# Hosting OpenClaw

Run OpenClaw inside a Sandbox0 sandbox when you want its gateway, workspace,
logs, and session state behind Sandbox0 lifecycle and network controls. The
builtin `openclaw` template stores `/home/node/.openclaw` on the sandbox
writable rootfs, so checkpointed pause/resume preserves that state.

## Create The Sandbox

Set separate tokens for the Sandbox0 public route and the OpenClaw gateway:

```bash
export OPENCLAW_GATEWAY_TOKEN="$(openssl rand -hex 32)"
export OPENCLAW_ROUTE_TOKEN="$(openssl rand -hex 32)"
```

Claim the builtin template with `auto_resume` and expose port `18789` as a
`cmd` Sandbox Service. The service command can be:

```bash
exec openclaw gateway run \
    --allow-unconfigured \
    --auth token \
    --token "$OPENCLAW_GATEWAY_TOKEN" \
    --bind lan \
    --port "$SANDBOX0_SERVICE_PORT"
```

Protect the public route with bearer auth using the SHA-256 digest of
`OPENCLAW_ROUTE_TOKEN`. Set `resume: true` on the route so a request can resume
a paused sandbox before it reaches OpenClaw.

With the CLI, create the runtime first and then configure services through an
SDK or the Sandbox Services API:

```bash
SANDBOX_ID="$(
    s0 -o json sandbox create --template openclaw \
        | jq -r '.ID // .id'
)"

s0 sandbox get "$SANDBOX_ID"
```

## Persistence

Files under `/home/node/.openclaw` use the same persistence boundary as the
rest of the writable RootFS. Pause checkpoints them; resume restores them into
the replacement runtime generation. Deleting the sandbox deletes its RootFS
state.

Create a named [rootfs snapshot](/docs/sandbox/snapshot-restore) before deletion
when you need a reusable restore point or want to claim another sandbox from
the initialized OpenClaw state.

## Use The Public URL

```bash
curl -fsS "$OPENCLAW_PUBLIC_URL/health" \
    -H "authorization: Bearer $OPENCLAW_ROUTE_TOKEN"
```

With the default filesystem-only pause, the OpenClaw process is not retained;
after resume, Sandbox0 starts the configured service command again against the
restored RootFS. Explicit experimental [memory pause/resume](/docs/sandbox/pause-resume#explicit-memory-pause-and-resume)
can retain supported process state instead. External clients must reconnect.

## Next Steps

<CardGroup>
  <Card title="Sandbox Services" href="/docs/sandbox/services" cta="Continue">
    Configure route auth, auto-resume, health checks, and timeouts.
  </Card>

  <Card title="Snapshot And Restore" href="/docs/sandbox/snapshot-restore" cta="Continue">
    Publish initialized OpenClaw state as a reusable rootfs snapshot.
  </Card>
</CardGroup>