Production Deployment & Operations

+15 Mana ✨

Introduction

Deploying an OpenClaw gateway to production involves choosing a hosting platform, configuring monitoring, managing credentials securely, and setting up log redaction to prevent sensitive data leaks. This lesson covers the operational concerns that keep a production gateway reliable and secure.

Key Concepts

  • Multi-Gateway Setup: Running multiple OpenClaw gateways for high availability or workload isolation, each handling different agents or teams.
  • Log Redaction: Automatically stripping sensitive information from gateway logs. Controlled by logging.redactSensitive (defaults to "tools") and logging.redactPatterns for custom token patterns.
  • Credential Rotation: The process of replacing authentication credentials on a schedule using openclaw credentials rotate to limit the blast radius of a compromised key.
  • Session Transcripts: Complete records of agent interactions stored at ~/.openclaw/agents/<agentId>/sessions/*.jsonl, which accumulate over time and should be pruned.
  • Health Checks: The openclaw status and openclaw doctor commands for verifying gateway health and diagnosing configuration issues.

Real World Context

A fintech company runs OpenClaw to automate compliance document processing. They deploy on Kubernetes in GCP with three gateways handling different regulatory domains. Log redaction is critical because agent conversations may reference customer financial data. Credential rotation runs weekly via a cron job, and session transcripts are pruned after 30 days to comply with data retention policies.

Deep Dive

Deployment Platforms

OpenClaw gateways can be deployed on several platforms. Docker is the most common starting point:

bash
docker run -d \
  --name openclaw-gateway \
  -p 18789:18789 \
  -v openclaw-data:/root/.openclaw \
  openclaw/gateway:latest

This command starts the gateway in a detached container, maps port 18789, and mounts a volume for persistent data. The volume ensures configuration, credentials, and session transcripts survive container restarts.

For Kubernetes deployments on GCP or Hetzner, you define a Deployment and Service:

yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: openclaw-gateway
spec:
  replicas: 1
  selector:
    matchLabels:
      app: openclaw-gateway
  template:
    metadata:
      labels:
        app: openclaw-gateway
    spec:
      containers:
        - name: gateway
          image: openclaw/gateway:latest
          ports:
            - containerPort: 18789
          volumeMounts:
            - name: data
              mountPath: /root/.openclaw
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: openclaw-pvc

This Kubernetes manifest creates a single-replica deployment with a persistent volume claim. For multi-gateway setups, increase the replica count or deploy separate Deployments with different configurations.

Cloud platforms like Fly.io, Railway, and Render also support OpenClaw. These platforms simplify deployment by handling container orchestration, but you should ensure they support persistent volumes and WebSocket connections.

Local deployment is also fully supported and is often used for development or single-user setups.

Monitoring

Two CLI commands form the core of gateway monitoring:

bash
openclaw status

This command displays the current gateway state, including uptime, connected nodes, active agents, and resource usage. It is the first command to run when investigating issues.

bash
openclaw doctor

The doctor command performs a comprehensive health check, verifying configuration files, database connectivity, credential validity, and node connections. It reports issues with suggested fixes.

In multi-gateway setups, run these commands against each gateway to get a complete picture of system health.

Log Redaction

Production gateways handle sensitive data that must not appear in logs. The logging.redactSensitive setting controls automatic redaction:

json
{
  "logging": {
    "redactSensitive": "tools"
  }
}

The default value is "tools", which redacts sensitive content from tool invocation logs (such as arguments and results) while leaving general agent conversation logs intact. This balances debuggability with security.

For custom redaction patterns, use logging.redactPatterns:

json
{
  "logging": {
    "redactSensitive": "tools",
    "redactPatterns": [
      "sk-[a-zA-Z0-9]{32,}",
      "ghp_[a-zA-Z0-9]{36}"
    ]
  }
}

This configuration adds regex patterns that match API keys (like OpenAI keys starting with sk-) and GitHub personal access tokens. Any log line matching these patterns has the token replaced with [REDACTED].

Credential Rotation

Credentials should be rotated regularly to limit exposure from potential leaks:

bash
openclaw credentials rotate

This command generates new credentials, updates the gateway configuration, and invalidates the old credentials. Connected nodes and clients will need to re-authenticate with the new credentials.

For backup strategies, export your current configuration before rotation:

bash
cp -r ~/.openclaw/credentials ~/.openclaw/credentials.backup.$(date +%Y%m%d)

This creates a dated backup of the credentials directory. Store these backups in a secure, encrypted location outside the gateway machine.

Session Transcript Management

Agent session transcripts accumulate at ~/.openclaw/agents/<agentId>/sessions/*.jsonl. Each session creates a new JSONL file containing the complete interaction history:

bash
ls ~/.openclaw/agents/*/sessions/

This command lists all session files across all agents. Over time, these files consume significant disk space. Prune old session files based on your data retention policy:

bash
find ~/.openclaw/agents/*/sessions/ -name '*.jsonl' -mtime +30 -delete

This deletes session files older than 30 days. Adjust the -mtime value according to your retention requirements. Consider archiving transcripts to object storage before deletion if you need long-term access.

Common Pitfalls

  • Not mounting a persistent volume in Docker/Kubernetes: Without persistent storage, configuration, credentials, and session transcripts are lost on container restart.
  • Leaving logging.redactSensitive disabled in production: Sensitive tool arguments and results will appear in plain text in logs, creating a security risk.
  • Never pruning session transcripts: JSONL files accumulate indefinitely and can fill disk space, eventually causing the gateway to fail.

Best Practices

  • Automate credential rotation with a cron job or CI pipeline that runs openclaw credentials rotate on a weekly or monthly schedule.
  • Set up alerting on openclaw doctor failures by running the health check in a monitoring system and alerting when it reports errors.
  • Archive session transcripts to object storage before pruning so you retain an audit trail without consuming local disk space.

Summary

  • OpenClaw gateways can be deployed on Docker, Kubernetes (GCP/Hetzner), Fly.io, Railway, Render, or locally.
  • Monitor gateway health with openclaw status for quick checks and openclaw doctor for comprehensive diagnostics.
  • Log redaction defaults to "tools" via logging.redactSensitive and supports custom patterns via logging.redactPatterns.
  • Rotate credentials regularly with openclaw credentials rotate and maintain encrypted backups.
  • Prune session transcripts at ~/.openclaw/agents/<agentId>/sessions/*.jsonl to prevent disk exhaustion.
  • Next steps: OpenClaw's ecosystem extends far beyond what this course covers. Skills and the ClawHub skill registry let you teach your agent new capabilities. The SOUL.md and AGENTS.md bootstrap files let you customize your agent's personality and behavior. And the Lobster workflow runtime enables deterministic automation pipelines. These topics are covered in the follow-up courses.
✓ Completed