Production Docker Deployment: From Single Container to Kubernetes
Docker is the recommended deployment method for production OpenClaw instances. This guide covers everything from a simple single-container setup to multi-service Docker Compose stacks with GPU passthrough, health monitoring, and Kubernetes scaling.
Why Docker for AI Agent Deployment?
Running AI agents in production requires reliability, reproducibility, and isolation. According to Docker's 2026 State of Application Development survey, 89% of organizations now use containers for AI/ML workloads, up from 67% in 2024. Docker provides consistent environments across development, staging, and production, eliminating "works on my machine" deployment failures.
For OpenClaw specifically, Docker solves several critical challenges: dependency isolation (Node.js, Python, Ollama all have different requirements), security sandboxing (restricting filesystem and network access), reproducible deployments (identical behavior across VPS providers), and zero-downtime updates via rolling container replacements.
Deployment Architectures
| Architecture | Best For | Complexity | Min Resources |
|---|---|---|---|
| Single Container | Personal use, testing | Low | 2 cores, 4GB RAM |
| Docker Compose (2 services) | Small teams, production | Medium | 4 cores, 16GB RAM |
| Compose + GPU (3 services) | Local inference | Medium-High | 4 cores, 16GB RAM + GPU |
| Kubernetes (multi-node) | Enterprise, high-availability | High | 3 nodes, 8 cores each |
Quick Start: Single Container
# Single container — simplest production deployment docker run -d \ --name openclaw \ --restart unless-stopped \ -v openclaw-data:/data \ -v openclaw-logs:/logs \ -e ANTHROPIC_API_KEY=sk-ant-xxx \ -e TELEGRAM_BOT_TOKEN=xxx \ -p 3100:3100 \ openclaw/openclaw:latest
Production: Docker Compose with Ollama
# docker-compose.yml — production stack
version: '3.8'
services:
openclaw:
image: openclaw/openclaw:latest
restart: unless-stopped
volumes:
- openclaw-data:/data
- openclaw-logs:/logs
- ./openclaw.config.yaml:/app/openclaw.config.yaml:ro
environment:
- OLLAMA_HOST=http://ollama:11434
- TELEGRAM_BOT_TOKEN=${TELEGRAM_BOT_TOKEN}
ports:
- "3100:3100"
depends_on:
ollama:
condition: service_healthy
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:3100/health"]
interval: 30s
timeout: 10s
retries: 3
ollama:
image: ollama/ollama:latest
restart: unless-stopped
volumes:
- ollama-models:/root/.ollama
deploy:
resources:
reservations:
devices:
- driver: nvidia
count: 1
capabilities: [gpu]
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:11434/api/tags"]
interval: 30s
timeout: 5s
volumes:
openclaw-data:
openclaw-logs:
ollama-models:Security Hardening for Production
Production deployments require additional security layers beyond the default configuration:
Network isolation
Use Docker networks to isolate OpenClaw from the host network. Only expose necessary ports (3100 for web UI, nothing else).
Read-only filesystem
Mount the config file as read-only (:ro). Use tmpfs for temporary directories.
Non-root user
OpenClaw containers run as non-root by default since v2026.4.0. Verify with docker exec openclaw whoami.
Secret management
Never hardcode API keys in docker-compose.yml. Use Docker secrets, .env files (chmod 600), or external secret managers like Vault.
Rate limiting
Deploy behind a reverse proxy (Caddy, Nginx, Traefik) with rate limiting to prevent abuse.
Monitoring and Maintenance
Production deployments need observability. OpenClaw exposes a /health endpoint and Prometheus metrics at /metrics (since v2026.4.15). Key metrics to monitor:
| Metric | Alert Threshold | Action |
|---|---|---|
| openclaw_response_time_p95 | > 10s | Check LLM provider latency or upgrade model |
| openclaw_memory_usage_bytes | > 80% RAM | Scale up or optimize memory config |
| openclaw_error_rate | > 5% | Check logs, likely API key or provider issue |
| openclaw_dreaming_cycle_duration | > 600s | Reduce max_entries_per_cycle in config |
| ollama_gpu_utilization | > 95% sustained | Model too large for GPU, consider quantization |
Frequently Asked Questions
What is the minimum server spec for Docker deployment?
Minimum: 2 CPU cores, 4GB RAM, 20GB disk for OpenClaw gateway only. With Ollama for local inference: 4 cores, 16GB RAM, 40GB disk. GPU passthrough requires NVIDIA Container Toolkit.
Can I run OpenClaw and Ollama in the same container?
You can, but it's not recommended for production. Use separate containers via Docker Compose for isolation, independent scaling, and easier updates.
Does OpenClaw support GPU passthrough in Docker?
Yes. As of v2026.4.24, OpenClaw supports NVIDIA GPU passthrough via the NVIDIA Container Toolkit. Configure --gpus all in your Docker run command or deploy section in docker-compose.yml.
How do I backup my OpenClaw data in Docker?
Mount persistent volumes for /data (memory, config) and /logs. Use docker volume backup strategies or bind mounts to host directories for automated backup with rsync or restic.
Key Takeaways
Docker Compose for most users
The 2-service Compose stack (OpenClaw + Ollama) covers 90% of production use cases.
GPU passthrough since v2026.4.24
NVIDIA Container Toolkit enables local inference inside Docker with full GPU acceleration.
Health checks are critical
Configure healthcheck endpoints for both OpenClaw and Ollama to enable automatic container restart on failure.
89% of AI workloads use containers
Docker is the industry standard for AI deployment — not optional for production.
▶ Continue Reading
Last updated: May 2, 2026 · Sources: Docker 2026 State of Development Survey, OpenClaw Docker documentation, NVIDIA Container Toolkit docs