OpenClaw on Hetzner: which server, the official setup, and the hardening
Which Hetzner server to pick for OpenClaw from measured usage, the official Docker path, and the hardening the official guide skips.
Hetzner is a good home for an OpenClaw agent: cheap EU compute, solid hardware, and an official OpenClaw guide that covers the Docker basics. A CPX22 (2 vCPU / 4 GB, ~€24/mo with backups and an IPv4 address, before VAT) runs an agent with real headroom; the cheaper CX line is ~€7/mo the same way when you can get it. The official guide gets you to a running gateway; what it deliberately doesn’t cover (firewall, hardening, backups you’ve tested) is where the operator work actually lives.
Which server
Measured numbers, not brochure reads: OpenClaw idles around 540 MB and wants ~2 GB headroom for real work, so 4 GB is the sane floor: CX23 (2 vCPU/4 GB x86, €5.49/mo) is the value pick and CPX22 (€19.49/mo) the dependable one, at the prices Hetzner set from June 15, 2026 for Germany and Finland, before VAT and the IPv4 address (Hetzner’s plan pages show each with the address, €0.50 more). The catch is stock: through 2026 the CX line has come and gone within hours, and the ARM CAX line was unobtainable for weeks at a time over the summer; on October 22 Hetzner marked every CX and CAX server not available, while CPX stock has held steady. Plan CPX22, treat CX as a bonus when it’s there, and add Hetzner’s backup option (20% of server price) without agonizing. Ubuntu 24.04 LTS is the boring, correct OS choice.
The official path, plus what it skips
OpenClaw’s Hetzner guide is Docker end-to-end: install Docker, clone the repo, create the state directory with correct ownership, fill .env, and docker compose up -d. Its security stance is the right one: the Gateway stays loopback-only, reached over an SSH tunnel, never exposed (a rule that deserves its own page). The guide itself tells you it stops there; the additions that matter:
- SSH first, agent second: key-only auth, no root login,
ss -tulpnafterward to confirm SSH is the only listener. The scan noise starts within hours; with keys-only it’s just noise. - Pin your image tag rather than tracking
latest: your agent’s version should change when you decide, and Docker-vs-npm release timing diverges more than you’d expect. - Test the restore, not the backup. Hetzner’s snapshots restore cleanly, but the first restore you ever attempt shouldn’t be the one you need.
- Two Ubuntu 24.04 traps for anyone scripting this: recent openssh upgrades leave sshd socket-activated, so
systemctl reload sshcan fail with “ssh.service is not active” mid-script (addressssh.socketor restart instead), and recreated servers frequently inherit recycled IPs: expect the host-key warning and handle it properly rather than disabling checking.
Locations, latency, and the euro question
Hetzner’s cheap lines live in the EU (Nuremberg and Helsinki for the servers above). For an agent this matters less than people assume: you chat with it through Telegram or a web UI, and the extra ~100 ms transatlantic hop is invisible in a conversation. Data residency, though, is a real feature: an EU-hosted agent is a clean answer to a question more operators are asking.
The bottom line
DIY on Hetzner is the best price-per-quality in the game. Do it yourself and the checklist above is yours to own on day one and every day after; buy it managed and that checklist is what you’re buying. The difference is whose pager it is.