How to deploy OpenClaw on Cloud Run instances

OpenClaw is an open-source personal agent. It wants one process that stays up, a home directory that survives restarts, and a URL you can bookmark. A laptop that sleeps will not do that. Neither will a Cloud Run service, which scales to zero when traffic stops.

Cloud Run instances are the documented fit: one copy, no autoscaling, a stable HTTPS URL, and the option to stop when idle and resume later. They are in preview (announced 27 August 2026): up to seven days of continuous runtime and an automatic restart policy. Google quotes $5.70 for 1 vCPU / 1 GiB running 30 days; the OpenClaw Codelab requests 4 CPU and 4Gi, so that figure is the product baseline, not this lab’s bill.

This is a runbook. You will create a dedicated service account, stash a Gemini key and gateway password in Secret Manager, put openclaw.json on a Cloud Storage bucket, and deploy with gcloud beta run instances.

Project, beta component, APIs

In Cloud Shell (billing must be enabled):

export PROJECT_ID=<YOUR_PROJECT_ID>
export REGION=<YOUR_REGION>
gcloud config set project $PROJECT_ID
gcloud config get project
gcloud components install beta --quiet
gcloud components update

Enable the APIs the Codelab lists:

gcloud services enable \
 run.googleapis.com \
 secretmanager.googleapis.com \
 storage.googleapis.com \
 generativelanguage.googleapis.com \
 compute.googleapis.com

The instances quickstart also enables logging.googleapis.com if you want Logs Explorer from the first deploy.

Service account and secrets

Least privilege starts with a dedicated account:

export SERVICE_ACCOUNT_NAME="openclaw-sa"
gcloud iam service-accounts create ${SERVICE_ACCOUNT_NAME} \
 --display-name="OpenClaw Service Account"
export SERVICE_ACCOUNT="${SERVICE_ACCOUNT_NAME}@${PROJECT_ID}.iam.gserviceaccount.com"

Create a Gemini API key in Google AI Studio for ${PROJECT_ID}, then:

echo -n "YOUR_GEMINI_API_KEY" | gcloud secrets create gemini-api-key \
 --data-file=- \
 --replication-policy="automatic"
gcloud secrets add-iam-policy-binding gemini-api-key \
 --member="serviceAccount:${SERVICE_ACCOUNT}" \
 --role="roles/secretmanager.secretAccessor"

Protect the public gateway with a random password:

export OPENCLAW_GATEWAY_PASSWORD=$(openssl rand -hex 16)
echo "Generated Gateway Password: ${OPENCLAW_GATEWAY_PASSWORD}"
echo -n "${OPENCLAW_GATEWAY_PASSWORD}" | gcloud secrets create openclaw-gateway-password \
 --data-file=- \
 --replication-policy="automatic"
gcloud secrets add-iam-policy-binding openclaw-gateway-password \
 --member="serviceAccount:${SERVICE_ACCOUNT}" \
 --role="roles/secretmanager.secretAccessor"

Keep that password. Optional channels: store telegram-bot-token or whatsapp-token the same way. Telegram setup is @BotFather (/newbot) plus your numeric ID from @userinfobot. WhatsApp uses an international number with no spaces, such as +15551234567.

Bucket and `openclaw.json`

OpenClaw reads /home/node/.openclaw/openclaw.json. Create the bucket and grant roles/storage.objectUser:

export BUCKET_NAME="openclaw-state-${PROJECT_ID}"
gcloud storage buckets create gs://${BUCKET_NAME} --location=${REGION}
gcloud storage buckets add-iam-policy-binding gs://${BUCKET_NAME} \
 --member="serviceAccount:${SERVICE_ACCOUNT}" \
 --role="roles/storage.objectUser"

Use the Codelab’s sample openclaw.json rather than inventing gateway or Control UI fields. That sample wires the listen port 18789, the password you generated above, the default model google/gemini-3.1-pro-preview, and optional Telegram or WhatsApp channels with an allowlist. Fill in only what the lab asks you to fill in, then upload it:

gcloud storage cp openclaw.json gs://${BUCKET_NAME}/openclaw.json

For sandboxed tools, follow the Codelab’s sandbox backend and upload its cloud-run-sandbox-provider plugin. --sandbox-launcher injects /usr/local/gcp/bin/sandbox (gVisor); Cloud Run images do not run Docker. Copy with gcloud storage cp -r plugins gs://${BUCKET_NAME}/. Custom Skills go on the same bucket.

Deploy the instance

gcloud beta run instances deploy openclaw-instance \
 --image ghcr.io/openclaw/openclaw:latest \
 --service-account ${SERVICE_ACCOUNT} \
 --port 18789 \
 --cpu 4 \
 --memory 4Gi \
 --public \
 --sandbox-launcher \
 --add-volume mount-path=/home/node/.openclaw,type=cloud-storage,mount-options="uid=1000;gid=1000;file-mode=0700;dir-mode=0700",bucket=${BUCKET_NAME} \
 --set-secrets GEMINI_API_KEY=gemini-api-key:latest,OPENCLAW_GATEWAY_PASSWORD=openclaw-gateway-password:latest \
 --region ${REGION}

The volume line is the persistence story: Cloud Storage at the OpenClaw home, uid 1000 / gid 1000, modes 0700. --public publishes the HTTPS URL. For Telegram, append ,TELEGRAM_BOT_TOKEN=telegram-bot-token:latest on --set-secrets.

The launch post’s shorter path is gcloud beta run instances create openclaw-instance with the same image, port, --public, uid/gid volume, and --set-env-vars for OPENCLAW_GATEWAY_PASSWORD and GEMINI_API_KEY. Prefer Secret Manager for a public URL. The generic quickstart is the same API: gcloud beta run instances create my-instance with --no-invoker-iam-check on a sample image.

Open the Control UI

gcloud beta run instances describe openclaw-instance \
 --region ${REGION} \
 --format="value(status.urls[0])"

Open the URL and enter the gateway password. If the modal has username and password fields, leave username blank (or use admin). You get the Control Dashboard: chat with Gemini, inspect sessions, and browse the persistent workspace.

Logs and teardown

In Logs Explorer, apply the Cloud Run instance filter from the instances quickstart. Substitute your region and the name openclaw-instance wherever that doc shows placeholders.

You can stop the instance when you are not using it; the HTTPS URL is unchanged across updates and restarts. To delete, the quickstart uses gcloud beta run instances delete my-instance --region REGION—substitute openclaw-instance and your region. Then follow the Codelab Clean Up section for the rest of the lab resources.

Next step: Run the full OpenClaw Codelab in Cloud Shell. Keep the instances create quickstart open for logs and delete, and read the Cloud Run instances announcement for preview behavior (singleton, seven-day runtime, stop/resume).