How to Set Up OpenClaw on AWS Lightsail

Prerequisites

• ✓An AWS Lightsail instance with Docker Desktop (or Docker Engine) + Docker Compose v2 installed.
• ✓At least 2 GB RAM on the Lightsail VM so `pnpm install` during image build does not get OOM-killed with exit 137.
• ✓Enough disk space on the Lightsail instance for Docker images, logs, and OpenClaw config/workspace directories.
• ✓If your Lightsail instance is publicly reachable, review Security hardening for network exposure, especially Docker `DOCKER-USER` firewall policy.

Steps

1. 1

   Clone the OpenClaw repo and move to the repo root

   On your Lightsail VM you need the OpenClaw repo so you can run the Docker setup script from the repo root. All the Docker commands and compose files assume you execute them in that directory.

   textCopy

   Run `docker compose` from the repo root. If you enabled `OPENCLAW_EXTRA_MOUNTS` or `OPENCLAW_HOME_VOLUME`, the setup script writes `docker-compose.extra.yml`; include it with `-f docker-compose.yml -f docker-compose.extra.yml`.

2. 2

   Build the OpenClaw Docker image on Lightsail

   Use the provided setup script to build the gateway image locally on your Lightsail instance. This gives you a containerized gateway that matches the repo version and prepares Docker Compose for the next steps.

   bashCopy

   ./scripts/docker/setup.sh

3. 3

   Use a pre-built OpenClaw image instead of building

   If your Lightsail VM is small or you want faster setup, point the script at the pre-built image from GitHub Container Registry. io/openclaw/openclaw:latest` instead.

   bashCopy

   export OPENCLAW_IMAGE="ghcr.io/openclaw/openclaw:latest"
   ./scripts/docker/setup.sh

4. 4

   Complete the OpenClaw onboarding in Docker

   The setup script runs onboarding inside the container on your Lightsail VM. env`, and starts the gateway via Docker Compose so the service is ready to use.

   textCopy

   The setup script runs onboarding automatically. It will:
   *   prompt for provider API keys
   *   generate a gateway token and write it to `.env`
   *   start the gateway via Docker Compose

5. 5

   Open the Control UI from your workstation

   env`. If you need the dashboard URL again, use the CLI container to print it without auto-opening a browser.

   bashCopy

   Open `http://127.0.0.1:18789/` in your browser and paste the configured shared secret into Settings. The setup script writes a token to `.env` by default; if you switch the container config to password auth, use that password instead.
   
   Need the URL again?
   
   docker compose run --rm openclaw-cli dashboard --no-open

6. 6

   Configure messaging channels from the CLI container

   After the gateway is up on Lightsail, use the `openclaw-cli` container to add WhatsApp, Telegram, or Discord channels. 1.

   bashCopy

   # WhatsApp (QR)
   docker compose run --rm openclaw-cli channels login
   
   # Telegram
   docker compose run --rm openclaw-cli channels add --channel telegram --token "<token>"
   
   # Discord
   docker compose run --rm openclaw-cli channels add --channel discord --token "<token>"

7. 7

   Run the manual Docker flow on Lightsail (optional)

   If you prefer explicit control instead of the setup script, you can build the image and run onboarding and config writes yourself. This is useful when you script Lightsail provisioning or want to tweak compose options before starting the gateway.

   bashCopy

   docker build -t openclaw:local -f Dockerfile .
   docker compose run --rm --no-deps --entrypoint node openclaw-gateway \
     dist/index.js onboard --mode local --no-install-daemon
   docker compose run --rm --no-deps --entrypoint node openclaw-gateway \
     dist/index.js config set --batch-json '[{"path":"gateway.mode","value":"local"},{"path":"gateway.bind","value":"lan"},{"path":"gateway.controlUi.allowedOrigins","value":["http://localhost:18789","http://127.0.0.1:18789"]}]'
   docker compose up -d openclaw-gateway

8. 8

   Verify health endpoints from the Lightsail VM

   Use the built-in health endpoints to confirm the gateway is live and ready on your Lightsail instance. These unauthenticated probes are also what Docker’s `HEALTHCHECK` uses to mark the container healthy.

   bashCopy

   curl -fsS http://127.0.0.1:18789/healthz   # liveness
   curl -fsS http://127.0.0.1:18789/readyz     # readiness

9. 9

   Install ClawDock helpers for day-to-day Docker management

   On your Lightsail VM shell, install the ClawDock helper script to get shortcuts like `clawdock-start` and `clawdock-dashboard`. This makes it easier to manage the OpenClaw Docker stack without remembering long compose commands.

   bashCopy

   mkdir -p ~/.clawdock && curl -sL https://raw.githubusercontent.com/openclaw/openclaw/main/scripts/clawdock/clawdock-helpers.sh -o ~/.clawdock/clawdock-helpers.sh
   echo 'source ~/.clawdock/clawdock-helpers.sh' >> ~/.zshrc && source ~/.zshrc

10. 10

    Enable agent sandboxing in your Lightsail Docker gateway

    If you want tool execution to run in isolated containers while the gateway stays on the Lightsail host, enable the sandbox bootstrap. The setup script mounts the Docker socket only after sandbox checks pass and falls back to `off` if it cannot complete.

    bashCopy

    export OPENCLAW_SANDBOX=1
    ./scripts/docker/setup.sh

Configuration

Troubleshooting

The VM needs at least 2 GB RAM. Use a larger machine class and retry.

docker compose run --rm openclaw-cli dashboard --no-open
docker compose run --rm openclaw-cli devices list
docker compose run --rm openclaw-cli devices approve <requestId>

docker compose run --rm openclaw-cli config set --batch-json '[{"path":"gateway.mode","value":"local"},{"path":"gateway.bind","value":"lan"}]'
docker compose run --rm openclaw-cli devices list --url ws://127.0.0.1:18789

sudo chown -R 1000:1000 /path/to/openclaw-config /path/to/openclaw-workspace

OpenClaw runs commands with `sh -lc` (login shell), which sources `/etc/profile` and may reset PATH. Set `docker.env.PATH` to prepend your custom tool paths, or add a script under `/etc/profile.d/` in your Dockerfile.

Frequently asked questions