OpenClaw on Contabo: Get Maximum VPS Power for Minimum Cost

Every enterprise cloud charges you a premium for branding, SLAs, and features most OpenClaw deployments never use. Contabo doesn't. Their VPS S gives you more raw compute per dollar than any tier-1 provider, and for a single always-on OpenClaw agent, raw compute is exactly what you need.

Here's where most people get burned: they order the cheapest plan, skip the firewall setup, and expose port 3000 directly to the internet. Three days later their agent is hammered by bots. This guide does it the right way — locked down, Nginx-fronted, and production-ready.

Prerequisites — What You Need Before You Start

• A Contabo account — registration at contabo.com takes under 5 minutes, billing is monthly
• A domain name — needed for Nginx + Let's Encrypt TLS setup
• An SSH key pair generated locally — ssh-keygen -t ed25519 if you haven't done this
• An OpenClaw account and your agent configuration details
• An AI provider API key (Anthropic, OpenAI, or local model endpoint)

Contabo VPS Provisioning

Order your VPS from the Contabo panel. Select Ubuntu 22.04 LTS as the OS image — it's the most stable base for Docker and OpenClaw as of early 2025. Upload your SSH public key during checkout to avoid password-based SSH entirely.

Once the server is provisioned (usually within 15 minutes), SSH in and perform initial hardening:

# SSH into your new server
ssh root@YOUR_SERVER_IP

# Update the system
apt update && apt upgrade -y

# Create a non-root user
adduser openclaw
usermod -aG sudo openclaw

# Copy SSH key to new user
rsync --archive --chown=openclaw:openclaw \
  ~/.ssh /home/openclaw

# Configure UFW firewall
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp    # SSH
ufw allow 80/tcp    # HTTP
ufw allow 443/tcp   # HTTPS
ufw enable

# Verify UFW status
ufw status verbose

We'll get to the OpenClaw port in a moment — but first understand why we're not opening port 3000 directly: routing traffic through Nginx gives you TLS termination, access logging, rate limiting, and the ability to run multiple services on the same server without port conflicts.

Installing OpenClaw on Contabo

Switch to the openclaw user and install Docker:

su - openclaw

# Install Docker
curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker openclaw

# Log out and back in for group to take effect
exit
su - openclaw

# Verify Docker
docker --version

# Pull OpenClaw
docker pull openclaw/openclaw:latest

# Create config directory
mkdir -p ~/openclaw/config ~/openclaw/data

Install Nginx and Certbot for reverse proxy and TLS:

sudo apt install nginx certbot python3-certbot-nginx -y

# Enable and start Nginx
sudo systemctl enable nginx
sudo systemctl start nginx

# Get Let's Encrypt certificate
sudo certbot --nginx -d agent.yourdomain.com \
  --non-interactive --agree-tos \
  --email your@email.com

Configuration and First Run

Create the OpenClaw environment file and Docker Compose config:

# ~/openclaw/config/.env
OPENCLAW_PORT=3000
OPENCLAW_HOST=127.0.0.1
AI_PROVIDER_KEY=your_api_key_here
NODE_ENV=production
OPENCLAW_LOG_LEVEL=info

# ~/openclaw/docker-compose.yml
version: '3.8'
services:
  openclaw:
    image: openclaw/openclaw:latest
    container_name: openclaw
    restart: unless-stopped
    env_file: ./config/.env
    ports:
      - "127.0.0.1:3000:3000"
    volumes:
      - ./data:/app/data
    mem_limit: 2g
    cpus: '2.0'

Configure Nginx to proxy requests to OpenClaw:

# /etc/nginx/sites-available/openclaw
server {
    listen 443 ssl;
    server_name agent.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/agent.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/agent.yourdomain.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_cache_bypass $http_upgrade;
        proxy_read_timeout 300s;
    }
}

server {
    listen 80;
    server_name agent.yourdomain.com;
    return 301 https://$host$request_uri;
}

sudo ln -s /etc/nginx/sites-available/openclaw \
  /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

# Start OpenClaw
cd ~/openclaw && docker compose up -d

# Verify it's running
docker compose logs -f openclaw

Performance Tuning and Cost Comparison

Here's how Contabo stacks up against alternatives for a typical OpenClaw single-agent deployment:

Add a swap file to handle memory spikes during heavy inference:

sudo fallocate -l 4G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

Common Issues and Fixes

SSH Connection Refused After Server Provision

Contabo sometimes takes 10–20 minutes to fully provision a new VPS. Wait and retry. If SSH still fails, check Contabo's customer panel — the server may be in a "starting" state. Never assume a failed SSH connection means your firewall rules are wrong until the server shows "running" in the panel.

OpenClaw Container OOMKilled on VPS S

Your agent is hitting the 2GB container memory limit during large context operations. Either increase the mem_limit in docker-compose.yml (you have 8GB total on VPS S) or upgrade to VPS M for 16GB total. The swap file also helps absorb short bursts without killing the container.

Nginx 502 Bad Gateway

OpenClaw isn't listening on 127.0.0.1:3000. Check the container is running: docker compose ps. If the container shows "Exited," check logs with docker compose logs openclaw. The most common cause is a missing or malformed environment variable in config/.env.

Let's Encrypt Certificate Renewal Fails

Certbot's auto-renewal requires port 80 to be accessible. If you've tightened UFW rules after initial setup, ensure port 80 is still open: ufw allow 80/tcp. Test renewal dry-run with sudo certbot renew --dry-run before it expires.

Frequently Asked Questions

Is Contabo good for running OpenClaw?

Contabo offers some of the highest RAM-per-dollar ratios in the VPS market. Their VPS S starts at around $6/month with 4 vCPU and 8GB RAM — plenty for a single OpenClaw agent with a mid-size model context.

What is the minimum Contabo plan for OpenClaw?

The VPS S (4 vCPU, 8GB RAM) handles OpenClaw at light to moderate load. For agents running large context windows or concurrent users, step up to the VPS M (6 vCPU, 16GB RAM) for headroom.

Does Contabo support Docker for OpenClaw?

Yes. Contabo VPS runs full Linux with root access, so Docker installs normally. The containerized OpenClaw setup works exactly the same as any other Ubuntu-based VPS.

How do I expose OpenClaw publicly on Contabo?

Contabo assigns a public IPv4 to every VPS by default. Open port 3000 in Contabo's customer panel firewall, then either access it directly or add Nginx as a reverse proxy with SSL for a cleaner setup.

Is Contabo reliable enough for production OpenClaw agents?

Contabo runs on shared hardware which means occasional CPU contention during peak hours. For dev and low-stakes production this is fine. Mission-critical agents with SLA requirements should use dedicated hosting or a tier-1 cloud provider.

How do I add a firewall on Contabo VPS?

Use both Contabo's customer panel firewall (external) and UFW on the OS itself (internal). Layered firewalls catch misconfiguration on either layer. Always block all ports by default, then open only 22, 80, 443, and your OpenClaw port.

Can I upgrade my Contabo VPS without data loss?

Contabo supports in-place upgrades for some plans via their customer panel. Larger upgrades require a new VPS and data migration. Back up your OpenClaw config and agent data before any upgrade to avoid loss.