Run OpenClaw in a Sandboxed macOS VM for Isolation or iMessage

Recommended default (most users)

• A low-cost Linux VPS suits an always-on Gateway without breaking the bank. Refer to VPS hosting.
• Your own hardware (a Mac mini or Linux machine) gives you complete control and a residential IP for browser automation. Since many services reject data center IPs, browsing from home often proves more reliable.
• A hybrid setup: run the Gateway on an inexpensive VPS, then attach your Mac as a node whenever browser or UI automation is required. Check Nodes and Gateway remote for details.

Reserve a macOS VM for cases where you truly need macOS-exclusive features like iMessage, or you want strong separation from your everyday Mac.

macOS VM options

Local VM on your Apple Silicon Mac (Lume)

With Lume, OpenClaw can run inside a sandboxed macOS VM on your current Apple Silicon Mac. This approach brings:

• A fully isolated macOS environment (your host machine stays untouched)
• iMessage functionality through imsg; the default local path isn't available on Linux or Windows
• Quick rollback by cloning VMs
• No additional hardware or cloud expenses

Hosted Mac providers (cloud)

For macOS in the cloud, hosted Mac services are another option:

• MacStadium provides hosted Macs
• Other hosted Mac providers work as well; just follow their VM and SSH instructions

Once SSH access to a macOS VM is established, proceed to Install OpenClaw below.

Quick path (Lume, experienced users)

1. Get Lume installed.
2. lume create openclaw --os macos --ipsw latest
3. Work through Setup Assistant, then turn on Remote Login (SSH).
4. lume run openclaw --no-display
5. SSH in, install OpenClaw, and set up channels.
6. You're done.

What you need (Lume)

• Apple Silicon Mac (M1/M2/M3/M4)
• Host running macOS Sequoia or newer
• Around 60 GB free disk space for each VM
• About 20 minutes of your time

1) Install Lume

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/trycua/cua/main/libs/lume/scripts/install.sh)"

If ~/.local/bin isn't on your PATH:

echo 'export PATH="$PATH:$HOME/.local/bin"' >> ~/.zshrc && source ~/.zshrc

Confirm it works:

lume --version

Documentation: Lume Installation

2) Create the macOS VM

lume create openclaw --os macos --ipsw latest

This fetches macOS and builds the VM. A VNC window should pop up automatically.

Note

Depending on your connection speed, the download might take a while.

3) Complete Setup Assistant

Inside the VNC window:

1. Pick your language and region.
2. Skip Apple ID (or log in later if iMessage is needed).
3. Set up a user account (keep track of the username and password).
4. Skip every optional feature.

Once setup finishes:

1. Enable SSH: go to System Settings -> General -> Sharing and switch on "Remote Login".
2. For headless operation, turn on auto-login: System Settings -> Users & Groups, choose "Automatically log in as:", and select the VM user.

4) Get the VM IP address

lume get openclaw

Find the IP address (typically 192.168.64.x).

5) SSH into the VM

ssh youruser@192.168.64.X

Substitute youruser with the account you created, and swap in your VM's IP address.

6) Install OpenClaw

Inside the VM, run the following command on npm 12 or npm 11.16+. For npm 11.15 or earlier, leave out --allow-scripts=openclaw.

npm install -g openclaw@latest --allow-scripts=openclaw
openclaw onboard --install-daemon

Follow the setup prompts to configure your model provider (Anthropic, OpenAI, etc.).

7) Configure channels

Put the Telegram token in the Gateway environment instead of pasting it into openclaw.json. Add TELEGRAM_BOT_TOKEN=<bot-token> to ~/.openclaw/.env, then source it in the current shell and add the channel:

export TELEGRAM_BOT_TOKEN="<bot-token>"
openclaw channels add --channel telegram --use-env

After a restart, the managed Gateway picks up the same state-directory .env. For WhatsApp, set your allowlist and then scan the login QR code:

openclaw config set channels.whatsapp.dmPolicy allowlist
openclaw config set channels.whatsapp.allowFrom '["+15551234567"]' --strict-json
openclaw channels login --channel whatsapp

8) Run the VM headlessly

Shut down the VM and restart it without a display:

lume stop openclaw
lume run openclaw --no-display

The VM keeps running in the background; OpenClaw's daemon maintains the gateway. To see the status:

ssh youruser@192.168.64.X "openclaw status"

Bonus: iMessage integration

This is where macOS really shines. Pair iMessage with imsg to bring Messages into OpenClaw.

From inside the VM:

1. Log into Messages.
2. Install imsg.
3. Give Full Disk Access and Automation permissions to the process running OpenClaw/imsg.
4. Check RPC support with imsg rpc --help.

Add this to your OpenClaw config:

{
  channels: {
    imessage: {
      enabled: true,
      cliPath: "imsg",
      dbPath: "~/Library/Messages/chat.db",
    },
  },
}

Restart the gateway. Your agent can then send and receive iMessages. Complete instructions: iMessage channel.

Save a golden image

Before making further changes, snapshot your clean setup:

lume stop openclaw
lume clone openclaw openclaw-golden

Restore at any point:

lume stop openclaw && lume delete openclaw
lume clone openclaw-golden openclaw
lume run openclaw --no-display

Running 24/7

To keep the VM active:

• Leave your Mac plugged in
• Turn off sleep under System Settings -> Energy Saver
• Use caffeinate when necessary

For genuine 24/7 operation, think about a dedicated Mac mini or a small VPS. See VPS hosting.

Troubleshooting

Related docs

• VPS hosting
• Nodes
• Gateway remote
• iMessage channel
• Lume Quickstart
• Lume CLI Reference
• Unattended VM Setup (advanced)
• Docker Sandboxing (alternative isolation approach)