How to Run OpenClaw on a Virtual Machine: Safe, Isolated AI Employee Deployment (2026)

Why Run OpenClaw on a Virtual Machine?

The question comes up often in the OpenClaw community: can I run OpenClaw on a virtual machine, and is it safe? The answer is yes on both counts. A VM is not just a viable option, it is often the smartest one for users who want a clean, isolated deployment.

Here is why a VM makes sense for OpenClaw:

VM Platform Options

Several hypervisor platforms work well with OpenClaw. Choose based on your OS, budget, and whether you need local or cloud-hosted isolation.

For most users getting started, VirtualBox is the right pick. It is free, runs on every major OS, and has strong snapshot support. VMware offers better performance and Apple Silicon native support if you are on a Mac. Proxmox is ideal if you want to run several VMs from a dedicated box at home. Cloud VMs (covered later) solve the always-on requirement without any local hardware.

Step-by-Step: Ubuntu 22.04 VM Setup for OpenClaw

Ubuntu 22.04 LTS is the recommended guest OS. It has long-term support, works well with Docker, and is the most tested environment for Node.js workloads. These steps use VirtualBox, but the OpenClaw setup commands are identical on any Ubuntu 22.04 VM.

1. Create the VM

Open VirtualBox and create a new VM with these settings:

Type: Linux
Version: Ubuntu (64-bit)
RAM: 2048 MB minimum (4096 MB recommended)
CPU: 2 cores minimum (4 recommended)
Disk: 25 GB (dynamically allocated VDI)
Network: NAT (change to Host-Only after setup if no internet needed)

Download the Ubuntu 22.04 LTS server ISO from ubuntu.com and attach it as the boot disk. Complete the standard Ubuntu installation, choosing minimal server install with OpenSSH server enabled.

2. Install Node.js and OpenClaw

SSH into the VM or use the VirtualBox terminal directly. Run the following to install Node.js 20 LTS and OpenClaw:

# Update and install prerequisites
sudo apt update && sudo apt upgrade -y
sudo apt install -y curl git build-essential

# Install Node.js 20 LTS via NodeSource
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install -y nodejs

# Verify installation
node --version   # should be v20.x
npm --version

# Install OpenClaw globally
npm install -g openclaw

# Verify OpenClaw
openclaw --version

3. Create Your First Agent

Create a workspace directory and set up an agent configuration:

# Create agent workspace
mkdir -p ~/agents/assistant
cd ~/agents/assistant

# Create environment file
cat > .env << 'EOF'
ANTHROPIC_API_KEY=sk-ant-your-key-here
OPENCLAW_GATEWAY_TOKEN=your-secure-token
EOF

# Create SOUL.md (agent configuration)
cat > SOUL.md << 'EOF'
## Identity
- Name: Assistant
- Role: General-purpose AI employee

## Personality
- Helpful, concise, and professional

## Skills
- browser: Research topics on the web

## Rules
- Always confirm before taking irreversible actions
- Stay within the scope of assigned tasks
EOF

4. Register and Start the Agent

# Register the agent with OpenClaw
openclaw agents add --name assistant --path ~/agents/assistant

# Start the gateway
openclaw gateway start

# Verify agents are registered
openclaw agents list

# Test the agent
openclaw agent --agent assistant --message "Hello, are you running?"

# (Optional) Start gateway as a background service
nohup openclaw gateway start > ~/openclaw-gateway.log 2>&1 &

5. Take a Snapshot Before Going Further

With OpenClaw installed and an agent running, this is an excellent time to take a VM snapshot. In VirtualBox, go to Machine > Take Snapshot and name it something like openclaw-base-install. Any time you make a major change and want to experiment safely, clone this snapshot instead of modifying your working environment.

Security Settings Specific to VM Deployments

Running OpenClaw in a VM gives you extra security levers that do not exist on bare-metal deployments. Use them.

Network Isolation Modes

VirtualBox and VMware offer several network adapter types. Each changes what traffic the VM can send and receive:

For NAT mode, configure port forwarding in VirtualBox to reach the OpenClaw gateway from your host machine:

# VBoxManage command equivalent
# Settings > Network > Adapter 1 > Port Forwarding
Name: openclaw-gateway
Protocol: TCP
Host IP: 127.0.0.1
Host Port: 18789
Guest IP: (leave empty)
Guest Port: 18789

# After this rule, access the gateway from your host at:
# http://127.0.0.1:18789

Resource Limits

Set hard resource caps in the VM settings to prevent any runaway agent process from consuming your host machine's resources:

# Limit CPU execution cap to 80% per core
VBoxManage modifyvm "YourVMName" --cpuexecutioncap 80

# Set CPU count
VBoxManage modifyvm "YourVMName" --cpus 2

# Set RAM
VBoxManage modifyvm "YourVMName" --memory 2048

# Limit disk I/O bandwidth (in MB/s)
VBoxManage bandwidthctl "YourVMName" add DiskLimit --type disk --limit 50M

Snapshot Strategy

A disciplined snapshot routine costs almost nothing and saves hours when things go wrong:

Snapshot 1: "base-ubuntu"      # Clean Ubuntu install, before OpenClaw
Snapshot 2: "openclaw-install"  # OpenClaw installed, no agents configured
Snapshot 3: "agents-configured" # Agents registered, gateway tested, working
Snapshot 4: "before-upgrade"    # Taken before every OpenClaw version update

# Restore from snapshot in VirtualBox
VBoxManage snapshot "YourVMName" restore "agents-configured"

Local VMs vs Cloud VPS: When Each Makes Sense

Both approaches run OpenClaw in an isolated environment, but they serve different use cases. Here is a direct comparison:

The practical workflow many users follow: develop and test agent configurations on a local VM, then export the working SOUL.md and config files to a VPS for production deployment. The local VM acts as a safe scratch pad; the VPS is where the agent goes live.

For VPS options, providers like Hetzner (starting at around $4/mo) and DigitalOcean (starting at $6/mo) offer Ubuntu 22.04 droplets that work out of the box with OpenClaw. The setup commands are identical to the local VM instructions above.

Alternative: Skip the VM Entirely with CrewClaw

If your goal is to get an AI employee running without managing VMs, snapshots, port forwarding, and system updates, CrewClaw is the shortcut. CrewClaw generates a complete, production-ready OpenClaw agent package, including SOUL.md, config files, Dockerfile, docker-compose setup, and a setup script, all ready to deploy to any server in one command.

You configure your agent in the browser (choose a role, set channels, define behavior), download the deploy package, and run the setup script on your VM or VPS. No Docker expertise required, no configuration file syntax to learn, no manual dependency management.

The generated package includes:

your-agent/
  SOUL.md              # Agent identity, skills, rules
  config.yaml          # OpenClaw configuration
  Dockerfile           # Container build file
  docker-compose.yml   # Service orchestration
  setup.sh             # One-command deploy script
  .env.example         # Environment variable template
  package.json         # Dependencies
  README.md            # Your specific setup instructions

On a fresh Ubuntu VM or VPS, the entire deploy process takes under five minutes:

# Upload and run the setup script
scp -r your-agent/ user@your-vm-ip:~/
ssh user@your-vm-ip
cd your-agent
chmod +x setup.sh && ./setup.sh

# Your AI employee is running

Troubleshooting Common VM Issues with OpenClaw

Most VM-specific issues fall into three categories: network connectivity, port access, and resource constraints. Here are the most common ones and how to fix them.

Cannot reach the gateway from the host machine

If you are using NAT mode and the gateway is not reachable from your host, port forwarding is likely missing or misconfigured. Verify with:

# Inside the VM: confirm gateway is running and bound correctly
ss -tlnp | grep 18789
# Expected: LISTEN 0 511 0.0.0.0:18789 or 127.0.0.1:18789

# From your host machine: test the forwarded port
curl -s http://127.0.0.1:18789/health
# Expected: {"status":"ok"} or similar

# If nothing responds, check VirtualBox port forwarding rule is saved
# and the VM was restarted after adding the rule

OpenClaw agent not responding

# Check if the gateway process is running
ps aux | grep openclaw

# Check gateway logs
cat ~/openclaw-gateway.log

# Restart the gateway
openclaw gateway stop
openclaw gateway start

# Re-list agents to confirm they are registered
openclaw agents list

VM is too slow or unresponsive

If the VM feels sluggish, check resource allocation and whether hardware virtualization is enabled:

# Inside VM: check resource usage
htop           # interactive CPU/RAM monitor
df -h          # check disk usage

# In VirtualBox settings (VM must be powered off):
# System > Processor > Enable PAE/NX
# System > Acceleration > Enable VT-x/AMD-V
# Increase RAM to 4096 MB if available

# On the host, ensure virtualization is enabled in BIOS
# Intel: VT-x | AMD: AMD-V

Agent cannot reach the LLM API

If your VM is in Host-Only mode, it has no internet access, which means cloud LLM APIs will fail. Either switch to NAT mode or use a local model:

# Test internet connectivity from inside the VM
curl -s https://api.anthropic.com
# If this hangs or fails: network mode is Host-Only or NAT with no DNS

# Switch to NAT in VirtualBox:
# Settings > Network > Adapter 1 > Attached to: NAT
# Restart VM

# Or use Ollama for local inference (no internet needed)
sudo apt install -y ollama
ollama pull llama3.2
# Then configure SOUL.md to use ollama provider

Frequently Asked Questions