I wanted to let a few friends get a hosted OpenClaw setup without each of them dealing with Docker, reverse proxy, SSL certs, etc. So I built a small toolkit that turns one Linux box into a multi-tenant hosting setup. Each person gets their own isolated instance on a unique subdomain.
What each person gets:
1. Their own OpenClaw dashboard.
2. A password-protected web terminal (HMAC tokens, 24h TTL)
3. Isolated CPU, memory, and PID limits so one person can't take down the box
Stack: Docker containers + Traefik for routing and auto SSL (Let’s Encrypt DNS-01) + a tiny forward-auth service (~90 lines of JS) for terminal token validation.
You can try it locally with one command, no server needed.
That spins up 2 instances on localhost using localtest.me. For real server deploys, there’s a provision script that sets up Docker + Traefik and a create-instance script to add more users and give them their own OpenClaws.
Rough sizing: each instance needs ~4 GB RAM, so an 8 GB VPS fits ~2, 16 GB fits ~4, etc. If you’ve already got a VPS sitting around, you just need a domain pointed at it (wildcard DNS A record) and the provision script handles the rest: installs Docker, sets up Traefik, automates SSL. Way cheaper than managed OpenClaw hosting and you actually own the infra.
Open to hearing feedback, anyone else self-hosting this vs using managed hosting?
This is a neat idea, especially for people who already have a VPS lying around. I like that you didn’t try to hide the complexity behind too much magic. The sizing notes are useful. Curious how painful upgrades are once multiple tenants are running.
FWIW the RAM number varies a lot depending on what you enable.
If you’re mostly using OpenClaw as a “gateway + chat UI” that calls hosted model APIs, and you’re not running a headful browser / local models / heavy indexing, you can often get by with much less than 4GB.
Where it gets chunky is when each tenant has its own Chromium instance, lots of background workers, or you’re doing anything that keeps long-lived context/caches around. In a multi-tenant setup I’d start conservative, but it’s worth measuring with cgroup limits and seeing what your actual p95 looks like.
It's the damn chromium instances that chugs memory like an Irish man chugs beer. I experimented launching containers with it and quickly realized the tiny shared infra hosts are not a good fit. We're launching a higher prized plan that has more memory for such things.
9 comments
[ 4.7 ms ] story [ 35.4 ms ] threadWhat each person gets:
1. Their own OpenClaw dashboard. 2. A password-protected web terminal (HMAC tokens, 24h TTL) 3. Isolated CPU, memory, and PID limits so one person can't take down the box
Stack: Docker containers + Traefik for routing and auto SSL (Let’s Encrypt DNS-01) + a tiny forward-auth service (~90 lines of JS) for terminal token validation.
You can try it locally with one command, no server needed.
That spins up 2 instances on localhost using localtest.me. For real server deploys, there’s a provision script that sets up Docker + Traefik and a create-instance script to add more users and give them their own OpenClaws.
Rough sizing: each instance needs ~4 GB RAM, so an 8 GB VPS fits ~2, 16 GB fits ~4, etc. If you’ve already got a VPS sitting around, you just need a domain pointed at it (wildcard DNS A record) and the provision script handles the rest: installs Docker, sets up Traefik, automates SSL. Way cheaper than managed OpenClaw hosting and you actually own the infra.
Open to hearing feedback, anyone else self-hosting this vs using managed hosting?
If you’re mostly using OpenClaw as a “gateway + chat UI” that calls hosted model APIs, and you’re not running a headful browser / local models / heavy indexing, you can often get by with much less than 4GB.
Where it gets chunky is when each tenant has its own Chromium instance, lots of background workers, or you’re doing anything that keeps long-lived context/caches around. In a multi-tenant setup I’d start conservative, but it’s worth measuring with cgroup limits and seeing what your actual p95 looks like.
It's the damn chromium instances that chugs memory like an Irish man chugs beer. I experimented launching containers with it and quickly realized the tiny shared infra hosts are not a good fit. We're launching a higher prized plan that has more memory for such things.