Neura Market Logo

Host OpenClaw on Oracle Cloud Always Free ARM Tier

Learn how to run a persistent OpenClaw Gateway on Oracle Cloud's Always Free ARM tier with up to 4 OCPU and 24 GB RAM. This guide covers prerequisites and step-by-step setup for users with an Oracle Cloud account.

Read this when

  • Setting up OpenClaw on Oracle Cloud
  • Looking for free VPS hosting for OpenClaw
  • Want 24/7 OpenClaw on a small server

Run a persistent OpenClaw Gateway on Oracle Cloud's Always Free ARM tier (up to 4 OCPU, 24 GB RAM, 200 GB storage) without incurring any charges.

Prerequisites

Setup

Create an OCI instance

  1. Sign in to the Oracle Cloud Console.
  2. Go to Compute > Instances > Create Instance.
  3. Set the following options:
    • Name: openclaw
    • Image: Ubuntu 24.04 (aarch64)
    • Shape: VM.Standard.A1.Flex (Ampere ARM)
    • OCPUs: 2 (or as many as 4)
    • Memory: 12 GB (or as much as 24 GB)
    • Boot volume: 50 GB (up to 200 GB at no charge)
    • SSH key: Provide your public key
  4. Press Create and make a note of the public IP address.

Tip

If instance creation fails due to an "Out of capacity" error, switch to another availability domain or attempt again later. Free tier capacity is constrained.

Connect and update the system

ssh ubuntu@YOUR_PUBLIC_IP

sudo apt update && sudo apt upgrade -y
sudo apt install -y build-essential

build-essential is necessary for compiling some dependencies on ARM.

Configure user and hostname

sudo hostnamectl set-hostname openclaw
sudo passwd ubuntu
sudo loginctl enable-linger ubuntu

Enabling linger ensures user services continue running after you log out.

Install Tailscale

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --ssh --hostname=openclaw

From this point forward, connect using Tailscale: ssh ubuntu@openclaw.

Install OpenClaw

curl -fsSL https://openclaw.ai/install.sh | bash
source ~/.bashrc

When asked "How do you want to hatch your bot?", pick Do this later.

Configure the gateway

Use token authentication with Tailscale Serve to enable secure remote access.

openclaw config set gateway.bind loopback
openclaw config set gateway.auth.mode token
openclaw doctor --generate-gateway-token
openclaw config set gateway.tailscale.mode serve
openclaw config set gateway.trustedProxies '["127.0.0.1"]'

systemctl --user restart openclaw-gateway.service

gateway.trustedProxies=["127.0.0.1"] in this context is only for the local Tailscale Serve proxy's forwarded IP and local client handling. It is not gateway.auth.mode: "trusted-proxy". In this configuration, diff viewer routes maintain fail closed behavior: raw 127.0.0.1 viewer requests that lack forwarded proxy headers return Diff not found. Use mode=file / mode=both for attachments, or deliberately enable remote viewers and set plugins.entries.diffs.config.viewerBaseUrl (or supply a proxy baseUrl) if shareable viewer links are required.

Lock down VCN security

At the network edge, block all traffic except Tailscale:

  1. Within the OCI Console, go to Networking > Virtual Cloud Networks.
  2. Select your VCN, then Security Lists > Default Security List.
  3. Delete every ingress rule except 0.0.0.0/0 UDP 41641 (Tailscale).
  4. Leave the default egress rules unchanged (allow all outbound).

This blocks SSH on port 22, HTTP, HTTPS, and all other protocols at the network boundary. From now on, you can only connect through Tailscale.

Verify

openclaw --version
systemctl --user status openclaw-gateway.service
tailscale serve status
curl http://localhost:18789

Reach the Control UI from any device on your tailnet:

https://openclaw.<tailnet-name>.ts.net/

Substitute <tailnet-name> with your tailnet name (you can find it in tailscale status).

Verify the security posture

With the VCN locked down (only UDP 41641 open) and the Gateway bound to loopback, public traffic is stopped at the network edge and admin access is restricted to the tailnet. This eliminates the need for several conventional VPS hardening measures:

Traditional stepNeeded?Why
UFW firewallNoThe VCN blocks traffic before it reaches the instance.
fail2banNoPort 22 is blocked at the VCN; no brute-force surface.
sshd hardeningNoTailscale SSH does not use sshd.
Disable root loginNoTailscale authenticates by tailnet identity, not system users.
SSH key-only authNoSame -- tailnet identity replaces system SSH keys.
IPv6 hardeningUsually notDepends on VCN/subnet settings; verify what is actually assigned/exposed.

Still advisable:

  • chmod 700 ~/.openclaw to restrict permissions on credential files.
  • openclaw security audit for an OpenClaw specific posture check.
  • Regular sudo apt update && sudo apt upgrade for OS patches.
  • Periodically review devices in the Tailscale admin console.

Quick verification commands:

# Confirm no public ports are listening
sudo ss -tlnp | grep -v '127.0.0.1\|::1'

# Verify Tailscale SSH is active
tailscale status | grep -q 'offers: ssh' && echo "Tailscale SSH active"

# Optional: disable sshd entirely once Tailscale SSH is confirmed working
sudo systemctl disable --now ssh

ARM notes

The Always Free tier uses ARM (aarch64). Most OpenClaw features work without issue; a small number of native binaries need ARM builds:

  • Node.js, Telegram, WhatsApp (Baileys): pure JavaScript, no problems.
  • Most npm packages with native code: pre-built linux-arm64 artifacts are available.
  • Optional CLI helpers (for example, Go or Rust binaries shipped by skills): check for an aarch64 / linux-arm64 release before installing.

Confirm the architecture with uname -m (it should output aarch64). For binaries lacking an ARM build, compile from source or skip them.

Persistence and backups

OpenClaw state is stored under:

  • ~/.openclaw/ -- openclaw.json, per-agent auth-profiles.json, channel/provider state, and session data.
  • ~/.openclaw/workspace/ -- the agent workspace (SOUL.md, memory, artifacts).

These survive reboots. To create a portable snapshot:

openclaw backup create

Fallback: SSH tunnel

If Tailscale Serve is not functioning, use an SSH tunnel from your local machine:

ssh -L 18789:127.0.0.1:18789 ubuntu@openclaw

Then open http://localhost:18789.

Troubleshooting

Instance creation fails ("Out of capacity") -- Free tier ARM instances are in high demand. Switch to a different availability domain or retry during less busy periods.

Tailscale will not connect -- Run sudo tailscale up --ssh --hostname=openclaw --reset to re-authenticate.

Gateway refuses to launch -- Execute openclaw doctor --non-interactive and examine logs via journalctl --user -u openclaw-gateway.service -n 50.

Problems with ARM binaries -- Most npm packages function correctly on ARM64. For native binaries, check for linux-arm64 or aarch64 builds. Confirm the architecture using uname -m.

Next steps