Gateway IP failure

[stark peak]

2026-05-09T18:51:33.208-07:00 [gateway] loading configuration…
2026-05-09T18:51:33.485-07:00 [gateway] resolving authentication…
2026-05-09T18:51:33.515-07:00 [gateway] starting...
2026-05-09T18:51:39.286-07:00 [gateway] wrote stability bundle: /home/node/.openclaw/logs/stability/openclaw-stability-2026-05-10T01-51-39-272Z-1-gateway.startup_failed.json
Gateway failed to start: Error: gateway bind=custom requested 172.25.0.7 but resolved 0.0.0.0; refusing fallback

Why do I keep getting this error? Previous version works file. Config:

  "gateway": {
    "mode": "remote",
    "port": 80,
    "bind": "custom",
    "customBindHost": "172.25.0.7",
    "auth": {
      "mode": "token",
      "trustedProxy": {
        "userHeader": "x-forwarded-user",
        "requiredHeaders": [
          "x-forwarded-proto",
          "x-forwarded-host"
        ],
        "allowUsers": []
      },
      "token": "${OPENCLAW_GATEWAY_TOKEN}"
    },
    "controlUi": {
      "allowedOrigins": [
        "http://ix-openclaw-openclaw-1",
        "https://app.xxx.com",
        "https://app-world.xxx.com",
        "https://app-local.xxx.com:60001"
      ],
      "enabled": true
    },

[plain oriole]

To help others find answers, you can mark your question as solved via Right click solution message -> Apps -> ✅ Mark Solution

[tiny herald]

This is almost certainly the new bind-safety check doing its job.

gateway.bind: "custom" now means “bind to exactly gateway.customBindHost”. OpenClaw first tests whether the process can actually bind 172.25.0.7. In your container/runtime that test is failing, so the resolver falls back to 0.0.0.0; newer OpenClaw refuses that fallback instead of silently widening the bind:

requested 172.25.0.7 but resolved 0.0.0.0; refusing fallback

Why it worked before: older versions appear to have allowed the fallback. The IP is probably no longer assigned inside the container, or Docker/TrueNAS changed the container IP.

For a Docker/reverse-proxy setup, don’t pin the container’s ephemeral bridge IP. Use one of these instead:

"gateway": {
  "bind": "lan"
}