Sanbox By Sanlabs

Guides

Always-on personal agents

Comparison

Where should I host OpenClaw so it keeps running?

By the Sanbox team updated

Ask ChatGPT Ask Claude

OpenClaw's own FAQ says to use a VPS if you want 24/7 reliability, calls a Mac mini a popular always-on host but not a requirement, and says a laptop works while you're actively using it. You need a Mac only for iMessage and other macOS-only tools. Whatever you choose, the host has to stay on and reachable, and OpenClaw's docs recommend keeping its gateway on loopback and reaching it through an SSH tunnel or Tailscale Serve. On Sanbox, a one-click OpenClaw Computer is available on request: we enable it for your organisation.

What does OpenClaw need from a host?

From OpenClaw's FAQ and hosting docs:

  • Always on and reachable. A VM is treated like a VPS: it "needs to be always on".
  • macOS or Linux. Windows works through WSL2. Ubuntu LTS, or another modern Debian or Ubuntu, is the best-tested Linux path.
  • Small resources. The minimum is 1 vCPU, 1 GB RAM and about 500 MB of disk. The recommendation is 1 to 2 vCPUs and at least 2 GB RAM.
  • Node. Node is the primary and recommended runtime.
  • A private gateway. The gateway binds to loopback by default. The docs call loopback plus an SSH tunnel or Tailscale Serve the safest default, with no public exposure.

How do the options compare?

LaptopMac mini at homeVPSOne-click managed hostSanbox (on request)
Runs 24/7Only while awakeYes, if power and network holdYesYesYes, until you stop it
iMessage and macOS toolsYes, on a MacYesNo, unless you pair a MacNoNo
Rough costHardware you ownFrom about $899 or €1,049From about €6 a month before VAT (Hetzner CX23)Varies by providerPer organisation
Who maintains itYouYouYouMostly the providerSanbox runs the Computer
Exposure riskYour laptop and accountsYour home networkA public server you secureDepends on the providerIsolated microVM, no inbound ports by default

For a full 12-month cost breakdown, see Mac mini vs VPS vs cloud computer.

Should I run it on my laptop?

Only for trying it out, or if you want local file access and visible browser automation while you work. OpenClaw's FAQ lists the downsides plainly: the laptop sleeps, the network drops and the OS reboots. Each of those stops the agent.

Should I buy a Mac mini?

Buy one if you need iMessage. OpenClaw's FAQ says iMessage needs a Mac signed in to Messages, and that any Mac works, not only a Mac mini. If your gateway runs on Linux, the FAQ describes pointing the iMessage channel at a Mac over SSH instead. A Mac is also the answer for other macOS-only tools.

The trade-offs are the ones of any home server: power cuts, router changes, macOS updates and keeping the machine awake. Don't forward a port from your router to the gateway. Use Tailscale or an SSH tunnel, as the docs recommend.

Is a VPS the better default?

For an assistant that should simply keep running, yes. That's the FAQ's own recommendation for 24/7 reliability. OpenClaw's Linux server docs include guides for many providers, among them Hetzner, DigitalOcean, Azure, GCP, Oracle Cloud and Raspberry Pi.

On a VPS you own the security work:

  • Keep the gateway on loopback. If you bind it to your LAN or tailnet, the docs require a shared secret.
  • Join the server to Tailscale and restrict public SSH.
  • Don't sign the server in to personal Apple or Google accounts, or to personal browser and password-manager profiles. The docs warn against this.
  • Treat the VPS as the source of truth and back up its state and workspace regularly.

What about one-click hosts?

OpenClaw's docs list providers with browser-based one-click setup, such as Railway and Northflank, and others such as Render and Fly.io. They take most of the server work off you. Check two things before you choose one: the price for a machine that never sleeps, and that OpenClaw's state lives on a persistent volume. The Fly.io and Railway guides both mount a volume at /data for that reason.

OpenClaw on Sanbox

A one-click OpenClaw Computer is enabled per organisation on request. It gives OpenClaw what Sanbox gives every agent:

  • Its own Computer. A Firecracker microVM with its own kernel and persistent disk, separated from other Computers by hardware virtualisation.
  • No open ports. Inbound access is off by default, so the gateway isn't on the public internet.
  • Controlled egress. A deny-by-default network policy lists the sites and APIs the agent may reach.
  • Keys it never sees. Secret proxies add API credentials to outgoing HTTPS requests outside the Computer.
  • Stop and resume. Files and installed packages survive a stop.
  • EU hosting. Computers run in EU data centres under an Article 28 GDPR data processing agreement.

Enable it for your organisation and tell us how you use OpenClaw and which channels you need.

If you want an always-on assistant on Sanbox today, the Hermes Computer is ready to use. It has memory, learned skills, an email inbox and Telegram. See How do I run Hermes Agent in the cloud?

When Sanbox is not the right fit

  • You need iMessage or macOS tools. Sanbox Computers run Linux. Use a Mac.
  • You want the lowest monthly bill. A small VPS is cheaper if you're happy to secure it yourself.
  • You want OpenClaw running this afternoon without contacting anyone. Use a VPS or a one-click host from OpenClaw's list, or a Hermes Computer on Sanbox.
  • You need local models or a GPU. Sanbox has no GPUs.

Sources