Skip to content
OpenClaw Docs

Oracle Cloud

Oracle Cloud

Section titled “Oracle Cloud”

Run a persistent OpenClaw Gateway on Oracle Cloud’s Always Free ARM tier (up to 4 OCPU, 24 GB RAM, 200 GB storage) at no cost.

Prerequisites

Section titled “Prerequisites”

Setup

Section titled “Setup”

  1. Create an OCI instance

    1. Log into Oracle Cloud Console.
    2. Navigate to Compute > Instances > Create Instance.
    3. Configure:
      • Name: openclaw
      • Image: Ubuntu 24.04 (aarch64)
      • Shape: VM.Standard.A1.Flex (Ampere ARM)
      • OCPUs: 2 (or up to 4)
      • Memory: 12 GB (or up to 24 GB)
      • Boot volume: 50 GB (up to 200 GB free)
      • SSH key: Add your public key
    4. Click Create and note the public IP address.

  2. Connect and update the system

    Terminal window
    ssh ubuntu@YOUR_PUBLIC_IP
    

    sudo apt update && sudo apt upgrade -y
    sudo apt install -y build-essential

    build-essential is required for ARM compilation of some dependencies.

  3. Configure user and hostname

    Terminal window
    sudo hostnamectl set-hostname openclaw
    sudo passwd ubuntu
    sudo loginctl enable-linger ubuntu

    Enabling linger keeps user services running after logout.

  4. Install Tailscale

    Terminal window
    curl -fsSL https://tailscale.com/install.sh | sh
    sudo tailscale up --ssh --hostname=openclaw

    From now on, connect via Tailscale: ssh ubuntu@openclaw.

  5. Install OpenClaw

    Terminal window
    curl -fsSL https://openclaw.ai/install.sh | bash
    source ~/.bashrc

    When prompted “How do you want to hatch your bot?”, select Do this later.

  6. Configure the gateway

    Use token auth with Tailscale Serve for secure remote access.

    Terminal window
    openclaw config set gateway.bind loopback
    openclaw config set gateway.auth.mode token
    openclaw doctor --generate-gateway-token
    openclaw config set gateway.tailscale.mode serve
    openclaw config set gateway.trustedProxies '["127.0.0.1"]'
    

    systemctl --user restart openclaw-gateway

    gateway.trustedProxies=["127.0.0.1"] is for the local Tailscale Serve proxy. Diff viewer routes keep fail-closed behavior in this setup: raw 127.0.0.1 viewer requests without forwarded proxy headers can return Diff not found. Use mode=file / mode=both for attachments, or intentionally enable remote viewers and set plugins.entries.diffs.config.viewerBaseUrl (or pass a proxy baseUrl) if you need shareable viewer links.

  7. Lock down VCN security

    Block all traffic except Tailscale at the network edge:

    1. Go to Networking > Virtual Cloud Networks in the OCI Console.
    2. Click your VCN, then Security Lists > Default Security List.
    3. Remove all ingress rules except 0.0.0.0/0 UDP 41641 (Tailscale).
    4. Keep default egress rules (allow all outbound).

    This blocks SSH on port 22, HTTP, HTTPS, and everything else at the network edge. You can only connect via Tailscale from this point on.

  8. Verify

    Terminal window
    openclaw --version
    systemctl --user status openclaw-gateway
    tailscale serve status
    curl http://localhost:18789

    Access the Control UI from any device on your tailnet:

    https://openclaw.

    .ts.net/ ```

    Replace `

    with your tailnet name (visible intailscale status`).

Fallback: SSH tunnel

Section titled “Fallback: SSH tunnel”

If Tailscale Serve is not working, use an SSH tunnel from your local machine:

Terminal window
ssh -L 18789:127.0.0.1:18789 ubuntu@openclaw

Then open http://localhost:18789.

Troubleshooting

Section titled “Troubleshooting”

Instance creation fails (“Out of capacity”) — Free tier ARM instances are popular. Try a different availability domain or retry during off-peak hours.

Tailscale will not connect — Run sudo tailscale up --ssh --hostname=openclaw --reset to re-authenticate.

Gateway will not start — Run openclaw doctor --non-interactive and check logs with journalctl --user -u openclaw-gateway -n 50.

ARM binary issues — Most npm packages work on ARM64. For native binaries, look for linux-arm64 or aarch64 releases. Verify architecture with uname -m.

Next steps

Section titled “Next steps”