Get started
How-to guides
Reference
Concepts
Self-host gallery
AppendixDeploy it
Security and requirements
Level: Standard. The template has no privileged-container finding. What this template needs:- Publishes ports directly on the host (
openclaw-gateway): 18789:18789. - Passwords and keys are generated at deploy time (
openclaw-gateway): OPENCLAW_GATEWAY_TOKEN. - Stores data in named volumes (
openclaw-gateway): openclaw_data.
--bind lan) and passes --allow-unconfigured, so it starts without a completed setup. Use the generated gateway token for any client that connects to it.
What Levelrail adds
- HTTPS and an ingress filter in front of any domain you attach. See domains and ingress and the firewall.
- Secrets stored encrypted and masked in logs and the UI, including the gateway token. See environment variables and secrets.
- Volume backups for
openclaw_data, which holds the gateway state and workspace. See backups and storage. - Health-gated deploys. The gateway has a health check, and a release takes traffic only after it passes. See deploy safety.
- Rollback to the previous image. See deploying apps.
What a raw docker compose misses
18789:18789is published on the host. The gateway is reachable directly unless you filter it.- The gateway token is a
$SERVICE_HEX_32_GATEWAYTOKENplaceholder. Plain Docker Compose cannot resolve it, so you would generate and store the token yourself. - Compose does not back up
openclaw_data, so the agent state and workspace exist on one disk. - Compose has no rollback to an earlier revision.
Next steps
- Control Levelrail from OpenClaw to give the agent a least-privilege token.
- Backups and storage for
openclaw_data, then prove your backups work. - Template reference for OpenClaw for the full service table.
- All guides.