Sign inSign up

secretvm/openclaw-tools

By secretvm

•Updated 7 months ago

OpenClaw upstream v2026.3.8 + tools

Image
Integration & delivery
0

1.3K

secretvm/openclaw-tools repository overview

⁠secretvm/openclaw-tools

TL;DR

services:
  openclaw-init:
    image: secretvm/openclaw-init:v2026.2.19
    environment:
      OPENCLAW_CONFIG_DIR_IN_CONTAINER: /home/node/.openclaw
      OPENCLAW_WORKSPACE_DIR_IN_CONTAINER: /home/node/.openclaw/workspace
      OPENCLAW_UID_GID: 1000:1000
    volumes:
      - ${OPENCLAW_CONFIG_DIR}:/home/node/.openclaw
      - ${OPENCLAW_WORKSPACE_DIR}:/home/node/.openclaw/workspace
    restart: no
    env_file:
      - usr/.env
  openclaw-gateway:
    image: ${OPENCLAW_IMAGE:-secretvm/openclaw-tools:2026.2.21.4}
    depends_on:
      openclaw-init:
        condition: service_completed_successfully
    environment:
      HOME: /home/node
      TERM: xterm-256color
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      GOG_KEYRING_PASSWORD: ${GOG_KEYRING_PASSWORD:-}
      PATH: /home/linuxbrew/.linuxbrew/bin:/home/linuxbrew/.linuxbrew/sbin:/usr/local/bin:/usr/bin:/bin
    volumes:
      - /opt/openclaw/config:/home/node/.openclaw
      - /opt/openclaw/workspace:/home/node/.openclaw/workspace
    ports:
      - 127.0.0.1:${OPENCLAW_GATEWAY_PORT:-18789}:18789
      - 127.0.0.1:${OPENCLAW_BRIDGE_PORT:-18790}:18790
    init: true
    restart: unless-stopped
    command:
      - node
      - openclaw.mjs
      - gateway
      - --bind
      - ${OPENCLAW_GATEWAY_BIND:-lan}
      - --port
      - "18789"
      - --allow-unconfigured
    env_file:
      - usr/.env
    healthcheck:
      test:
        - CMD-SHELL
        - node openclaw.mjs health --token "$OPENCLAW_GATEWAY_TOKEN" >/dev/null
          2>&1 || exit 1
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 30s

secretvm/openclaw-tools is a hardened OpenClaw Gateway image with a curated “tools layer” baked in for common OpenClaw skills and operational workflows.

It is intended for deployments where: • OpenClaw runs inside a VM / container runtime (including confidential VMs). • You want predictable skill dependencies (e.g., ffmpeg) available at runtime. • You want to keep the upstream OpenClaw build intact while adding only OS-level utilities.

This image runs OpenClaw as the non-root node user (UID 1000), consistent with upstream security hardening.

⁠What’s included

This image is based on the upstream OpenClaw Docker build and adds additional OS packages (“tools layer”) that some skills and troubleshooting workflows rely on.

Typical additions include: • Media tooling (e.g. ffmpeg) for voice/video/audio workflows • CLI utilities (e.g. curl, jq, certificates) used by skills and diagnostics

Exact package lists depend on the tag/version you are using.

⁠Quick start (Docker)

  1. Create persistent directories

OpenClaw expects a persistent home directory for config/state.

mkdir -p /opt/openclaw/config /opt/openclaw/workspace
# If you run as UID 1000 inside the container (default), make sure perms allow it:
chown -R 1000:1000 /opt/openclaw
  1. Run the gateway

Set a gateway token and publish port 18789.

docker run -d --name openclaw-gateway \
  -p 18789:18789 \
  -e OPENCLAW_GATEWAY_TOKEN="REPLACE_ME" \
  -e HOME=/home/node \
  -v /opt/openclaw/config:/home/node/.openclaw \
  -v /opt/openclaw/workspace:/home/node/.openclaw/workspace \
  secretvm/openclaw-tools:latest \
  node dist/index.js gateway --bind lan --port 18789 --allow-unconfigured

Notes: • --allow-unconfigured is useful for first boot; remove it after initial setup/pairing. • Keep /home/node/.openclaw persistent or you will lose pairing/config.

⁠Quick start (Docker Compose)

services:
  openclaw-gateway:
    image: secretvm/openclaw-tools:latest
    command:
      ["node","dist/index.js","gateway","--bind","lan","--port","18789","--allow-unconfigured"]
    environment:
      HOME: /home/node
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
    volumes:
      - /opt/openclaw/config:/home/node/.openclaw
      - /opt/openclaw/workspace:/home/node/.openclaw/workspace
    ports:
      - "18789:18789"
    restart: unless-stopped

Bring it up:

export OPENCLAW_GATEWAY_TOKEN="REPLACE_ME"
docker compose up -d

⁠Connecting to the gateway

From another machine (or a local CLI container), connect using the gateway URL and token:

openclaw devices list --url ws://<VM-IP>:18789 --token "$OPENCLAW_GATEWAY_TOKEN"

If you are using TLS termination (recommended), use wss:// and your domain.

⁠Security recommendations (strongly recommended)

•	Put the gateway behind TLS termination (Caddy / Nginx / Traefik) and expose only 443.
•	Restrict inbound firewall rules to your admin IPs or VPN.
•	Keep OPENCLAW_GATEWAY_TOKEN in a secret manager or Docker secrets.
•	After first-time bootstrap pairing, remove --allow-unconfigured.
•	Configure trusted proxies if running behind a reverse proxy.

⁠Tags & versioning

Use versioned tags for reproducible deployments (recommended). Example: • secretvm/openclaw-tools:2026.2.19

latest may change without notice.

⁠Support / upstream

This image is derived from OpenClaw. For core OpenClaw documentation and CLI usage, see upstream docs.

Tag summary

Content type

Image

Digest

sha256:e3e419dd4…

Size

2.1 GB

Last updated

7 months ago

docker pull secretvm/openclaw-tools:v2026.3.8.11