Self-Host OpenClaw on Railway

Railway is the fastest path from zero to a running OpenClaw instance. Its template system handles the Docker build, environment configuration, and deployment in a single flow, entirely through the browser. If you want self-hosted OpenClaw without touching a terminal, this is the guide for you.

Quick Path

For users who just want to get moving:

1. Click the OpenClaw deploy template link (or deploy from the GitHub repo)
2. Add a Volume mounted at /data in the Railway dashboard
3. Set environment variables: OPENCLAW_GATEWAY_PORT, OPENCLAW_GATEWAY_TOKEN, OPENCLAW_STATE_DIR, OPENCLAW_WORKSPACE_DIR
4. Enable the HTTP proxy on port 8080
5. Access OpenClaw at your Railway-provided domain

Total time: under 10 minutes, no terminal required.

Prerequisites

• A Railway account (free to create)
• A Railway Pro or Hobby plan (required for deployments; the free trial works for testing)
• An Anthropic API key

No local tools, CLI installations, or Docker knowledge are needed.

Step 1: Deploy the Template

Railway templates are pre-configured deployment blueprints. Click the deploy button to start:

If the template link above does not work, you can deploy directly from the GitHub repository:

1. Log in to railway.app
2. Click New Project on your dashboard
3. Select Deploy from GitHub repo
4. Connect your GitHub account if prompted
5. Search for or paste the OpenClaw repository URL
6. Click Deploy

Railway detects the Dockerfile in the repository, builds the image, and starts the service. The initial build takes 2-4 minutes.

Step 2: Add a Persistent Volume

Without a volume, all OpenClaw data (sessions, configuration, workspace files) is lost on every redeployment. Adding a volume is essential.

1. In your Railway project, click on the OpenClaw service
2. Go to the Settings tab
3. Scroll to the Volumes section
4. Click Add Volume
5. Set the mount path to /data
6. Click Save

Railway provisions the volume and redeploys the service with the mount active. The default volume size is 1 GB, which is sufficient for most use cases. You can increase it later through the dashboard.

Step 3: Set Environment Variables

Click on your OpenClaw service, go to the Variables tab, and add the following:

To generate a secure gateway token, use any random string generator. A simple option:

openssl rand -hex 32

Or use an online generator if you prefer not to use the terminal.

After adding all variables, Railway automatically redeploys the service with the new configuration.

Variable Tips

• Railway variables are encrypted at rest and in transit
• You can bulk-import variables by switching to the RAW editor and pasting:

  OPENCLAW_GATEWAY_PORT=8080
  OPENCLAW_GATEWAY_TOKEN=your-secure-token
  OPENCLAW_STATE_DIR=/data/.openclaw
  OPENCLAW_WORKSPACE_DIR=/data/workspace
  ANTHROPIC_API_KEY=sk-ant-your-key-here
  NODE_ENV=production
  

• Railway also provides built-in variables like ${{RAILWAY_PUBLIC_DOMAIN}} that you can reference in your configuration

Step 4: Enable the HTTP Proxy

Railway needs to know which port your service listens on to route public traffic to it.

1. In your service's Settings tab, scroll to Networking
2. Under Public Networking, click Generate Domain to get a *.railway.app domain
3. Ensure the port is set to 8080 (matching OPENCLAW_GATEWAY_PORT)

Railway handles TLS termination automatically. Your service gets a free *.railway.app subdomain with HTTPS.

Step 5: Access OpenClaw

Once the deployment is complete and the health checks pass, access OpenClaw at:

https://your-service-name.railway.app/openclaw

Find your exact URL in the service's Settings tab under Domains.

You will need to authenticate using the gateway token you set in Step 3. The exact authentication method depends on your OpenClaw version, but typically involves passing the token as a header or query parameter on your first connection.

Understanding the Architecture

Railway's deployment model is straightforward:

Browser → Railway Edge (TLS) → Your Container (:8080) → OpenClaw
                                      ↓
                                 Volume (/data)
                                   ├── .openclaw/  (state)
                                   └── workspace/  (code)

• Railway Edge: Handles TLS, HTTP/2, and routing. No configuration needed.
• Container: Runs the OpenClaw Docker image. Railway manages the lifecycle.
• Volume: Persistent block storage mounted at /data. Survives redeployments.

Persistent Storage Details

The volume at /data is the backbone of your deployment's durability:

• Survives redeployments: When you push new code or trigger a rebuild, the new container mounts the same volume. All sessions, configurations, and workspace files remain intact.
• Survives restarts: If the container crashes or Railway reschedules it, the volume reattaches automatically.
• Not shared: Each service gets its own volume. Volumes cannot be shared between services or projects.
• Backup support: Use the Railway CLI or OpenClaw's built-in backup command to export your data.

Creating Backups

From a machine with the Railway CLI installed:

# Install the Railway CLI if needed
npm install -g @railway/cli

# Login
railway login

# Link to your project
railway link

# Run a backup command inside the container
railway run openclaw backup create

Or through the Railway dashboard, use the Shell tab on your service to run:

openclaw backup create

Backup files are written to the volume at /data/.openclaw/backups/. Download them through the Railway shell or by adding a temporary file-serving route.

Updating OpenClaw

If deployed from a GitHub repo:

Push to the connected branch and Railway rebuilds automatically:

cd openclaw
git pull origin main
git push

Railway detects the push, builds the new Docker image, and performs a zero-downtime deployment.

If deployed from the template:

1. Go to your service in the Railway dashboard
2. Click the Settings tab
3. Under Source, click Check for Updates or manually trigger a redeploy

Manual redeploy:

In the dashboard, click the Deployments tab and click Redeploy on the latest deployment.

Security Best Practices

• Always set a gateway token: Without OPENCLAW_GATEWAY_TOKEN, anyone with your Railway URL can access OpenClaw. Treat this token like a password.
• Use Railway's private networking: If you only access OpenClaw from other Railway services, disable the public domain and use Railway's internal networking (service-name.railway.internal:8080). This removes all public internet exposure.
• Rotate your API key: If you suspect your Anthropic API key has been compromised, rotate it immediately in the Anthropic Console and update the Railway variable.
• Review deployment logs: Check the Deployments tab regularly for unexpected restarts or errors that could indicate unauthorized access attempts.
• Enable two-factor authentication: Secure your Railway account with 2FA to prevent unauthorized access to your deployment configuration and secrets.
• Restrict team access: If using Railway's team features, limit who has access to the project. Only members who need to manage the deployment should have write access.

Troubleshooting

Deployment stuck in "Building"

Railway builds Docker images remotely. If the build hangs for more than 10 minutes:

1. Check the build logs in the Deployments tab for error messages
2. Verify the Dockerfile exists in the repository root
3. Try a manual redeploy from the dashboard

If the issue persists, Railway's build infrastructure may be experiencing an outage. Check status.railway.app.

"Port scan timeout" or service not reachable

This means Railway cannot detect your service listening on the expected port:

1. Verify OPENCLAW_GATEWAY_PORT is set to 8080
2. Check that the service's networking configuration matches this port
3. Look at runtime logs for startup errors (missing environment variables, crash on boot)

A common mistake is setting the port variable but not having the application actually bind to that port. OpenClaw uses OPENCLAW_GATEWAY_PORT to determine its listen port.

Volume data not persisting

If data disappears between deploys:

1. Confirm the volume is attached: go to Settings > Volumes and verify the mount path is /data
2. Check that OPENCLAW_STATE_DIR points to a subdirectory of the volume mount (/data/.openclaw, not /app/.openclaw)
3. If you recently attached the volume, you may need to redeploy for the mount to take effect

Out of memory crashes

Railway's default memory limit is generous, but heavy OpenClaw workloads can exceed it. Check for OOM events in the Deployments tab. To address this:

1. Add a NODE_OPTIONS environment variable: --max-old-space-size=1536
2. If the issue persists, upgrade your Railway plan for higher resource limits
3. Consider splitting heavy workloads across multiple sessions

Cannot access the Railway shell

The in-browser shell requires a running deployment. If the service is crashing on startup, the shell will not be available. In this case:

1. Check the deployment logs to identify the crash reason
2. Fix any misconfigured environment variables
3. Trigger a redeploy
4. Try the shell again once the deployment is healthy

Cost Breakdown

Railway pricing is usage-based after the base plan fee:

The Pro plan ($20/month base) includes higher resource limits and team features. For individual self-hosting, the Hobby plan is sufficient.

Railway provides a usage dashboard showing real-time cost tracking, so you can monitor exactly how much your deployment costs and adjust resources accordingly.