OpenClaw review: setup, Docker and security for self-hosters

OpenClaw is the default answer when someone asks for an open-source AI agent they can run themselves. It launched in November 2025, had 394,193 GitHub stars when we checked on November 8, 2026, and now sits under a nonprofit foundation with no paid tier. That popularity buys a lot: 29 chat channels, 64 model and media providers and 142 official plugins. It also means a lot of people are running an agent with shell access on their main computer without having read the security docs. This review is about what running it actually takes.

Who it suits

OpenClaw fits a developer or a technical hobbyist who wants one agent reachable from WhatsApp, Telegram, iMessage or Slack, wants to pick (and switch) the model, and is willing to own the setup. If you would not be comfortable reading a config file to turn on a sandbox, the maintainers themselves warn it is risky for you, and a more locked-down option from the list below is a better start.

OpenClaw setup: three real routes

The install docs give you three practical paths:

• Installer script. curl -fsSL https://openclaw.ai/install.sh | bash on macOS, Linux or WSL2, or a PowerShell one-liner on Windows. It provisions Node if you don’t have it and then launches onboarding. This is the path most people should take.
• npm. npm install -g openclaw@latest, then openclaw onboard --install-daemon. Useful if you already manage Node yourself; you need Node 24.16+ or 26.1+.
• Desktop apps for macOS, Windows and Linux, plus a one-click Railway deploy if you want it on a server without touching a terminal.

Onboarding walks you through a model provider and your first channel. Expect the fiddly part to be the channel, not the install: iMessage, for example, has its own setup page.

OpenClaw in Docker

There is an official Docker path: run ./scripts/docker/setup.sh from the repo, which prompts for API keys, writes a gateway token and starts the gateway with Docker Compose. You can use the prebuilt ghcr.io/openclaw/openclaw image; building locally needs at least 6 GB of RAM. The control UI then listens on 127.0.0.1:18789.

The point most people miss: running the gateway in Docker is not the same as sandboxing the agent. The Docker docs say it plainly: sandboxing is off by default and “does not require the Gateway itself to run in a container.” Docker gives you a tidy, throwaway install. It does not, on its own, decide what the agent’s tools can touch. That is a separate setting.

OpenClaw security: what to change on day one

Out of the box, OpenClaw’s tools run on the host. The sandboxing docs explain that agents.defaults.sandbox controls it, with Docker as the default backend and Podman, SSH, OpenShell and Crabbox as alternatives. Even with the sandbox on, the gateway process stays on the host, and tools.elevated is an explicit escape hatch that runs commands outside it. The docs call the sandbox “not a perfect security boundary.”

In practice, a sensible baseline looks like this:

1. Turn the sandbox on (the docs’ minimal example uses mode: "non-main" with workspaceAccess: "none").
2. Deny exec in tool policy if the agent doesn’t need a shell, and keep elevated off.
3. Treat third-party skills like any other code you install, because a skill runs with the agent’s access.
4. Be careful which inboxes you connect. Anything the agent reads, including an email from a stranger, can try to steer it.

We cover the wider risk picture in Is OpenClaw safe?. If you want OpenClaw itself but with a sandbox and network approvals built in, NVIDIA’s NemoClaw wraps it; see NemoClaw vs OpenClaw.

Telemetry

OpenClaw is not silent by default. Out of the box it runs a daily update check that sends your OpenClaw, OS and Node versions and CPU architecture, plus an identifier-free install count and update reports. Feature statistics are opt-in. Setting update.checkOnStart: false turns all of it off, per the telemetry docs. For most self-hosters that’s an acceptable default; for an air-gapped box, flip the setting.

Models and running costs

The software is free; the model is not, unless you run one locally through Ollama, LM Studio or vLLM. This matters more with OpenClaw than with a chat app, because an agent loops: it plans, calls tools, reads results and calls again. Notebookcheck reported users spending over $100 a day on expensive models. Set a spending limit at your provider before you leave it running, and start proactive and scheduled jobs on a cheaper model.

Upkeep and maturity

Development is very active: the version we checked was v2026.11.1, and releases come often. That’s good for fixes and bad for “set and forget”. Plan to update regularly, read release notes for config changes, and run openclaw doctor after upgrades to catch config issues (the Docker image runs it for you when it starts). The upside of the size is that most problems you hit have already been hit, asked about and answered.

When to pick something else

• You want isolation on by default: NanoClaw runs every agent in its own container, and ZeroClaw ships an OS sandbox in one Rust binary. See NanoClaw vs OpenClaw and ZeroClaw vs OpenClaw.
• You want an agent that writes its own skills: Hermes Agent, which can also import your OpenClaw setup. See Hermes Agent vs OpenClaw.
• You want several always-on bots, each with its own computer: Rakazo.

The full field is on our OpenClaw alternatives page.

Verdict

OpenClaw is the most-starred open-source agent on our list, with a large plugin ecosystem, and the MIT license with no paid tier means there’s no upsell waiting. Its weak spot is the default posture: tools on the host, telemetry on, and an ecosystem of skills you have to vet yourself. Set up the sandbox and tool policy before connecting your email, and it is a strong choice.