Securely deploy OpenClaw using Ansible and Podman containers. This hardening guide covers network isolation, API budget caps, and egress filtering for AI agents.
This is great! I like that you included an emergency procedure. solid advice. Also nice job predicting the p22 trouble, if people are a bit new that's usually a pitfall.
For everyone trying to run this on Debian instead of Ubuntu: I got the following error when running the Ansible playbook:
[ERROR]: Task failed: Failed to set permissions on the temporary files Ansible needs to create when becoming an unprivileged user (rc: 1, err: chmod: invalid mode: ‘A+user:openclaw:rx:allow’
I fixed it by installing ACL (sudo apt-get install acl) on my server. Ubuntu comes with this package pre‑installed.
Although the playbook ran without problems after this fix, I still never got the setup to work. Likely also because I wasn’t using Ubuntu.
Thank you for sharing this setup, Fernando! :) Even though I didn’t get it to work, I ended up using something similar
This is thorough. The Ansible approach makes sense if you want full control over every layer. For anyone who doesn't need that level of customisation though, Laravel Forge recently added OpenClaw as a server type. Five minutes, no Ansible, no manual hardening. I wrote a walkthrough here: https://reading.sh/laravel-forge-can-now-run-openclaw-not-just-your-websites-65c248964223. Different tradeoffs obviously, but worth knowing both options exist.
This is great! I like that you included an emergency procedure. solid advice. Also nice job predicting the p22 trouble, if people are a bit new that's usually a pitfall.
Great read!
For everyone trying to run this on Debian instead of Ubuntu: I got the following error when running the Ansible playbook:
[ERROR]: Task failed: Failed to set permissions on the temporary files Ansible needs to create when becoming an unprivileged user (rc: 1, err: chmod: invalid mode: ‘A+user:openclaw:rx:allow’
I fixed it by installing ACL (sudo apt-get install acl) on my server. Ubuntu comes with this package pre‑installed.
Although the playbook ran without problems after this fix, I still never got the setup to work. Likely also because I wasn’t using Ubuntu.
Thank you for sharing this setup, Fernando! :) Even though I didn’t get it to work, I ended up using something similar
This is thorough. The Ansible approach makes sense if you want full control over every layer. For anyone who doesn't need that level of customisation though, Laravel Forge recently added OpenClaw as a server type. Five minutes, no Ansible, no manual hardening. I wrote a walkthrough here: https://reading.sh/laravel-forge-can-now-run-openclaw-not-just-your-websites-65c248964223. Different tradeoffs obviously, but worth knowing both options exist.