OpenClaw for Linux

This page is the Linux setup reference for OpenClaw. Below you’ll find a quick two-command install; system requirements and distro-specific steps (Ubuntu/Debian, Fedora/RHEL, Arch); how to run the Gateway as a systemd service so it stays up and survives reboot; browser and sandboxing notes; headless server and remote access; troubleshooting; and best practices. Jump to the section that matches what you need.

Two commands get OpenClaw installed and the Gateway ready. Run the install script (it pulls Node if needed), then run onboarding with --install-daemon so the Gateway is installed as a systemd user service. After that you can start the service and finish setup in the wizard.

curl -fsSL https://openclaw.ai/install.sh | bash

openclaw onboard --install-daemon

If your distro isn’t in the script’s default set or you hit issues, check System requirements and Distribution-specific instructions. Full install options: Installation guide.

Supported Linux setups: Ubuntu 20.04+, Debian 11+, Fedora 34+, or similar; x86_64 or arm64. Node.js ≥22 is required—the install script can install it if missing. You need systemd for running the Gateway as a service (standard on most current distros). Budget about 500MB for the install plus space for your workspace. If you’re on something else (e.g. older RHEL, minimal images), see the Installation guide and Distribution-specific instructions for variants. For a script tailored to your OS in the browser, use the Setup Wizard.

Same flow everywhere: install curl (or use wget), run the install script, then openclaw onboard --install-daemon. Only the package manager and package name differ.

Ubuntu / Debian

sudo apt update
sudo apt install -y curl
curl -fsSL https://openclaw.ai/install.sh | bash
openclaw onboard --install-daemon

Fedora / RHEL / CentOS

sudo dnf install -y curl
curl -fsSL https://openclaw.ai/install.sh | bash
openclaw onboard --install-daemon

Arch Linux

sudo pacman -S curl
curl -fsSL https://openclaw.ai/install.sh | bash
openclaw onboard --install-daemon

After onboarding, use Systemd service to start or enable the Gateway.

The Gateway runs as a systemd user service—no root, same user as your workspace. Installing the service is done by openclaw onboard --install-daemon (during Quick start or after a manual install). That drops the unit into ~/.config/systemd/user/openclaw-gateway.service and you control it with systemctl --user. You get a single long-lived process that keeps running after you close the terminal and, if enabled, after reboot.

systemctl --user start openclaw-gateway
systemctl --user stop openclaw-gateway
systemctl --user enable openclaw-gateway
systemctl --user status openclaw-gateway
journalctl --user -u openclaw-gateway -f

If the service doesn’t start, see Troubleshooting. For what the Gateway does and which ports it uses: Architecture. Tuning: Configuration.

Browser. Skills that drive a browser (e.g. automation, screenshots) need Chromium or Chrome and often extra libraries (e.g. libnss3, libatk-bridge, libgbm). Install your distro’s chromium (or chromium-browser on older Ubuntu/Debian) and the dependencies your package manager suggests; on Debian/Ubuntu a common set is libnss3 libatk-bridge2.0-0 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 libgbm1 libasound2. If automation still fails, Browser guide has distro-specific and troubleshooting steps.

Sandboxing. You can run group or isolated sessions inside Docker for stronger isolation. You need Docker installed and configured; then session/group settings can use a sandbox profile that runs the agent in a container. Details and how to enable: Security guide.

On a server without a desktop you install over SSH: run the same Quick start or Distribution-specific commands in your SSH session, then run the Gateway as a systemd service. The Gateway listens on localhost by default (architecture), so to use the Control UI or a mobile app from your laptop or phone you forward the WebSocket port. Example: ssh -L 18789:localhost:18789 user@server, then open the UI on your local machine. For Tailscale or other remote-access patterns (tokens, bind address), see the Remote access guide.

Service won’t start. Run journalctl --user -u openclaw-gateway for errors. Confirm the unit exists at ~/.config/systemd/user/openclaw-gateway.service and run systemctl --user status openclaw-gateway. openclaw doctor checks paths and env. Often the fix is lingering sessions or a missing dependency—see the main Troubleshooting guide.

Permission errors. Ensure the user running the service owns the workspace and config dirs and can read ~/.clawdbot/credentials/. If SELinux or AppArmor is enabled, check that the OpenClaw binary and its files are allowed; relax or adjust policy as needed for your setup.

Browser automation fails. Install Chromium and the usual deps (e.g. on Ubuntu/Debian: sudo apt install -y chromium-browser libnss3 libatk-bridge2.0-0 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxfixes3 libxrandr2 libgbm1 libasound2). More: Browser guide.

Run the Gateway as the systemd user service and enable it so it starts on boot. Use journalctl --user -u openclaw-gateway -f when debugging. Keep the install and Node updated for security. Because the Gateway listens on a port (18789 by default), restrict access with a firewall if the machine is reachable from the network—prefer SSH or Tailscale for remote access instead of opening the port to the internet. See Security and Remote access for hardening and safe exposure.