OpenClaw: new service

[jackspiering]

Description

Adds OpenClaw, a self-hosted personal AI assistant, behind a Tailscale sidecar.

Is the sidecar necessary? Yes. OpenClaw has its own Tailscale Serve mode, but it runs the tailscale command on the host and needs a logged-in daemon next to the Gateway. The official image (ghcr.io/openclaw/openclaw:latest) contains neither tailscale nor tailscaled (which tailscale tailscaled finds nothing), and upstream's compose file drops NET_ADMIN. So gateway.tailscale.mode stays off, the sidecar provides Serve, and gateway.auth.allowTailscale identity login is unavailable, so the stack signs in with a token.

Is the project maintained? Yes. The repository is not archived, was pushed to today, and publishes releases almost daily. ghcr.io/openclaw/openclaw is the registry that the upstream Docker docs name, and latest is the tag they recommend.

Notes on the stack:

• The command sets gateway.trustedProxies to 127.0.0.1 and gateway.mode to local on each start. Without the trusted proxy, Serve gets 403 proxy_attribution_required.
• The data folder must exist before the first start, owned by uid 1000. Otherwise Docker creates it as root and the application restarts in a loop (GatewayLockError).

Related Issues

• Closes 🏗️ New Service: OpenClaw #234.

Verification

• docker compose config --quiet from services/openclaw, with a dummy value for OPENCLAW_GATEWAY_TOKEN
• The stack started, Tailscale is healthy, and the service is reachable through the Tailnet (checked from inside the namespace with --resolve, because test nodes are not reachable from this host)
• The main function of the service works, and its data survives a restart
• rumdl check --config .markdownlint.yml . on the whole repository (0.2.78), and git diff --check origin/main

What I ran on a copy outside the repository:

• Both containers healthy. docker exec app-<name> node dist/docker-healthcheck.js exits 0.
• GET / and /healthz through Serve return 200. A wrong token is rejected (gateway token mismatch), and the right token reaches device pairing required.
• Approving the request with devices approve pairs the device, and the paired device is still there after docker compose restart.
• A headless Chromium on the https://<name>.<tailnet>.ts.net origin connected with the token, created a pairing request as openclaw-control-ui, and I approved it. The Serve origin needs no allowedOrigins setting.
• Not run: chatting with an agent (no model provider key), and the optional LAN ports block (left commented, as in the template).

Impact on existing users

• None. This is a new service.

Checklist

• I have performed a self-review of my code and followed the templates structure.
• I did not commit a working auth key, password, token, or other credential.
• The service README uses the headings of the template, in the same order, and is up to date.
• I added, removed, or renamed the service in the root README.md, in alphabetical order, or this PR does not change the list of services.

Additional Context

• Deviations are listed in the service README: required gateway token, sidecar instead of OpenClaw's own Tailscale mode, trusted proxy, hardening (cap_drop, no-new-privileges), and no separate CLI container (use docker exec app-openclaw node dist/index.js ...).