Cloud Deploy
Cloud Deploy lets you provision fully managed OpenClaw instances in one click. Available on Pro, Team, and Enterprise plans.
Each instance is a dedicated Linode VM bootstrapped with cloud-init — it installs OpenClaw, the Clawkeeper agent, Runtime Shield, and a Tailscale mesh node, then locks down the firewall so the only access path is through the Clawkeeper Console.
Deploy wizard
Launch the wizard from Hosts → Deploy Cloud Instance or navigate directly to /hosts/new. The wizard has four steps:
Step 1 — Instance
| Setting | Options |
|---|---|
| Region | See Regions below |
| Plan | Small 2 GB ($20/mo), Medium 4 GB ($40/mo), Large 8 GB ($80/mo) |
| Label | Friendly name shown in the dashboard |
Step 2 — Agent
| Setting | Description |
|---|---|
| LLM provider | Anthropic, OpenAI, Google, Ollama (Local), or Ollama Cloud |
| LLM API key | Your provider API key — encrypted at rest, never logged |
| Model | Provider-specific model list (e.g. claude-sonnet-4-20250514, nemotron-3-super:cloud) |
Ollama Cloud runs inference on Ollama's GPU servers instead of the instance. This lets you deploy large models like NVIDIA Nemotron Super (120B params, 12B active MoE) or Llama 4 Scout on a standard 2 GB instance — no local GPU required. Just provide your Ollama API key; Clawkeeper automatically sets
OLLAMA_HOST=https://ollama.comso requests route to Ollama's cloud.
Step 3 — Security
| Setting | Description |
|---|---|
| Shield level | Paranoid, Strict (default), Moderate, or Minimal |
| Custom blacklist | Additional phrases to block (one per line) |
Step 4 — Review & deploy
Confirm your selections and click Deploy. The dashboard shows real-time progress as cloud-init runs through each stage.
Deploy times depend on whether a golden image is available:
| Mode | Time | When |
|---|---|---|
| Golden image (quick-init) | ~60 seconds | GOLDEN_IMAGE_ID configured in environment |
| Full cloud-init | 5–10 minutes | No golden image available |
Golden images are pre-baked Linode custom images with Node.js 22, Docker, Tailscale, fail2ban, and Clawkeeper pre-installed. Quick-init only runs per-instance configuration (hostname, secrets, gateway config, first scan).
Instance lifecycle
Once deployed, you can manage instances from the host detail page:
| Action | Description |
|---|---|
| Stop | Power off the VM. You are not billed for compute while stopped. |
| Start | Boot a stopped VM. |
| Redeploy | Destroy and recreate with the same configuration. Use this to pick up agent updates. |
| Destroy | Permanently delete the VM and all data. |
| Open Console | Connect to the instance terminal via Tailscale. See Console. |
Console
Cloud instances have no public SSH port. The only way to reach the terminal is through the Open Console button, which routes through a Tailscale mesh with JWT authentication. See the dedicated Console page for the full security model.
Security architecture
Cloud Deploy is designed with defense in depth:
- SSH hardening —
PermitRootLogin prohibit-password,PasswordAuthentication no,X11Forwarding no,MaxAuthTries 3,AllowAgentForwarding no. Applied directly to/etc/ssh/sshd_config(not drop-in configs) so the scanner sees correct values. - UFW firewall — only Tailscale interface (
tailscale0) traffic is allowed inbound. SSH (port 22) is available as a temporary fallback with key-only authentication. - Tailscale mesh — each instance joins a private tailnet. Console traffic never crosses the public internet.
- JWT authentication — console sessions require a signed JWT issued by the dashboard. Tokens expire after 1 hour.
- File permissions —
openclaw.json,.env,SOUL.md, andMEMORY.mdare set to 600 during provisioning. Skills directory is 700. - Runtime Shield — pre-installed and connected to your dashboard. Dual-layer protection covers web chat (proxy) and external channels (hook).
- Plan gating — only paid plans (Pro, Team, and Enterprise) can deploy or access cloud instances. The API rejects requests from free-tier accounts.
- Rate limits — max 3 deployments per org per hour, max 2 concurrent provisions.
- Spend cap — a $200/month hard cap on Linode spend prevents runaway costs. The cap is checked before every deploy.
Tailscale-aware checks
The Clawkeeper scanner automatically detects when Tailscale is active and skips checks that would produce false positives on cloud instances:
| Check | Cloud behavior | Why |
|---|---|---|
| Network Mode | Skipped (host networking expected) | Docker uses network_mode: host for Tailscale port access |
| gateway.bind | Skipped (bind: auto expected) | Gateway binds to all interfaces for Tailscale accessibility |
| Disk Encryption | Skipped on VPS | Cloud providers manage disk encryption at the infrastructure layer |
Regions
| Region | Location |
|---|---|
us-east | Newark, NJ |
us-west | Fremont, CA |
eu-central | Frankfurt, DE |
ap-south | Singapore |
Compute pricing
Cloud hosts are sold as an add-on — separate from seat pricing. Every host is billed monthly per unit. No hosts are bundled in any seat tier.
| Size | vCPUs | RAM | Storage | Price |
|---|---|---|---|---|
| Small | 1 | 2 GB | 50 GB | $20/mo |
| Medium | 1 | 4 GB | 80 GB | $40/mo |
| Large | 2 | 8 GB | 160 GB | $80/mo |
Stopped instances are not billed for compute.
Enterprise plans qualify for volume pricing on cloud hosts (discounted rates at 20+ hosts). Contact sales for details.
Plan limits
| Pro | Team | Enterprise | |
|---|---|---|---|
| Seat pricing | $19/mo | $29/seat/mo (min 3) | Custom |
| Cloud hosts | Add-on ($20-$80/mo) | Add-on ($20-$80/mo) | Volume pricing |
| Agents per instance | 5 | 10 | Unlimited |
| Console | Yes | Yes | Yes |
| Regions | All | All | All |
Free accounts cannot deploy cloud instances. Upgrade to a paid plan to get started.
FAQ
Can I SSH into my instance?
SSH is available over Tailscale for emergency access, but the primary access method is the Open Console button in the dashboard. Password authentication is disabled — only key-based SSH is allowed. The firewall blocks all public inbound traffic except through the Tailscale interface.
What happens if provisioning fails?
The instance is automatically destroyed and you are not charged. The dashboard shows the failure reason in the instance activity log. Common causes: invalid LLM API key, region capacity, or Linode API errors.
Is my LLM API key safe?
Your LLM API key is encrypted at rest in the database and injected into the instance via cloud-init user data over HTTPS. It is never logged or exposed in the dashboard UI.
Can free accounts use Cloud Deploy?
No. Cloud Deploy requires a Pro ($19/mo), Team ($29/seat/mo, min 3 seats), or Enterprise plan. The CLI scanner remains free and unlimited. Cloud hosts are sold as an add-on — see pricing above.