26 July 2026

Running OpenClaw 2026.7.1 in Podman rootless container

This is an overview of how to run OpenClaw version 2026.7.1 in a Podman container on a home server.

Why don't I run it on my personal Windows computer using the standard method "iwr -useb https://openclaw.ai/install.ps1 | iex"?

I don't want to run an uncontrolled AI agent on a computer that has my personal data and full admin rights. That is why I prefer an isolated Podman container in rootless mode.

Why don't I use the ready-made script "./scripts/podman/setup.sh"?

  • I don't want to run third-party scripts.
  • I don't plan to use the OpenClaw CLI.
  • I don't want unnecessary files on my server.
  • I don't want to build the image (podman build) directly on the server.

I planned to run OpenClaw with a single podman run command, but it was more complicated than I thought. In this post, I want to show what the problems were and how I solved them.

Environment overview

  • Lab server model: GenMachine Ren4000 with AMD Ryzen 7 4800H and 16 GB RAM
  • OS: Ubuntu Server 26.04 LTS
  • Server IP: 10.0.0.77
  • Podman version: 5.7.0
  • Directory for OpenClaw: /home/alex/containers/openclaw/
  • User: alex (uid=1000, gid=1000, groups=1000)
  • OpenClaw container image: ghcr.io/openclaw/openclaw:2026.7.1
  • AI provider for OpenClaw: OpenRouter
  • HTTPS: no, only HTTP
  • OpenClaw CLI: not installed

Attempt #1

Commands podman run -d \
  --name openclaw \
  -p 18789:18789 \
  -v /home/alex/containers/openclaw/:/home/node/.openclaw \
  -e OPENROUTER_API_KEY="sk-or-v1-111222333444555666777888999000" \
  -e OPENCLAW_GATEWAY_TOKEN="secret" \
ghcr.io/openclaw/openclaw:2026.7.1
Container status Stopped
Container logs
[openclaw] Could not start the CLI.
[openclaw] Reason: EACCES: permission denied, mkdir '/home/node/.openclaw/state'
[openclaw] Debug: set OPENCLAW_DEBUG=1 to include the stack trace.
[openclaw] Try: openclaw doctor
[openclaw] Help: openclaw --help
Resume The problem is with directory permissions. Need to specify the correct user by adding the --userns=keep-id option.

Attempt #2

Commands
podman run -d \
  --name openclaw \
  -p 18789:18789 \
  --userns=keep-id \
  -v /home/alex/containers/openclaw/:/home/node/.openclaw \
  -e OPENROUTER_API_KEY="sk-or-v1-111222333444555666777888999000" \
  -e OPENCLAW_GATEWAY_TOKEN="secret" \
  ghcr.io/openclaw/openclaw:2026.7.1
Container statusStopped
Container logs
2026-07-26T14:46:01.679+00:00 [gateway] loading configuration…
2026-07-26T14:46:01.687+00:00 [gateway] resolving authentication…
2026-07-26T14:46:01.688+00:00 Missing config. Run `openclaw setup` or set gateway.mode=local (or pass --allow-unconfigured).
ResumeThe problem is the missing configuration file. To fix this, we can add the --allow-unconfigured flag.

Attempt #3

Commands
podman run -d \
  --name openclaw \
  -p 18789:18789 \
  --userns=keep-id \
  -v /home/alex/containers/openclaw/:/home/node/.openclaw \
  -e OPENROUTER_API_KEY="sk-or-v1-111222333444555666777888999000" \
  -e OPENCLAW_GATEWAY_TOKEN="secret" \
  ghcr.io/openclaw/openclaw:2026.7.1 --allow-unconfigured
Container statusStopped
Container logs
2026-07-26T14:57:43.948+00:00 [gateway] loading configuration…
2026-07-26T14:57:43.957+00:00 [gateway] resolving authentication…
2026-07-26T14:57:43.957+00:00 Missing config. Run `openclaw setup` or set gateway.mode=local (or pass --allow-unconfigured).
ResumeThat didn't work. The AI suggests using OPENCLAW_GATEWAY_MODE="local".

Attempt #4

Commands
podman run -d \
  --name openclaw \
  -p 18789:18789 \
  --userns=keep-id \
  -v /home/alex/containers/openclaw/:/home/node/.openclaw \
  -e OPENROUTER_API_KEY="sk-or-v1-111222333444555666777888999000" \
  -e OPENCLAW_GATEWAY_TOKEN="secret" \
  -e OPENCLAW_GATEWAY_MODE="local" \
  ghcr.io/openclaw/openclaw:2026.7.1
Container statusStopped
Container logs
2026-07-26T14:57:43.948+00:00 [gateway] loading configuration…
2026-07-26T14:57:43.957+00:00 [gateway] resolving authentication…
2026-07-26T14:57:43.957+00:00 Missing config. Run `openclaw setup` or set gateway.mode=local (or pass --allow-unconfigured).
ResumeThat also didn't work. Let's create openclaw.json

Attempt #5

Commands
echo -e '{\n  "gateway": {\n    "mode": "local"\n    }\n}' > /home/alex/containers/openclaw/openclaw.json

podman run -d \
  --name openclaw \
  -p 18789:18789 \
  --userns=keep-id \
  -v /home/alex/containers/openclaw/:/home/node/.openclaw \
  -e OPENROUTER_API_KEY="sk-or-v1-111222333444555666777888999000" \
  -e OPENCLAW_GATEWAY_TOKEN="secret" \
  ghcr.io/openclaw/openclaw:2026.7.1
Container statusRunning
OpenClaw statusRunning, but I can't login with secret
Container logs2026-07-26T15:18:49.901+00:00 [ws] closed before connect conn=9af8297f-e193-4260-832b-5e4e66fee64e peer=10.0.0.94:62240->10.0.0.77:18789 remote=10.0.0.94 fwd=n/a origin=http://10.0.0.77:18789 host=10.0.0.77:18789 ua=Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 code=1008 reason=control ui requires device identity (use HTTPS or localhost secure context) phase=auth_credentials_received
OpenClaw errors
Could not connect
The browser could not complete the Gateway connection. Check the target and transport before retrying credentials.
Confirm the Gateway is running with openclaw status or openclaw gateway run.
Check the WebSocket URL and use wss:// when the Gateway is behind HTTPS/Tailscale Serve.
Reopen the dashboard with openclaw dashboard --no-open to recopy the current URL and auth details.
Raw error
control ui requires device identity (use HTTPS or localhost secure context)
Screenshot
ResumeHTTPS or localhost secure context is required.

Attempt #6

Commands
echo -e '{\n  "gateway": {\n    "mode": "local",\n    "controlUi": {\n      "allowInsecureAuth": true,\n      "dangerouslyDisableDeviceAuth": true,\n      "allowedOrigins": ["http://10.0.0.77:18789", "http://localhost:18789"]\n    }\n  }\n}' > /home/alex/containers/openclaw/openclaw.json

podman run -d \
  --name openclaw \
  -p 18789:18789 \
  --userns=keep-id \
  -v /home/alex/containers/openclaw/:/home/node/.openclaw \
  -e OPENROUTER_API_KEY="sk-or-v1-111222333444555666777888999000" \
  -e OPENCLAW_GATEWAY_TOKEN="secret" \
  ghcr.io/openclaw/openclaw:2026.7.1
Container statusRunning
OpenClaw statusRunning, and I can login with secret
Container logs
2026-07-26T15:25:49.056+00:00 [gateway] loading configuration…
2026-07-26T15:25:49.142+00:00 [gateway] resolving authentication…
2026-07-26T15:25:49.151+00:00 [gateway] starting...
2026-07-26T15:25:49.583+00:00 [gateway] starting HTTP server...
2026-07-26T15:25:49.586+00:00 [gateway] ⚠️  Gateway is binding to a non-loopback address. Ensure authentication is configured before exposing to public networks.
2026-07-26T15:25:49.652+00:00 [health-monitor] started (interval: 300s, startup-grace: 60s, channel-connect-grace: 120s)
2026-07-26T15:25:50.032+00:00 [gateway] agent model: openai/gpt-5.5 (thinking=medium, fast=off)
2026-07-26T15:25:50.034+00:00 [gateway] http server listening (8 plugins: browser, canvas, device-pair, file-transfer, memory-core, ollama, phone-control, talk-voice; 0.7s)
2026-07-26T15:25:50.036+00:00 [gateway] log file: /tmp/openclaw/openclaw-2026-07-26.log
2026-07-26T15:25:50.076+00:00 [gateway] security warning: dangerous config flags enabled: gateway.controlUi.allowInsecureAuth=true, gateway.controlUi.dangerouslyDisableDeviceAuth=true. Run `openclaw security audit`.
2026-07-26T15:25:50.078+00:00 [gateway] starting channels and sidecars...
2026-07-26T15:25:50.134+00:00 [gateway] ready
2026-07-26T15:25:50.149+00:00 [heartbeat] started
OpenClaw errorsunexpected status 401 Unauthorized: Missing bearer or basic authentication in header, url: https://api.openai.com/v1/responses, cf-ray: a2146eccdd4bc8c4-ARN, request id: 7ca3d6b7-793b-4134-ac29-ab58a5a357c6
Screenshot
ResumeIt works, but OpenRouter don't used. Let's configure OpenRouter agent, add free LLM and some additional features (:Z, time zone and restart).

Finaly

Commands
cat << 'EOF' > /home/alex/containers/openclaw/openclaw.json
{
  "gateway": {
    "mode": "local",
    "controlUi": {
      "allowInsecureAuth": true,
      "dangerouslyDisableDeviceAuth": true,
      "allowedOrigins": ["http://10.0.0.77:18789", "http://localhost:18789"]
    }
  },
  "agents": {
    "defaults": {
      "model": {
        "primary": "openrouter/nvidia/nemotron-3-ultra-550b-a55b:free"
      },
      "models": {
        "openrouter/nvidia/nemotron-3-ultra-550b-a55b:free": {}
      }
    }
  }
}
EOF

podman run -d \
  --name openclaw \
  -p 18789:18789 \
  --userns=keep-id \
  -v /home/alex/containers/openclaw/:/home/node/.openclaw:Z \
  -e OPENROUTER_API_KEY="sk-or-v1-111222333444555666777888999000" \
  -e OPENCLAW_GATEWAY_TOKEN="secret" \
  -e TZ=Europe/Moscow \
  --restart unless-stopped \
  ghcr.io/openclaw/openclaw:2026.7.1
Container statusRunning
OpenClaw statusRunning
Screenshot
ResumePerfect!
Two commands instead of one as I expected.
Hope it helps someone.
Автор: на
Ярлыки: , , , ,

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)