OpenClaw on Hetzner: the setup guide we actually operate by
Server sizing from measured usage, the official Docker path, and the hardening the official guide skips, from a team running production OpenClaw pods on Hetzner.
Hetzner is a good home for an OpenClaw agent: cheap EU compute, solid hardware, and an official OpenClaw guide that covers the Docker basics. A CPX22 (2 vCPU / 4 GB, ~€23/mo with backups) runs an agent with real headroom; the cheaper CX line is ~€8/mo with backups when you can get it. The official guide gets you to a running gateway; what it deliberately doesn’t cover (firewall, hardening, backups you’ve tested) is where the operator work actually lives.
Which server
Measured numbers, not brochure reads: OpenClaw idles around 540 MB and wants ~2 GB headroom for real work, so 4 GB is the sane floor: CX23 (2 vCPU/4 GB x86, ~€6.5/mo net) is the value pick and CPX22 (~€23/mo net) the dependable one. The catch: CX-line availability flickers, appearing and vanishing within hours, and the ARM CAX line has been effectively unobtainable for weeks at a time, while CPX stock holds steady. Plan CPX22, treat CX as a bonus when it’s there, and add Hetzner’s backup option (20% of server price) without agonizing. Ubuntu 24.04 LTS is the boring, correct OS choice.
The official path, plus what it skips
OpenClaw’s Hetzner guide is Docker end-to-end: install Docker, clone the repo, create the state directory with correct ownership, fill .env, and docker compose up -d. Its security stance is the right one: the Gateway stays loopback-only, reached over an SSH tunnel, never exposed (a rule that deserves its own page). The guide itself tells you it stops there; the additions that matter:
- SSH first, agent second: key-only auth, no root login,
ss -tulpnafterward to confirm SSH is the only listener. The scan noise starts within hours; with keys-only it’s just noise. - Pin your image tag rather than tracking
latest: your agent’s version should change when you decide, and Docker-vs-npm release timing diverges more than you’d expect. - Test the restore, not the backup. Hetzner’s snapshots restore cleanly, but the first restore you ever attempt shouldn’t be the one you need.
- Two Ubuntu 24.04 traps for anyone scripting this: recent openssh upgrades leave sshd socket-activated, so
systemctl reload sshcan fail with “ssh.service is not active” mid-script (addressssh.socketor restart instead), and recreated servers frequently inherit recycled IPs: expect the host-key warning and handle it properly rather than disabling checking.
Locations, latency, and the euro question
Hetzner’s cheap lines live in the EU (Falkenstein, Nuremberg, Helsinki). For an agent this matters less than people assume: you chat with it through Telegram or a web UI, and the extra ~100 ms transatlantic hop is invisible in a conversation. Data residency, though, is a real feature: an EU-hosted agent is a clean answer to a question more operators are asking.
The bottom line
DIY on Hetzner is the best price-per-quality in the game. Do it yourself and the checklist above is yours to own on day one and every day after; buy it managed and that checklist is what you’re buying. The difference is whose pager it is.