Security
Container Security: Running OpenClaw in Docker provides isolation, but requires proper hardening to prevent security vulnerabilities.
Basic Docker Security
# Use non-root user
USER openclaw
# Drop capabilities
CAPABILITIES DROP ALL
# Read-only root filesystem
READONLY root filesystemDocker Compose Security Configuration
version: '3.8'
services:
openclaw:
image: openclaw/latest
security_opt:
- no-new-privileges:true
- read-only:true
environment:
- OPENCLAW_SANDBOX=true
volumes:
- openclaw_data:/data
networks:
- internalNetwork Isolation
# Create isolated network
docker network create openclaw-net
# Run without external network access
docker run --network=openclaw-net openclawResource Limits
# Limit CPU and memory
docker run --cpus="1.5" --memory="2g" openclawSecrets Management
# Use Docker secrets for API keys
echo "your-api-key" | docker secret create openclaw-key -
docker run --secret=openclaw-key openclawVulnerability Scanning
# Scan image for vulnerabilities
docker scan openclaw:latest
# Use Trivy for deeper scans
trivy image openclaw:latest --severity HIGH,CRITICALRuntime Security Monitoring
# Monitor container activity
docker logs openclaw --follow
# Inspect container filesystem
docker exec openclaw ls -la /openclaw