Deploy OpenClaw Gateway on GCP Compute Engine with Docker

Run an OpenClaw Gateway that stays active on a Debian Compute Engine VM. This document handles GCP provisioning, network access, and VM management; container setup, persistence, custom binaries, verification, and updates are covered on the shared Docker VM runtime page.

Costs depend on the machine type and region you choose. For a source build, start with at least 2 GB RAM, and scale up if the build gets OOM-killed.

What you need

• A GCP project with billing enabled
• The gcloud CLI or the Cloud Console
• SSH access from your laptop
• Model and optional channel credentials
• About 20 minutes

Provision the VM

Initialize gcloud

Get the CLI from cloud.google.com/sdk/docs/install, then authenticate:

gcloud init
gcloud auth login

The same steps can be done in the Cloud Console.

Create the project

gcloud projects create my-openclaw-project --name="OpenClaw Gateway"
gcloud config set project my-openclaw-project
gcloud services enable compute.googleapis.com

Turn on billing in the Billing console. Without it, Compute Engine won't start.

Choose a machine

Set up a Debian 12 VM:

gcloud compute instances create openclaw-gateway \
  --zone=us-central1-a \
  --machine-type=e2-small \
  --boot-disk-size=20GB \
  --image-family=debian-12 \
  --image-project=debian-cloud

Review firewall access

Port TCP 18789 should stay closed to the public Internet. The SSH tunnel described below only requires SSH access to the VM:

gcloud compute firewall-rules list \
  --format='table(name,network,direction,sourceRanges.list():label=SOURCE_RANGES,allowed[].map().firewall_rule().list():label=ALLOW)'

When possible, limit SSH source ranges to your administrative network. If you plan to expose the Gateway through a reverse proxy or tailnet, follow Gateway security instead of adding a broad 0.0.0.0/0 rule for port 18789.

Connect over SSH

gcloud compute ssh openclaw-gateway --zone=us-central1-a

After VM creation, SSH key propagation may take a minute or two. If the first connection is refused, wait and try again.

Install Docker

On the VM:

sudo apt-get update
sudo apt-get install -y git curl ca-certificates
curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker "$USER"
exit

Reconnect so the group change takes effect, then confirm the installation:

gcloud compute ssh openclaw-gateway --zone=us-central1-a
docker --version
docker compose version

Configure the Docker runtime

On the VM, go through Docker VM runtime from Before you begin to Verify and administer the Gateway. The maintained setup script defaults to these GCP host paths:

export OPENCLAW_CONFIG_DIR="$HOME/.openclaw"
export OPENCLAW_WORKSPACE_DIR="$HOME/.openclaw/workspace"
export OPENCLAW_AUTH_PROFILE_SECRET_DIR="$HOME/.openclaw-auth-profile-secrets"

If a source build ends with Killed, ResourceExhausted, or exit code 137, resize the VM before trying again.

Access the Control UI

From your laptop, start an SSH tunnel and keep it running:

gcloud compute ssh openclaw-gateway --zone=us-central1-a -- -L 18789:127.0.0.1:18789

Open http://127.0.0.1:18789/. When prompted, paste the Gateway token from the VM's .env. To reprint the dashboard URL or approve a browser device, run on the VM:

cd openclaw
docker compose run --rm openclaw-cli dashboard --no-open
docker compose run --rm openclaw-cli devices list
docker compose run --rm openclaw-cli devices approve <requestId>

Troubleshooting

SSH connection refused

Wait one or two minutes for SSH key propagation, then retry. Verify the VM is running and that an ingress firewall rule allows TCP 22 from your current network.

OS Login issues

gcloud compute os-login describe-profile

Your account needs Compute OS Login or Compute OS Admin Login permission.

Resize after an out-of-memory build

gcloud compute instances stop openclaw-gateway --zone=us-central1-a
gcloud compute instances set-machine-type openclaw-gateway \
  --zone=us-central1-a \
  --machine-type=e2-medium
gcloud compute instances start openclaw-gateway --zone=us-central1-a

Use a deployment service account

For personal setup, your user account suffices. Automation should use a dedicated service account with the narrowest role that works:

gcloud iam service-accounts create openclaw-deploy \
  --display-name="OpenClaw Deployment"

gcloud projects add-iam-policy-binding my-openclaw-project \
  --member="serviceAccount:openclaw-deploy@my-openclaw-project.iam.gserviceaccount.com" \
  --role="roles/compute.instanceAdmin.v1"

Avoid the Owner role. See Understanding roles.

Next steps

• Channels
• Nodes
• Gateway configuration
• Docker VM Runtime

Related

• Install overview
• Docker VM Runtime
• VPS hosting