Deploy OpenClaw on Pethost in one click

What happens

1. You sign in to Pethost or make an account, with a passkey, GitHub or Google.
2. No machine yet? You pick a plan, and we prepare one for you. The link waits in your browser until it is ready.
3. New project opens at the app. You fill in what it asks for and click Create project: OpenAI API key (optional), Anthropic API key (optional).
4. In a minute or two the app is live at its own address with HTTPS. Its secrets are made for it at random, and its data is in the nightly backup.
5. It is a project like any other: its compose.yaml, its .env, its logs and a terminal are in the panel, and your agent can change it, roll it back or restore it.

First steps

Open the address and paste the gateway token into Gateway secret: it is OPENCLAW_GATEWAY_TOKEN in the project’s .env. Then approve the browser once in the openclaw service’s terminal: openclaw devices list, then openclaw devices approve <requestId>. A model’s key is added under Settings, Models.

What it runs

The template is this compose.yaml and the variables it writes into the project’s .env. Pethost runs the file as it is written.

services:
  openclaw:
    image: ghcr.io/openclaw/openclaw:2026.10.3
    restart: unless-stopped
    environment:
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
      OPENAI_API_KEY: ${OPENAI_API_KEY:-}
      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
    # The gateway answers 403 until its config names the proxy's network and the
    # origin the Control UI is opened from, and it has no flag or variable for
    # either. So the config is written once, into the state volume, where the app
    # keeps and rewrites it; then the image's own entrypoint starts the gateway.
    command:
      - sh
      - -c
      - |
        set -e
        cfg=/home/node/.openclaw/openclaw.json
        if [ ! -s "$$cfg" ]; then
          cat > "$$cfg" <<'JSON'
        {
          "gateway": {
            "mode": "local",
            "bind": "lan",
            "auth": { "mode": "token" },
            "trustedProxies": ["10.192.0.0/10"],
            "controlUi": { "allowedOrigins": ["${CONTROL_UI_ORIGIN}"] }
          }
        }
        JSON
          chmod 600 "$$cfg"
        fi
        if [ -f /app/docker-entrypoint.mjs ]; then
          exec node /app/docker-entrypoint.mjs node openclaw.mjs gateway --allow-unconfigured --bind lan --port 18789
        fi
        exec node openclaw.mjs gateway --allow-unconfigured --bind lan --port 18789
    volumes:
      - state:/home/node/.openclaw
      - auth-keys:/home/node/.config/openclaw
    # The image's own check runs every 3 minutes, so a deploy would wait that long.
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:18789/healthz').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 5m
      start_interval: 5s

volumes:
  state:
  auth-keys:

compose.yamlSee it on GitHub