OpenClaw holds your paired WhatsApp session, your model key, and a license to act on your accounts — and the docs themselves tell you not to run it open to the world on your laptop. So put it on a server. But not a shared container, where one host kernel sits between your bot and every other tenant. This is a guide to self-hosting OpenClaw properly: your gateway in its own Firecracker microVM, bridging WhatsApp, Telegram, Discord, and Signal to your own LLM key, running 24/7, provisioned automatically the moment you pay — the microVM boots in 124ms. Ready to buy? The checkout path is managed OpenClaw on jurniti.
What OpenClaw is
OpenClaw is an open-source gateway that connects your messaging apps to an AI agent. You run one gateway process and it becomes the bridge — message it from WhatsApp, Telegram, Discord, or Signal, and it answers in the same thread. It runs tools, browses, automates tasks, and carries the plugin ecosystem the community already builds for.
It is bring-your-own-key: you connect your own Anthropic, OpenAI, or OpenRouter key. The OpenClaw Foundation stewards the project, and NVIDIA ships a reference deployment of it.
The problem with the obvious setup — running it on your laptop — is that laptops sleep. An assistant that triages your messages at 3am can't. So you put it on a server. The question is what kind.
Why a dedicated microVM, not your Mac or a container
The OpenClaw docs themselves warn you: never run it open-to-the-world on your personal machine, and lock down who can message it. That advice exists because you are handing an agent your accounts and credentials.
A shared container means a shared kernel — over 200 known weaknesses in the container stack, between your paired accounts and every other tenant. That's the wrong trade for a process this privileged. jurniti gives every gateway its own Firecracker microVM with its own kernel and a KVM hardware boundary — the isolation primitive that runs serverless platforms at scale, one per tenant, booting in about 124ms.
Bundled "AI credits" — and even most "BYOK" — put a middleman on your keys. Managed OpenClaw offers pre-load credits so you "don't need an OpenAI or Anthropic account," and charge their margin on every token. Even the common BYOK gateway stores your key and proxies your traffic through it. jurniti's BYOK is architectural: the key lives only in your VM, model traffic leaves that VM straight to the provider, and jurniti is never in the path. No proxy, no markup.
And it stays a reversible decision — a 30-day money-back guarantee, with your persistent workspace retained for 7 days after cancellation.
Self-host OpenClaw in 3 steps
Doing this by hand means a VPS, Node 22+, a gateway config, a reverse proxy for TLS, and pairing flows you debug over SSH — then patching and restarting it forever. jurniti runs the box ops; you keep the keys to the agent. Here it is in three steps.
1. Pick a plan and pay
Choose Starter, Pro, or Max and check out. Payment kicks off the provision chain automatically — no manual setup, no support ticket.
2. Your microVM boots and the gateway comes up
A fresh Ubuntu microVM boots, the OpenClaw runtime installs, and the gateway comes up. You get an in-browser terminal, so there is nothing to SSH into. On Pro and up, the gateway also gets its own TLS subdomain at https://<you>.jurniti.com.
Run the guided onboarding to connect your channels and your model key:
openclaw onboard
It walks you through pairing WhatsApp (scan a QR), Telegram (bot token), Discord, or Signal, and connecting your BYOK provider. Config lives on your persistent volume. Already running OpenClaw on your laptop? One command moves OpenClaw to the cloud — workspace, memory, and channel config carry over, and credentials are scrubbed before anything leaves your machine.
3. Message your assistant
Confirm the gateway is up:
openclaw gateway status
You should see it listening on port 18789. Now message your paired number (WhatsApp, Telegram, etc.) like any contact — OpenClaw answers in the same thread. Conversations, plugin state, and skills persist across restarts.
What people run OpenClaw for
- A personal chief of staff. Connect calendar + messaging; it reschedules meetings and briefs you each morning.
- A sales responder. It qualifies leads in Telegram, logs contacts, and drafts follow-ups.
- A community moderator. Route Discord support through it; it handles the routine tickets before a human sees them.
- A cross-platform automator. One agent reachable from every app you already use, instead of five disconnected bots.
You can snapshot a configured gateway into a template and fork it into a second VM for a different number or use case. It's also your safety net before a risky upstream update — OpenClaw has a reputation for breaking on upgrades: snapshot a known-good config first, upgrade, and if it breaks, fork the template back into a clean VM. For what a complete backup must actually include — and why partial copies corrupt state — see how to back up OpenClaw.
OpenClaw VPS vs a dedicated microVM
Most people self-hosting OpenClaw start by pricing a VPS. That works — it is just more of your evening than it looks, and the isolation is weaker than the name suggests.
A $5–10/mo OpenClaw VPS means you own the whole stack: provisioning Ubuntu, Node 22+, the gateway config, a reverse proxy and certificate renewal for TLS, a systemd unit so it survives reboots, and the pairing flows you debug over SSH at 1am. Then you own patching it forever. And on the cheap tiers you are usually on a shared kernel anyway — an OpenVZ or container-backed "VPS" puts the same 200-plus known container-stack weaknesses between your paired WhatsApp session and every other tenant on the box.
A dedicated Firecracker microVM is a different primitive: its own kernel, a KVM hardware boundary, one tenant. It is what serverless platforms run at scale, and it boots in about 124ms.
| OpenClaw VPS (DIY) | jurniti microVM | |
|---|---|---|
| Isolation | Often a shared kernel | Own kernel + KVM boundary |
| Setup | Ubuntu, Node, TLS, systemd, pairing | Automatic on payment, ~3 min |
| TLS subdomain | You configure certbot | Included on Pro and up |
| Patching | Yours, forever | Ours |
| Snapshot / rollback | dd and hope | Fork a template |
| Cost | $5–10/mo + your evenings | From $25/mo |
If you enjoy running the box, a VPS is genuinely fine. If you want the agent and not the sysadmin work, that is what this is.
The OpenClaw VPS checklist
If you are going the DIY route — a Hostinger or HostGator one-click image, an xCloud managed panel, a bare OVH box — this is the list you own. Work down it before you pair a single account:
- Kernel isolation. Confirm the tier is KVM, not OpenVZ or container-backed. "VPS" on the cheap plans frequently means a shared kernel.
- Node 22+ and a pinned gateway version. OpenClaw has broken on upgrades before; know which version you are on and how to go back.
- TLS in front of the gateway. A reverse proxy plus certificate renewal — never the raw port on a public IP.
- A systemd unit. So the gateway survives a reboot instead of going quiet until you notice your assistant stopped answering.
- Message allowlists and a dedicated number. Restrict who can reach the bot during onboarding.
- A patch cadence. The OS, Node, and the gateway. Forever.
- A restore path. Not
ddand hope — an actual tested way back to a known-good config. - Key handling. Your model key stays on the box. If any host asks you to paste it into their dashboard so they can proxy "for convenience," that is a different architecture than BYOK.
Every line above is work jurniti already did — items 1–4, 6 and 7 come with the plan, and 5 and 8 stay yours because they should be. Commercial plans, checkout, and the provision chain live on the OpenClaw hosting page.
Running OpenClaw in the cloud without the middleman
"OpenClaw cloud" usually means one of two things, and they are not the same deal. Managed-credits hosts bundle AI credits so you "don't need an Anthropic or OpenAI account" — convenient, and you pay their margin on every message forever. Even most BYOK gateways store your key and proxy your model traffic through their infrastructure.
jurniti's BYOK is architectural rather than a policy promise: the key lives only inside your microVM, model traffic leaves that VM straight to the provider, and jurniti is never in the path. You get cloud convenience — always-on, automatic provisioning, a TLS subdomain — without a middleman on your keys or your token spend.
jurniti vs your laptop vs a managed-credits host
| jurniti | Your laptop / Mac | Managed-credits host | |
|---|---|---|---|
| Always on | Yes, 24/7 | No — it sleeps | Yes |
| Isolation | Firecracker microVM (KVM) | Your whole machine | Shared container |
| Model keys | Yours, never leave the VM | Yours | Bundled + marked up |
| Setup | Automatic · ~3 min to live | Manual, fiddly | One click |
| Persistent workspace | Yes | Yes (on your disk) | Varies |
| Refund | 30-day money-back | n/a | Varies |
Pair channels without lighting the wrong fuse
OpenClaw is dangerous in a boring way: it is supposed to reach the accounts you pair. Treat pairing like production access.
- Prefer a dedicated number for the assistant, not your personal WhatsApp.
- Restrict who can message the bot during onboarding (allowlists / group rules).
- Snapshot a known-good config as a template before a risky upstream upgrade — OpenClaw upgrades have broken configs before; forking a snapshot is cheaper than re-pairing at midnight.
- Keep model keys inside the guest. If a host asks you to paste the key into their control plane so they can "proxy for convenience," that is not the same architecture as jurniti BYOK.
None of that replaces the KVM boundary. It stacks on top of it.
When to leave this guide and open checkout
This page is the long answer for people searching how to self-host and run OpenClaw 24/7 without a laptop and without a shared-kernel VPS. The short product path — plans, checkout, provision chain — lives on the OpenClaw product page. Google should send commercial "managed / hosting" intent there; this guide should send the operators who still need the isolation story.
Pricing
Starter is $25/mo ($250/year), Pro $49/mo ($490/year), Max $99/mo ($990/year) — annual billing is two months free. Every plan has the 30-day money-back guarantee on the first purchase. You bring your own model key, so token spend is separate and never marked up.
Running something else? See Claude Code security, Hermes Agent, and GTM agent templates, or compare plans on the pricing page.
