Neura Market Logo

Host OpenClaw on Oracle Cloud Always Free ARM Tier

Run OpenClaw Gateway 24/7 on Oracle Cloud's Always Free ARM tier with up to 4 OCPUs and 24 GB RAM. This guide covers prerequisites and step-by-step instance setup for developers.

Read this when

  • Setting up OpenClaw on Oracle Cloud
  • Looking for free VPS hosting for OpenClaw
  • Want 24/7 OpenClaw on a small server

Run an OpenClaw Gateway around the clock on Oracle Cloud's Always Free ARM tier, which offers up to 4 OCPUs, 24 GB of RAM, and 200 GB of storage, without spending anything.

Prerequisites

Setup

Create an OCI instance

  1. Sign in to the Oracle Cloud Console.
  2. Go to Compute > Instances > Create Instance.
  3. Set up the following:
    • Name: openclaw
    • Image: Ubuntu 24.04 (aarch64)
    • Shape: VM.Standard.A1.Flex (Ampere ARM)
    • OCPUs: 2 (or as many as 4)
    • Memory: 12 GB (or up to 24 GB)
    • Boot volume: 50 GB (up to 200 GB at no charge)
    • SSH key: Add your public key
  4. Select Create and write down the public IP address.

Tip

If you get an "Out of capacity" error during creation, switch to a different availability domain or come back later. The free tier has limited capacity.

Connect and update the system

ssh ubuntu@YOUR_PUBLIC_IP

sudo apt update && sudo apt upgrade -y
sudo apt install -y build-essential

Some dependencies need build-essential to compile for ARM.

Configure user and hostname

sudo hostnamectl set-hostname openclaw
sudo passwd ubuntu
sudo loginctl enable-linger ubuntu

With linger enabled, user services keep running even after you log out.

Install Tailscale

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --ssh --hostname=openclaw

From this point forward, use Tailscale to connect: ssh ubuntu@openclaw.

Install OpenClaw

curl -fsSL https://openclaw.ai/install.sh | bash
source ~/.bashrc

When it asks "How do you want to hatch your bot?", pick Do this later.

Configure the gateway

For secure remote access, use token authentication with Tailscale Serve.

openclaw config set gateway.bind loopback
openclaw config set gateway.auth.mode token
openclaw doctor --generate-gateway-token
openclaw config set gateway.tailscale.mode serve
openclaw config set gateway.trustedProxies '["127.0.0.1"]'

openclaw gateway install
systemctl --user restart openclaw-gateway.service

gateway.trustedProxies=["127.0.0.1"] in this context is only for the local Tailscale Serve proxy's handling of forwarded IPs and local clients. It is not gateway.auth.mode: "trusted-proxy". In this configuration, diff viewer routes stay fail-closed: raw 127.0.0.1 viewer requests that lack forwarded proxy headers get Diff not found. For attachments, use mode=file / mode=both, or if you want shareable viewer links, deliberately enable remote viewers and set plugins.entries.diffs.config.viewerBaseUrl (or provide a proxy baseUrl).

Lock down VCN security

At the network edge, block everything except Tailscale:

  1. In the OCI Console, go to Networking > Virtual Cloud Networks.
  2. Select your VCN, then Security Lists > Default Security List.
  3. Delete all ingress rules except 0.0.0.0/0 UDP 41641 (Tailscale).
  4. Leave the default egress rules as they are (allow all outbound).

This stops SSH on port 22, HTTP, HTTPS, and all other traffic at the network edge. From here on, Tailscale is your only way in.

Verify

openclaw --version
systemctl --user status openclaw-gateway.service
tailscale serve status
curl http://localhost:18789

Reach the Control UI from any device on your tailnet:

https://openclaw.<tailnet-name>.ts.net/

Swap in your tailnet name for <tailnet-name> (you can see it in tailscale status).

Verify the security posture

With the VCN locked down (only UDP 41641 open) and the Gateway bound to loopback, public traffic gets blocked at the network edge and admin access is limited to the tailnet. That makes several traditional VPS hardening steps unnecessary:

Traditional stepNeeded?Why
UFW firewallNoThe VCN stops traffic before it reaches the instance.
fail2banNoPort 22 is blocked at the VCN; there's no brute-force surface.
sshd hardeningNoTailscale SSH doesn't rely on sshd.
Disable root loginNoTailscale uses tailnet identity, not system users, for authentication.
SSH key-only authNoSame reason -- tailnet identity takes the place of system SSH keys.
IPv6 hardeningUsually notDepends on VCN/subnet settings; check what is actually assigned/exposed.

Still worth doing:

  • chmod 700 ~/.openclaw to tighten permissions on credential files.
  • openclaw security audit for a posture check specific to OpenClaw.
  • Regular sudo apt update && sudo apt upgrade for OS patches.
  • Periodically review devices in the Tailscale admin console.

Quick commands to verify things:

# Confirm no public ports are listening
sudo ss -tlnp | grep -v '127.0.0.1\|::1'

# Verify Tailscale SSH is active
tailscale status | grep -q 'offers: ssh' && echo "Tailscale SSH active"

# Optional: disable sshd entirely once Tailscale SSH is confirmed working
sudo systemctl disable --now ssh

ARM notes

The Always Free tier runs on ARM (aarch64). Most OpenClaw features work without issue; a few native binaries need ARM builds:

  • Node.js, Telegram, WhatsApp (Baileys): pure JavaScript, so no problems.
  • Most npm packages with native code: pre-built linux-arm64 artifacts are available.
  • Optional CLI helpers (like Go/Rust binaries from skills): look for an aarch64 / linux-arm64 release before installing.

Check the architecture with uname -m (it should print aarch64). If a binary has no ARM build, either compile from source or skip it.

Persistence and backups

OpenClaw state is stored in:

  • ~/.openclaw/ -- openclaw.json, per-agent auth-profiles.json, channel/provider state, and session data.
  • ~/.openclaw/workspace/ -- the agent workspace (SOUL.md, memory, artifacts).

These survive reboots. To grab a portable snapshot:

openclaw backup create
openclaw backup restore <archive.tar.gz> --target <fresh-directory>

Restore verifies and unpacks into a fresh staging directory; activation is a separate offline step. See Restore a full archive for the rollback warnings and the activation sequence.

Fallback: SSH tunnel

If Tailscale Serve isn't cooperating, set up an SSH tunnel from your local machine:

ssh -L 18789:127.0.0.1:18789 ubuntu@openclaw

Then open http://localhost:18789.

Troubleshooting

Instance creation fails ("Out of capacity") -- Free tier ARM instances are in high demand. Switch to another availability domain or try again when traffic is lighter.

Tailscale will not connect -- Execute sudo tailscale up --ssh --hostname=openclaw --reset to re-authenticate.

Gateway will not start -- Use openclaw doctor --non-interactive and inspect the logs via journalctl --user -u openclaw-gateway.service -n 50.

ARM binary issues -- The majority of npm packages are compatible with ARM64. For native binaries, seek out linux-arm64 or aarch64 releases. Confirm the architecture using uname -m.

Next steps

1,121 words · updated Aug 14, 2026