is up

docker compose ps

4) Open the dashboard link + get the token helper

#

Run:

docker compose run --rm openclaw-cli dashboard --no-open

Then open the URL it prints in your browser.

Same machine: http://127.0.0.1:18789/
Different machine (remote server): don’t open ports yet—use an SSH tunnel:
```
ssh -N -L 18789:127.0.0.1:18789 user@YOUR_SERVER_IP
```
then open http://127.0.0.1:18789/ on your laptop.

Security note (important)

For “remote access”, do not port-forward 18789 to the public internet while you’re learning. Use SSH tunnel or Tailscale instead.

#

Docs: https://docs.openclaw.ai/install/docker

If any step fails, paste the output of:

pwd
ls -la | head
docker compose ps

thick mango Feb 18, 2026, 1:29 AM

#

thor@DESKTOP-2HNAR5T:~/openclaw$ ls -n docker-compose.yml docker-setup.sh
-rw-r--r-- 1 1000 1000 1469 Feb 16 18:38 docker-compose.yml
-rwxr-xr-x 1 1000 1000 6306 Feb 16 15:45 docker-setup.sh
thor@DESKTOP-2HNAR5T:~/openclaw$ is what i got

lean ruinBOT Feb 18, 2026, 1:30 AM

#

Perfect — that output means you’re in the right folder (repo root) and the files are there.

Next, do this:

1) Run the Docker setup/onboarding

cd ~/openclaw
./docker-setup.sh

2) After it finishes, confirm containers are running

docker compose ps

3) Get the dashboard URL (and token helper)

#

docker compose run --rm openclaw-cli dashboard --no-open

Then open the printed URL.

If you’re on the same machine: http://127.0.0.1:18789/
If you’re on a different machine (remote): use an SSH tunnel instead of opening ports:
```
ssh -N -L 18789:127.0.0.1:18789 thor@<server-ip>
```
then open http://127.0.0.1:18789/ on your laptop.

If something errors

Paste the last ~30 lines of:

#

docker compose logs --tail=200 openclaw-gateway

(And if ./docker-setup.sh complains about permissions, paste that message too.)

thick mango Feb 18, 2026, 3:24 AM

#

thor@DESKTOP-2HNAR5T:~/openclaw$ ./docker-setup.sh
Docker Compose not available (try: docker compose version)
thor@DESKTOP-2HNAR5T:~/openclaw$ ./docker-setup.sh
Docker Compose not available (try: docker compose version)
thor@DESKTOP-2HNAR5T:~/openclaw$ ./docker-compose.yml
-bash: ./docker-compose.yml: Permission denied
thor@DESKTOP-2HNAR5T:~/openclaw$ docker compose run --rm openclaw-cli dashboard --no-open

The command 'docker' could not be found in this WSL 2 distro.
We recommend to activate the WSL integration in Docker Desktop settings.

For details about using Docker Desktop with WSL 2, visit:

https://docs.docker.com/go/wsl2/

thor@DESKTOP-2HNAR5T:~/openclaw$

lean ruinBOT Feb 18, 2026, 3:25 AM

#

You’re in WSL2 Ubuntu, but Docker isn’t installed/available inside that WSL distro, so docker-setup.sh can’t run yet.

Also: docker-compose.yml is a config file, not something you execute (that’s why ./docker-compose.yml → permission denied).

Fix (recommended): Docker Desktop + WSL integration

On Windows:

Install Docker Desktop (and make sure it’s running)
Docker Desktop → Settings → General
- Enable “Use the WSL 2 based engine”
Docker Desktop → Settings → Resources → WSL Integration
- Enable integration for your Ubuntu distro (the one you’re using)
In PowerShell, restart WSL:
```
wsl --shutdown
```
Then reopen your Ubuntu terminal.

#

Back in WSL Ubuntu, verify:

docker version
docker compose version

If those work, go back to the repo and rerun:

cd ~/openclaw
./docker-setup.sh

Docker’s WSL2 guide (same link your error showed): https://docs.docker.com/go/wsl2/

If you paste the output of docker compose version after enabling integration, we can continue from there.

thick mango Feb 18, 2026, 3:30 AM

#

what do i do in ubuntu to run openclaw setup

lean ruinBOT Feb 18, 2026, 3:31 AM

#

openclaw setup is an OpenClaw CLI command. In Ubuntu you can run it as soon as the openclaw command exists on your PATH.

1) First check if OpenClaw is installed

In Ubuntu/WSL:

openclaw --version

If that prints a version → you’re good. Run:
```
openclaw setup
# or, to launch the full wizard:
openclaw setup --wizard
```
(The full wizard is also available as openclaw onboard.)
If you get “command not found” → you need to install OpenClaw first.

#

2) Install OpenClaw (non-Docker path)

Run the official installer:

curl -fsSL https://openclaw.ai/install.sh | bash

Then close/reopen the terminal (so PATH updates), and verify:

openclaw --version

Now you can run:

openclaw setup --wizard
# (or just: openclaw onboard)

#

3) If you meant “Docker setup”

Right now Docker isn’t available in your WSL distro (that’s what the error said). openclaw setup will work without Docker, but if you want the Docker flow you must first enable Docker Desktop’s WSL Integration for your Ubuntu distro, then docker compose version should work.

Docs:

openclaw setup: https://docs.openclaw.ai/cli/setup
Wizard/onboarding: https://docs.openclaw.ai/start/wizard

If you paste the output of:

openclaw --version
which openclaw

I can tell you which path you’re on (global install vs something else) and what the next exact command should be.

thick mango Feb 18, 2026, 3:35 AM

#

help [-dms] [pattern ...] { COMMANDS ; }
thor@DESKTOP-2HNAR5T:~/openclaw$ openclaw setup
/mnt/c/Users/thor/AppData/Roaming/npm/openclaw: 15: exec: node: not found
thor@DESKTOP-2HNAR5T:~/openclaw$ openclaw --version
/mnt/c/Users/thor/AppData/Roaming/npm/openclaw: 15: exec: node: not found
thor@DESKTOP-2HNAR5T:~/openclaw$ cd ..
thor@DESKTOP-2HNAR5T:~$ openclaw onboard
/mnt/c/Users/thor/AppData/Roaming/npm/openclaw: 15: exec: node: not found
thor@DESKTOP-2HNAR5T:~$ cd openclaw
thor@DESKTOP-2HNAR5T:~/openclaw$ openclaw onboard
/mnt/c/Users/thor/AppData/Roaming/npm/openclaw: 15: exec: node: not found
thor@DESKTOP-2HNAR5T:~/openclaw$

#

i already have openclaw installed and i am in ~/openclaw but the commands arent working, you can see the error above

lean ruinBOT Feb 18, 2026, 3:50 AM

#

The error you pasted isn’t “OpenClaw commands failing” — it’s Docker not being available inside your WSL Ubuntu:

The command 'docker' could not be found in this WSL 2 distro

So anything like ./docker-setup.sh or docker compose ... will fail until Docker works in WSL.

You’ve got 2 paths — pick one:

1) Keep Docker (recommended if you want the repo’s docker-compose flow)

Do this on Windows (Docker Desktop):

Install/launch Docker Desktop
Docker Desktop → Settings → Resources → WSL Integration
- Enable WSL integration
- Toggle ON your Ubuntu distro
Restart WSL:
- In PowerShell:

#

     wsl --shutdown
     ```
   - Reopen Ubuntu

Now in Ubuntu (WSL) this must work:
```bash
docker --version
docker compose version
docker info

Then rerun:

cd ~/openclaw
./docker-setup.sh

#

2) Skip Docker and run OpenClaw directly in WSL (simpler)

If you don’t actually need Docker, just run:

openclaw setup --wizard
# or
openclaw onboard

(This won’t use compose at all.)

If you tell me which option you want (1 = Docker, 2 = no Docker), I’ll give the exact next commands.

Also paste the output of:

openclaw --version

#

docker compose version

(the second one will currently fail until you do option 1, but paste it anyway).

thick mango Feb 18, 2026, 3:52 AM

#

only "docker --version" and "docker info" work

lean ruinBOT Feb 18, 2026, 3:53 AM

#

That means you have the Docker CLI + daemon, but you don’t have Docker Compose v2 available (docker compose ...).

./docker-setup.sh specifically checks for Compose with docker compose version, so it will refuse to run until that works.

1) Confirm what you have

Run:

docker compose version
docker-compose version

If docker-compose version works but docker compose version fails → you have old “Compose v1” only.
If both fail → Compose isn’t installed at all.

2) Fix: install the Compose v2 plugin (Ubuntu/WSL)

In your Ubuntu (WSL) shell:

#

sudo apt-get update
sudo apt-get install -y docker-compose-plugin

Then verify:

docker compose version

3) If `docker-compose-plugin` isn’t found by apt

That usually means you installed Docker from Ubuntu’s docker.io packages (older). In that case, simplest options:

Option A (quick workaround): install legacy compose:
```
sudo apt-get install -y docker-compose
```

#

(but note: ./docker-setup.sh still expects docker compose, so you’d run compose manually with docker-compose ... instead)

Option B (recommended): use Docker’s official packages (Docker CE) so docker compose is available. (Tell me what docker --version prints and I’ll point you to the exact install steps for WSL.)

4) Once `docker compose version` works

Go back to:

cd ~/openclaw
./docker-setup.sh

Paste the output of docker compose version (the error message) if it still doesn’t work.

thick mango Feb 18, 2026, 3:54 AM

#

but both docker compose and docker-compose work

lean ruinBOT Feb 18, 2026, 3:57 AM

#

Cool — if both docker compose and docker-compose work now, then the fix is simply: rerun the setup script.

cd ~/openclaw
./docker-setup.sh

If it still prints “Docker Compose not available”, then the script is seeing docker compose version fail (non‑zero) for some reason. Let’s capture exactly what it’s seeing:

Run this and paste the output:

docker compose version; echo "exit=$?"

Then run a traced start of the script (this only shows the early checks):

#How can I run locally through Docker, and keep myself safe?? I have absolutely no idea what Im doing

1) Quick start (Docker)

2) The main safety rules (don’t skip these)

If you want “local-only” access

3) Two quick questions so I don’t give you the wrong steps

Recommended Windows flow (WSL2)

“Keep myself safe” (most important bit)

Make the Docker ports local-only

Also:

One question so I don’t steer you wrong

1) One-time setup (Windows)

2) Install OpenClaw via Docker (from Ubuntu/WSL)

3) “Keep myself safe” (most important)

Quick question

Step 1 — paste the log tail (most important)

Step 2 — quick sanity checks

If gateway.mode is missing / not "local"

About “other devices later”

What I need next (this will show the real crash reason)

Bonus: avoid the confusing “probe” error for now

One important note

A) “AI has no access to my files” — what’s actually true in Docker

If you want zero access to your Windows files (strong isolation)

B) Logs are too big — give me the “error-only” slice

Option 1 (usually perfect)

Option 2 (filter to errors, PowerShell-friendly)

C) One important cleanup question

If you cloned OpenClaw on Windows (PowerShell)

If you cloned inside WSL2 (Ubuntu)

If you can’t remember where you cloned it

0) Prereqs (Windows)

1) Clone OpenClaw (inside WSL/Ubuntu)

2) Strong isolation: use named Docker volumes (NOT Windows folders)

3) Run the Docker setup

4) Keep it “local-only” (not reachable from other devices)

5) What NOT to do (to keep file isolation strong)

Quick checks (optional)

One question (so I tailor the “later” plan)

Why WSL2 (Ubuntu) is recommended even on Windows 11

But you don’t have to use WSL

What you need to verify first (2 quick checks)

Then the “strong isolation + local only” path (recap)

1) Re-run the setup (safe to retry)

2) Quick checks if it keeps canceling

3) Strong isolation reminder (you’re still on track)

Fix (keeps strong isolation: no Windows file mounts)

1) Make sure your repo .env has exactly:

2) Edit docker-compose.yml and add this at the very bottom:

3) Bring it up again (from the repo folder, in WSL)

Extra: keep it local-only on your PC

Sanity check (optional)

1) Find your OpenClaw repo folder (in WSL/Ubuntu)

If you see openclaw

If you DON’T see openclaw

2) Find (or create) the .env file

Verify there are no accidental spaces/typos

3) Edit docker-compose.yml to declare the named volumes

4) (Optional but recommended) Keep it LOCAL-only on your PC

5) Restart the stack

6) “Strong isolation” (what this achieves)

What it should look like (example)

If you already have a volumes: section

Common “wrong” version I’ve seen (this breaks Compose)

Name mismatch check (most likely your issue)

Option A (recommended): rename them to match the .env values

Option B: keep your existing names, but match .env to them

What the openclaw-gateway part should look like

What the bottom of the file should look like

And your .env should match those names exactly

Fix steps

If you’re in nano

If you’re in vim / neovim

Quick check

1) First: saving in nano

2) Fix the compose file structure

3) Quick way to see what’s wrong (pasteable)

4) Validate + try again

Fix (edit the bottom of docker-compose.yml)

Validate it (fast sanity check)

Then restart

If `gateway.mode` is missing / not `"local"`

1) Make sure your repo `.env` has exactly:

2) Edit `docker-compose.yml` and add this at the very bottom:

If you see `openclaw`

If you DON’T see `openclaw`

2) Find (or create) the `.env` file

3) Edit `docker-compose.yml` to declare the named volumes

If you already have a `volumes:` section

Option A (recommended): rename them to match the `.env` values

Option B: keep your existing names, but match `.env` to them

What the `openclaw-gateway` part should look like

And your `.env` should match those names exactly

Fix (edit the bottom of `docker-compose.yml`)

One more check: your `.env` must match the names

Step 2: Reset `docker-compose.yml` back to how the repo shipped it

Step 4: Make sure your `.env` matches the volume names

If `git restore docker-compose.yml` fails

A) You’re running compose from the wrong folder (so `.env` isn’t loaded)

C) `.env` must match your named volumes exactly

1) First: check your `.env` actually has a token (not blank)

Find the folder that contains `docker-compose.yml`

A) You accidentally ran `openclaw logs` (host CLI), not `docker compose logs`

B) You’re not in the folder that has `docker-compose.yml`

Bind address (`gateway.bind`)