Cloud Deploy Tutorial

Deploy a fully managed, hardened AI agent or Claude Code VM and connect to it through the Tailscale-backed web console — no SSH, no VPN, no firewall rules.

Prerequisites

Create a Clawkeeper account

Upgrade to Pro

Cloud Deploy requires a paid plan (Pro, Team, or Enterprise). Go to Settings and click Upgrade to Pro ($19/mo, or $15/mo annual).

Already on Pro?

Skip this step. Cloud hosts are sold as an add-on on any paid plan — starting at $20/mo for Small, $40/mo Medium, $80/mo Large.

Have your LLM API key ready

Cloud instances need an LLM provider key. For AI agents, grab a key from your provider (Anthropic, OpenAI, Google, or Ollama Cloud). For Claude Code VMs, you'll need an Anthropic API key.

No GPU? Try Ollama Cloud

Ollama Cloud runs inference on Ollama's GPU servers so you don't need a beefy local instance. Deploy models like NVIDIA Nemotron Super (120B MoE) or Llama 4 Scout on a standard 2GB instance — just bring your Ollama API key.

Deploy an Instance

Open the deploy wizard

Navigate to Hosts → Deploy Cloud Instance or click the + Deploy button on the hosts page.

Choose your deployment type

The first step is selecting what you want to deploy:

AI Agent — Deploy a managed OpenClaw, NemoClaw, or NanoClaw agent with web console, messaging channels, and Runtime Shield.
Claude Code VM — Deploy a hardened Ubuntu VM with Claude Code CLI pre-installed, Clawkeeper hooks pre-wired, and web terminal access. Ideal for teams that want managed, secure Claude Code environments. Requires 4GB+ RAM.
Connect Workstations — Add Clawkeeper security hooks to your team's existing Claude Code installations without deploying a VM.

Not sure which to pick?

Start with OpenClaw for general-purpose AI agents. Choose Claude Code VM if your team uses Claude Code and wants a managed, hardened environment. Choose NemoClaw for enterprise guardrails or PII protection. See the Claude Code VM, NemoClaw and NanoClaw tutorials for details.

Configure the instance

Choose a region close to you, a compute plan (Small at $20/mo is fine for getting started), and give the instance a friendly label.

Tip

The 2GB instance (1 vCPU, 2 GB RAM) is enough for OpenClaw and NanoClaw. NemoClaw and Claude Code VMs auto-select a 4GB+ instance.

Configure the agent

Select your LLM provider, paste your API key, and choose a model. Your key is encrypted at rest and never logged. Supported providers: Anthropic, OpenAI, Google, Ollama (local), and Ollama Cloud.

Ollama Cloud vs Ollama (Local)

Ollama (Local) installs Ollama on the instance and pulls a model — requires a larger instance with enough RAM. Ollama Cloud sends inference to Ollama's GPU servers, so even the smallest 2GB instance works. Choose Ollama Cloud if you want to run large models like Nemotron Super without paying for a high-memory VM.

Configure security settings

Pick a Shield level (Strict is recommended for most users) and optionally add custom blacklist phrases. OpenClaw and NemoClaw instances get Runtime Shield pre-installed. NanoClaw instances rely on container isolation instead.

Review and deploy

Confirm your selections on the review screen and click Deploy. The dashboard shows real-time progress as cloud-init runs through each stage:

VM creation and boot
SSH hardening (key-only auth, no root passwords, no X11)
System packages and OpenClaw installation
Clawkeeper agent and Runtime Shield setup
Tailscale mesh join and firewall lockdown
File permission hardening and first security scan

Golden image = faster deploys

When a golden image is available, provisioning takes under 60 seconds instead of 5-10 minutes. The golden image has Node.js, Docker, Tailscale, and Clawkeeper pre-installed — only per-instance config is needed.

Connect to Your Instance

Open the console

Once status shows Ready, click Open Console on the host detail page. A browser-based terminal opens with full access to your instance — no SSH keys or VPN needed.

How it works

The console routes through a Tailscale mesh with JWT authentication. There are no public SSH ports — see the documentation for the full security model.

Monitor and manage from the dashboard

Your cloud instance reports scans automatically. The host detail page has 3 tabs:

Overview — shield status, security advisor, score history, scan history
Checks — phase sub-tabs with detailed pass/fail results
Monitoring — agents, shield events, and metrics

Cloud instances also get a Manage tab where you can edit agent instructions (SOUL.md), manage skills, and add messaging channels — all without SSH access.

Automate these checks with Clawkeeper

One command scans your entire OpenClaw deployment and gives you an A-F security grade.