Install OpenClaw hardened. In minutes.
OpenClaw is an always-on AI agent in your WhatsApp. Powerful. Dangerous when misconfigured. AUTOCLAWD installs it right: containerized, never exposed, with rollback.
One-time payment · Official image · Verifiable checksum
$ curl -fsSL https://autoclawd.io/i | bash
▸ Detecting system… OK
▸ Container engine… ready
▸ bind 127.0.0.1 ✓ sandbox ✓
▸ Secrets sanitized ✓
▸ Rollback armed ✓
✓ OpenClaw running. Hardened.
42,900
OpenClaw gateways exposed on the internet (2026 scan)
9.9
max CVSS of the CVEs the installer mitigates
~0.3%
container escape on rootless Podman (vs ~12% Docker)
7 phases
of hardened install, with full rollback
The "easy way" leaves you exposed.
Most people run npx and leave the gateway open to the world. That's how 42,900 boxes ended up exposed.
Open to the internet
Bound to 0.0.0.0, the port is exposed. Anyone can find it.
Sandbox off
Without isolation, a malicious skill runs commands on your machine.
Secrets in the open
API keys in logs, tokens never rotated, and nothing to revert on failure.
Expert-grade security. Beginner-grade effort.
One command. AUTOCLAWD applies the hardening you'd do by hand — without you knowing security.
Containerized
Runs isolated in Docker or Podman. Never loose on your system.
Bound to loopback
Listens only on 127.0.0.1. Not exposed to the internet.
Mandatory sandbox
Every agent isolated. cap_drop ALL and no-new-privileges.
Secret hygiene
Token shown once. Your API keys never touch the log.
Official image
Only ghcr.io/openclaw/openclaw. No third-party binaries.
Rollback on failure
If something breaks, it reverts everything. You're never left half-done.
Five steps. Zero guesswork.
The installer does the heavy lifting and guides you through what only you can do.
Detects your system
Checks OS, resources and permissions before touching anything.
Installs the engine
Docker or Podman, per your profile. No root daemon on PyME.
Configures hardened
Token, masked API keys and firewall. All locked down.
Deploys and connects
Brings up the container and connects your channel. Telegram with auto-pairing.
Audits and summarizes
Runs the security audit and leaves you a clear summary.
And if something fails, it reverts itself.
trap cleanup undoes packages, directories, firewall and containers. You're never left half-done.
For your machine or for production?
Two profiles. The same hardening. Choose by where it runs.
Hogareño
You want your 24/7 agent without getting hacked.
- Your always-on AI assistant
- On your machine or VPS
- Docker, simple and direct
- Ready in minutes
Técnico / PyME
You put it in production and it has to survive an audit.
- Rootless Podman, no daemon
- nftables that blocks lateral movement
- SELinux and isolated network
- Defensible in front of clients
Choose your profile.
One-time payment. No subscription. The same hardening in both.
Hogareño
Your 24/7 agent, hardened, on your machine.
- install-openclaw-docker.sh installer
- Docker Engine + hardened compose
- Loopback bind + mandatory sandbox
- cap_drop ALL + no-new-privileges
- Secret hygiene (token and keys protected)
- Full rollback on failure
- Automated Telegram pairing
- Quick-start + SHA256 checksum
Técnico / PyME
OpenClaw in production, audit-defensible.
Everything in Hogareño, plus:
- install-openclaw-podman.sh installer
- Rootless Podman (no daemon, no root)
- Quadlet (systemd) + auto-update
- Isolated claw-net network
- nftables: blocks lateral movement to the LAN
- Native SELinux
- Reinforced security audit
- One-time payment. No subscription. No per-seat fees.
- Lifetime access to your tier's installer + verifiable checksum.
- Linux and macOS today. Windows via WSL2, guide included.
Refund if the installer doesn't run on your supported system.
A security installer shouldn't ship insecurely.
That's why you can verify every byte before you run it.
HTTPS on autoclawd.io
Served only from our verified domain.
SHA256 checksum
Verify the script against the published hash.
Auditable script
Readable bash. Read it end to end before running.
Official image
Only ghcr.io/openclaw/openclaw. Nothing third-party.
Built on CNCERT 2026's six golden rules.
What you need to know.
Today it runs on Linux and macOS. On Windows it works via WSL2, guide included. Native support is coming soon.
It's an always-on AI agent wired to your messaging apps. It has access to a lot. Misconfigured, it's an open door.
Docker (Hogareño) for your machine and development. Podman (Técnico/PyME) for production: rootless and more hardened.
Rollback reverts everything: packages, directories, firewall and containers. You're never left half-done.
No. The installer does the heavy lifting. You just paste your API key and connect your channel.
Yes. Served over HTTPS, with a verifiable SHA256 checksum, and it uses only OpenClaw's official image.
One-time payment. Buy your tier and get lifetime access to the installer.
Yes. Installer updates show up in your portal. We'll confirm the full policy before launch.
After paying, you get an access link by email. You enter the portal and get your command, the download and the quick-start.
Your gateway doesn't have to be one of the 42,900.
Install OpenClaw hardened today. One command and done.