Deploy OpenClaw Gateway on EasyRunner with Podman and Caddy

EasyRunner runs the OpenClaw Gateway as a lightweight containerized service behind its Caddy proxy. The instructions below assume an EasyRunner host capable of running Podman-compatible Compose applications and handling HTTPS termination through Caddy.

Before you begin

• An EasyRunner server with a domain name pointed to it.
• The official OpenClaw image (ghcr.io/openclaw/openclaw) or a custom build you provide.
• A dedicated config volume that persists /home/node/.openclaw.
• A dedicated workspace volume that persists /home/node/.openclaw/workspace.
• A strong Gateway token or password.

Leave device authentication enabled whenever you can. If your reverse proxy cannot forward device identity correctly, adjust the trusted-proxy settings first (refer to Trusted proxy auth); only rely on dangerous auth bypasses within a fully private, operator-controlled network.

Compose app

Define an EasyRunner app using a Compose file structured as follows:

services:
  openclaw:
    image: ghcr.io/openclaw/openclaw:latest
    restart: unless-stopped
    environment:
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
      OPENCLAW_HOME: /home/node
      OPENCLAW_STATE_DIR: /home/node/.openclaw
      OPENCLAW_CONFIG_PATH: /home/node/.openclaw/openclaw.json
      OPENCLAW_WORKSPACE_DIR: /home/node/.openclaw/workspace
    volumes:
      - openclaw-config:/home/node/.openclaw
      - openclaw-workspace:/home/node/.openclaw/workspace
    labels:
      caddy: openclaw.example.com
      caddy.reverse_proxy: "{{upstreams 1455}}"
    command: ["node", "openclaw.mjs", "gateway", "--bind", "lan", "--port", "1455"]

volumes:
  openclaw-config:
  openclaw-workspace:

Substitute openclaw.example.com with your Gateway hostname. Store OPENCLAW_GATEWAY_TOKEN inside EasyRunner's secret or environment manager rather than including it directly in the app definition. The image binds to the loopback interface by default, so the explicit --bind lan --port 1455 in command is necessary for Caddy to communicate with the container.

Configure OpenClaw

Within the persistent config volume, restrict Gateway access to the proxy only and enforce authentication:

{
  gateway: {
    bind: "lan",
    port: 1455,
    auth: {
      token: "${OPENCLAW_GATEWAY_TOKEN}",
    },
  },
}

If Caddy handles TLS termination for the Gateway, apply trusted-proxy settings to the specific proxy path instead of turning off auth checks globally. See Trusted proxy auth.

Verify

From your local machine:

openclaw gateway probe --url https://openclaw.example.com --token <token>
openclaw gateway status --url https://openclaw.example.com --token <token>

On the EasyRunner host, GET /healthz (liveness) and GET /readyz (readiness) require no authentication and support the image's built-in container health check. Additionally, examine the app logs for a listening Gateway and verify there are no startup failures related to SecretRef, plugins, or channel authentication.

Updates and backups

• Pull or rebuild the new OpenClaw image, then redeploy the EasyRunner app.
• Before updates, back up the openclaw-config volume. It contains openclaw.json, agents/<agentId>/agent/auth-profiles.json, and the state of any installed plugins.
• Back up openclaw-workspace if agents write persistent project data there.
• After major updates, run openclaw doctor to detect config migrations and service warnings.

Troubleshooting

• gateway probe cannot connect: verify the Caddy hostname resolves to the app and that the container listens on 0.0.0.0:1455.
• Authentication fails: rotate the token in EasyRunner secrets and update the local client command at the same time.
• Files are owned by root after a restore: the image runs as node (uid 1000); fix the mounted volumes so that user can write to /home/node/.openclaw and /home/node/.openclaw/workspace.
• Browser or channel plugins fail: check that required external binaries, network egress, and mounted credentials are accessible inside the container.