Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix Gateway HTTP server binds to 127.0.0.1 inside container, preventing Docker port forwarding from working [1 pull requests, 1 comments, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#61779•Fetched 2026-04-08 02:54:40
View on GitHub
Comments
1
Participants
1
Timeline
6
Reactions
1
Author
CubefiveCubefive
Participants
CubefiveCubefive
Timeline (top)
labeled ×2closed ×1commented ×1cross-referenced ×1

The OpenClaw gateway HTTP server binds to 127.0.0.1 inside the Docker container and is not reachable via Docker host port forwarding. Accessing the gateway from inside the container succeeds (401 Unauthorized), but requests to the host's forwarded port fail with "Connection reset by peer".

Error Message

docker-logs-redacted.txt Contents (attach this file): 2026-04-06T08:04:25.299+00:00 [gateway] loading configuration… 2026-04-06T08:04:25.304+00:00 [gateway] resolving authentication… 2026-04-06T08:04:25.306+00:00 [gateway] starting... 2026-04-06T08:04:36.614+00:00 [gateway] starting HTTP server... 2026-04-06T08:04:36.621+00:00 [canvas] host mounted at http://127.0.0.1:18789/__openclaw__/canvas/ (root /home/node/.openclaw/canvas) 2026-04-06T08:04:36.628+00:00 [gateway] MCP loopback server listening on http://127.0.0.1:35391/mcp 2026-04-06T08:04:36.678+00:00 [heartbeat] started 2026-04-06T08:04:36.680+00:00 [health-monitor] started 2026-04-06T08:04:36.684+00:00 [gateway] agent model: openai/gpt-5.4 2026-04-06T08:04:36.686+00:00 [gateway] ready (5 plugins, 11.4s) 2026-04-06T08:04:36.687+00:00 [gateway] log file: /tmp/openclaw/openclaw-2026-04-06.log 2026-04-06T08:04:36.689+00:00 [gateway] starting channels and sidecars... 2026-04-06T08:04:36.822+00:00 [hooks] loaded 4 internal hook handlers 2026-04-06T08:04:36.826+00:00 [plugins] embedded acpx runtime backend registered 2026-04-06T08:04:37.456+00:00 [browser] control listening on http://127.0.0.1:18791/ (auth=token) 2026-04-06T08:05:48.428+00:00 [plugins] memory-core failed during register from /app/extensions/memory-core/index.ts: RangeError: Maximum call stack size exceeded 2026-04-06T08:07:07.903+00:00 [plugins] 1 plugin(s) failed to initialize (register: memory-core) 2026-04-06T08:08:11.219+00:00 [bonjour] watchdog detected non-announced service; attempting re-advertise (gateway fqdn=20b4d0d87f15 (OpenClaw)._openclaw-gw._tcp.local. host=openclaw.local. port=18789 state=probing) 2026-04-06T08:08:11.253+00:00 [gateway] signal SIGTERM received 2026-04-06T08:08:11.255+00:00 [gateway] received SIGTERM; shutting down 2026-04-06T08:08:11.270+00:00 [openclaw] Unhandled promise rejection: CIAO PROBING CANCELLED 2026-04-06T08:08:36.697+00:00 [gateway] loading configuration… 2026-04-06T08:08:36.705+00:00 [gateway] starting... 2026-04-06T08:08:43.731+00:00 [gateway] starting HTTP server... 2026-04-06T08:08:43.738+00:00 [canvas] host mounted at http://127.0.0.1:18789/__openclaw__/canvas/ 2026-04-06T08:08:43.745+00:00 [gateway] MCP loopback server listening on http://127.0.0.1:39753/mcp 2026-04-06T08:08:43.791+00:00 [heartbeat] started 2026-04-06T08:08:43.793+00:00 [health-monitor] started 2026-04-06T08:08:43.799+00:00 [gateway] agent model: openai/gpt-5.4 2026-04-06T08:08:43.801+00:00 [gateway] ready (5 plugins, 7.1s) 2026-04-06T08:08:43.802+00:00 [gateway] log file: /tmp/openclaw/openclaw-2026-04-06.log 2026-04-06T08:08:43.805+00:00 [browser] control listening on http://127.0.0.1:18791/ (auth=token) 2026-04-06T08:38:48.807+00:00 [diagnostic] lane task error: lane=main durationMs=884 error="Error: No API key found for provider "openai". Auth store: /home/node/.openclaw/agents/main/agent/auth-profiles.json" 2026-04-06T08:38:48.823+00:00 [model-fallback] model fallback decision: decision=candidate_failed requested=openai/gpt-5.4 candidate=openai/gpt-5.4 reason=auth 2026-04-06T08:38:48.807+00:00 [diagnostic] lane task error: lane=main durationMs=884 error="Error: No API key found for provider "openai". Auth store: /home/node/.openclaw/agents/main/agent/auth-profiles.json"

Root Cause

The OpenClaw gateway HTTP server binds to 127.0.0.1 inside the Docker container and is not reachable via Docker host port forwarding. Accessing the gateway from inside the container succeeds (401 Unauthorized), but requests to the host's forwarded port fail with "Connection reset by peer".

Fix Action

Fixed

PR fix notes

PR #61818: fix(gateway): auto-bind to 0.0.0.0 inside container environments

Description (problem / solution / changelog)

Summary

  • Problem: When running the Gateway inside a Docker container without an explicit gateway.bind configuration, the HTTP server binds to 127.0.0.1 by default. This prevents the host machine from accessing the Gateway or Control UI via port forwarding, effectively blocking Docker deployments. (See src/gateway/net.ts line 241 and src/gateway/server-runtime-config.ts line 46).
  • Root Cause: The default bind mode is "loopback", and even when set to "auto", resolveGatewayBindHost prioritizes 127.0.0.1 if it is available. Inside a container, 127.0.0.1 is always available but is isolated to the container's network namespace. There was no mechanism to detect the container environment and adjust the default bind address or security checks accordingly.
  • Fix:
    1. Introduced isContainerEnvironment() in src/gateway/net.ts using reliable heuristics (/.dockerenv and /proc/1/cgroup).
    2. Updated resolveGatewayBindHost so that "auto" mode prefers 0.0.0.0 when running inside a container.
    3. Changed the default bind mode from "loopback" to "auto" when a container environment is detected.
    4. Relaxed the strict auth and controlUi origin checks in server-runtime-config.ts and gateway-cli/run.ts only when the bind address is auto-resolved to 0.0.0.0 due to container detection. This maintains the "loopback-equivalent" security posture since the container's 0.0.0.0 is still only reachable via explicit port forwarding by the container runtime.
  • What changed:
    • src/gateway/net.ts: Added isContainerEnvironment() and updated "auto" mode logic.
    • src/gateway/server-runtime-config.ts: Updated default bind mode and relaxed auth/origin checks for container auto-binds.
    • src/cli/gateway-cli/run.ts: Updated CLI default bind mode and relaxed auth checks for container auto-binds.
    • src/gateway/net.test.ts: Added tests for container detection and bind resolution.
    • src/gateway/server-runtime-config.test.ts: Added tests for container-aware bind defaults.
  • What did NOT change (scope boundary):
    • Explicit configurations (bind: "loopback", bind: "lan") are strictly respected, even inside containers.
    • Non-container environments (bare-metal, macOS, Windows) retain the exact same "loopback" default and strict auth requirements for non-loopback binds.
    • Tailscale bind logic remains unchanged.

Reproduction

  1. Run the gateway via Docker without explicit bind config: docker run -p 18789:18789 openclaw/openclaw gateway start
  2. Attempt to access http://localhost:18789 from the host machine.
  3. Before: Connection refused (bound to container's 127.0.0.1 ).
  4. After: Successfully connects to the Gateway / Control UI.

Risk / Mitigation

  • Risk: Exposing the gateway to 0.0.0.0 without authentication could lead to unauthorized access if the container network is exposed to the public internet without a reverse proxy.
  • Mitigation: The relaxed auth check only applies when the user has not explicitly configured a bind address and the system auto-detects a container. In Docker/Kubernetes, 0.0.0.0 inside the container is still isolated from the host's LAN unless explicitly published via -p or a Service. This matches the security posture of a local 127.0.0.1 bind on bare metal. Extensive tests were added to ensure explicit configs still enforce auth.

Change Type (select all)

  • Bug fix

Scope (select all touched areas)

  • Gateway
  • CLI
  • Config

Linked Issue/PR

Fixes #61779

Changed files

  • CHANGELOG.md (modified, +1/-0)
  • src/cli/daemon-cli/status.gather.test.ts (modified, +21/-1)
  • src/cli/gateway-cli/run.ts (modified, +33/-15)
  • src/commands/doctor-security.test.ts (modified, +8/-0)
  • src/commands/doctor-security.ts (modified, +2/-1)
  • src/config/gateway-control-ui-origins.ts (modified, +23/-8)
  • src/gateway/net.test.ts (modified, +187/-0)
  • src/gateway/net.ts (modified, +85/-1)
  • src/gateway/server-runtime-config.test.ts (modified, +104/-1)
  • src/gateway/server-runtime-config.ts (modified, +15/-2)
  • src/gateway/startup-control-ui-origins.ts (modified, +4/-1)

Code Example

Observed container mapping:
  docker ps shows: 127.0.0.1:18789->18789/tcp

Inside container (works):
  sudo docker exec docker-openclaw-1 curl -I http://127.0.0.1:18789/__openclaw__/canvas/
    → HTTP/1.1 401 Unauthorized
  sudo docker exec docker-openclaw-1 curl -I http://127.0.0.1:18791/
    → HTTP/1.1 401 Unauthorized

From host (fails):
  curl -I http://127.0.0.1:18789/
    → curl: (56) Recv failure: Connection reset by peer

Gateway startup excerpts:
  2026-04-06T08:04:36.614+00:00 [gateway] starting HTTP server...
  2026-04-06T08:04:36.621+00:00 [canvas] host mounted at http://127.0.0.1:18789/__openclaw__/canvas/
  2026-04-06T08:04:36.628+00:00 [gateway] MCP loopback server listening on http://127.0.0.1:35391/mcp
  2026-04-06T08:04:37.456+00:00 [browser] control listening on http://127.0.0.1:18791/ (auth=token)
RAW_BUFFERClick to expand / collapse

Bug type

Behavior bug (incorrect output/state without crash)

Beta release blocker

No

Summary

The OpenClaw gateway HTTP server binds to 127.0.0.1 inside the Docker container and is not reachable via Docker host port forwarding. Accessing the gateway from inside the container succeeds (401 Unauthorized), but requests to the host's forwarded port fail with "Connection reset by peer".

Steps to reproduce

  1. Deploy OpenClaw using the default docker-compose setup under /opt/openclaw/docker and start the container (sudo docker compose up -d).
  2. Wait for the gateway to become "ready" in the container logs.
  3. From inside the container: sudo docker exec <container> curl -I http://127.0.0.1:18789/__openclaw__/canvas/ → returns HTTP/1.1 401 Unauthorized (server reachable).
  4. From the host (or VPS shell): curl -I http://127.0.0.1:18789/ → connection reset / empty reply (host cannot reach forwarded port).

Expected behavior

When configured for LAN/auto, the gateway should bind to 0.0.0.0 inside the container (or otherwise be reachable), so Docker host port forwarding (for example 127.0.0.1:18789:18789 or 0.0.0.0:18789:18789) can reach the service. If loopback-first behavior is intentional, the docs should show the exact docker-compose/env/CLI steps to expose the UI safely.

Actual behavior

Gateway logs show loopback endpoints (127.0.0.1:18789 / 18791). Requests inside the container to these endpoints return 401/200 as expected. Requests from the host to the mapped ports reset the connection. Attempts to change bind mode, ports, or env vars did not make the host-forwarded port reachable.

OpenClaw version

openclaw:local (built from GitHub main). Note: I reviewed release notes through v2026.4.5.

Operating system

Ubuntu 24.04 (VPS)

Install method

docker (docker-compose under /opt/openclaw/docker)

Model

openai/gpt-5.4

Provider / routing chain

openclaw -> openai

Additional provider/model setup details

Default route used during testing: openclaw -> openai (model: openai/gpt-5.4 as shown in gateway logs). Gateway logged "No API key found for provider 'openai'"; auth store path: /home/node/.openclaw/agents/main/agent/auth-profiles.json (no provider key configured). Config files manipulated: /opt/openclaw/docker/docker-compose.yml and /opt/openclaw/.env (I tried OPENCLAW_GATEWAY_BIND, OPENCLAW_GATEWAY_MODE, OPENCLAW_GATEWAY_HOST_IP, OPENCLAW_CONTROL_UI_DANGEROUSLY_ALLOW_HOST_HEADER_ORIGIN_FALLBACK). Browser control uses token auth (log: "browser control listening ... (auth=token)"). Image used: openclaw:local (built from GitHub main).

Logs, screenshots, and evidence

Observed container mapping:
  docker ps shows: 127.0.0.1:18789->18789/tcp

Inside container (works):
  sudo docker exec docker-openclaw-1 curl -I http://127.0.0.1:18789/__openclaw__/canvas/
    → HTTP/1.1 401 Unauthorized
  sudo docker exec docker-openclaw-1 curl -I http://127.0.0.1:18791/
    → HTTP/1.1 401 Unauthorized

From host (fails):
  curl -I http://127.0.0.1:18789/
    → curl: (56) Recv failure: Connection reset by peer

Gateway startup excerpts:
  2026-04-06T08:04:36.614+00:00 [gateway] starting HTTP server...
  2026-04-06T08:04:36.621+00:00 [canvas] host mounted at http://127.0.0.1:18789/__openclaw__/canvas/
  2026-04-06T08:04:36.628+00:00 [gateway] MCP loopback server listening on http://127.0.0.1:35391/mcp
  2026-04-06T08:04:37.456+00:00 [browser] control listening on http://127.0.0.1:18791/ (auth=token)

Impact and severity

Affected: Users deploying OpenClaw gateway with Docker expecting host/SSH access to the web UI. Severity: High — blocks access to web UI and browser control from host. Frequency: Reproducible in every test run (always). Consequence: Host cannot reach OpenClaw web endpoints through Docker port forwarding; UI and control features inaccessible.

Additional information

I reviewed releases up through v2026.4.5 (https://github.com/openclaw/openclaw/releases). I found PR #55992 which adjusts docker-compose host-IP defaults, but I did not find a release note that changes the gateway's internal bind behavior to allow 0.0.0.0 inside the container. It appears docker-compose-side host binding defaults and the gateway process internal bind behavior aren’t clearly documented or not in sync.

docker-ps.txt Contents (attach this file): CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 20b4d0d87f15 openclaw:local "docker-entrypoint.s…" 50 minutes ago Up 46 minutes (healthy) 127.0.0.1:18789->18789/tcp, 127.0.0.1:18791->18791/tcp docker-openclaw-1 8d1136bcc83d moby/buildkit:buildx-stable-1 "/usr/bin/buildkitd-…" 17 hours ago Up 17 hours buildx_buildkit_openclaw-builder0

docker-logs-redacted.txt Contents (attach this file): 2026-04-06T08:04:25.299+00:00 [gateway] loading configuration… 2026-04-06T08:04:25.304+00:00 [gateway] resolving authentication… 2026-04-06T08:04:25.306+00:00 [gateway] starting... 2026-04-06T08:04:36.614+00:00 [gateway] starting HTTP server... 2026-04-06T08:04:36.621+00:00 [canvas] host mounted at http://127.0.0.1:18789/__openclaw__/canvas/ (root /home/node/.openclaw/canvas) 2026-04-06T08:04:36.628+00:00 [gateway] MCP loopback server listening on http://127.0.0.1:35391/mcp 2026-04-06T08:04:36.678+00:00 [heartbeat] started 2026-04-06T08:04:36.680+00:00 [health-monitor] started 2026-04-06T08:04:36.684+00:00 [gateway] agent model: openai/gpt-5.4 2026-04-06T08:04:36.686+00:00 [gateway] ready (5 plugins, 11.4s) 2026-04-06T08:04:36.687+00:00 [gateway] log file: /tmp/openclaw/openclaw-2026-04-06.log 2026-04-06T08:04:36.689+00:00 [gateway] starting channels and sidecars... 2026-04-06T08:04:36.822+00:00 [hooks] loaded 4 internal hook handlers 2026-04-06T08:04:36.826+00:00 [plugins] embedded acpx runtime backend registered 2026-04-06T08:04:37.456+00:00 [browser] control listening on http://127.0.0.1:18791/ (auth=token) 2026-04-06T08:05:48.428+00:00 [plugins] memory-core failed during register from /app/extensions/memory-core/index.ts: RangeError: Maximum call stack size exceeded 2026-04-06T08:07:07.903+00:00 [plugins] 1 plugin(s) failed to initialize (register: memory-core) 2026-04-06T08:08:11.219+00:00 [bonjour] watchdog detected non-announced service; attempting re-advertise (gateway fqdn=20b4d0d87f15 (OpenClaw)._openclaw-gw._tcp.local. host=openclaw.local. port=18789 state=probing) 2026-04-06T08:08:11.253+00:00 [gateway] signal SIGTERM received 2026-04-06T08:08:11.255+00:00 [gateway] received SIGTERM; shutting down 2026-04-06T08:08:11.270+00:00 [openclaw] Unhandled promise rejection: CIAO PROBING CANCELLED 2026-04-06T08:08:36.697+00:00 [gateway] loading configuration… 2026-04-06T08:08:36.705+00:00 [gateway] starting... 2026-04-06T08:08:43.731+00:00 [gateway] starting HTTP server... 2026-04-06T08:08:43.738+00:00 [canvas] host mounted at http://127.0.0.1:18789/__openclaw__/canvas/ 2026-04-06T08:08:43.745+00:00 [gateway] MCP loopback server listening on http://127.0.0.1:39753/mcp 2026-04-06T08:08:43.791+00:00 [heartbeat] started 2026-04-06T08:08:43.793+00:00 [health-monitor] started 2026-04-06T08:08:43.799+00:00 [gateway] agent model: openai/gpt-5.4 2026-04-06T08:08:43.801+00:00 [gateway] ready (5 plugins, 7.1s) 2026-04-06T08:08:43.802+00:00 [gateway] log file: /tmp/openclaw/openclaw-2026-04-06.log 2026-04-06T08:08:43.805+00:00 [browser] control listening on http://127.0.0.1:18791/ (auth=token) 2026-04-06T08:38:48.807+00:00 [diagnostic] lane task error: lane=main durationMs=884 error="Error: No API key found for provider "openai". Auth store: /home/node/.openclaw/agents/main/agent/auth-profiles.json" 2026-04-06T08:38:48.823+00:00 [model-fallback] model fallback decision: decision=candidate_failed requested=openai/gpt-5.4 candidate=openai/gpt-5.4 reason=auth docker-compose.redacted.yml version: "3.8" services: openclaw: image: openclaw:local restart: unless-stopped command: node dist/index.js gateway --bind auto --allow-unconfigured env_file: - /opt/openclaw/.env environment: NODE_ENV: production OPENCLAW_CONTROL_UI_DANGEROUSLY_ALLOW_HOST_HEADER_ORIGIN_FALLBACK: "true" volumes: - openclaw-workspace:/app/workspace - openclaw-vault:/app/config/.vault - /opt/openclaw/.env:/app/.env:ro ports: - 127.0.0.1:18789:18789 - 127.0.0.1:18791:18791 volumes: openclaw-workspace: {} openclaw-vault: {}

openclaw.env.redacted OPENCLAW_IMAGE=openclaw:local OPENCLAW_GATEWAY_TOKEN=<REDACTED_GATEWAY_TOKEN> OPENCLAW_GATEWAY_BIND=0.0.0.0 OPENCLAW_GATEWAY_PORT=18789 OPENCLAW_CONFIG_DIR=/home/node/.openclaw OPENCLAW_WORKSPACE_DIR=/home/node/.openclaw/workspace GOG_KEYRING_PASSWORD=<REDACTED_PASSWORD> XDG_CONFIG_HOME=/home/node/.openclaw GATEWAY_ALLOW_HOST_FALLBACK=true OPENCLAW_GATEWAY_BIND_ADDRESS=0.0.0.0 OPENCLAW_GATEWAY_MODE=local OPENCLAW_GATEWAY_BIND=lan OPENCLAW_GATEWAY_MODE=local OPENCLAW_GATEWAY_HOST_IP=0.0.0.0 OPENCLAW_CONTROL_UI_DANGEROUSLY_ALLOW_HOST_HEADER_ORIGIN_FALLBACK=true

docker-logs-redacted.txt 2026-04-06T08:04:25.299+00:00 [gateway] loading configuration… 2026-04-06T08:04:25.304+00:00 [gateway] resolving authentication… 2026-04-06T08:04:25.306+00:00 [gateway] starting... 2026-04-06T08:04:36.614+00:00 [gateway] starting HTTP server... 2026-04-06T08:04:36.621+00:00 [canvas] host mounted at http://127.0.0.1:18789/__openclaw__/canvas/ (root /home/node/.openclaw/canvas) 2026-04-06T08:04:36.628+00:00 [gateway] MCP loopback server listening on http://127.0.0.1:35391/mcp 2026-04-06T08:04:36.678+00:00 [heartbeat] started 2026-04-06T08:04:36.684+00:00 [gateway] agent model: openai/gpt-5.4 2026-04-06T08:04:36.686+00:00 [gateway] ready (5 plugins, 11.4s) 2026-04-06T08:04:36.687+00:00 [gateway] log file: /tmp/openclaw/openclaw-2026-04-06.log 2026-04-06T08:04:36.689+00:00 [gateway] starting channels and sidecars... 2026-04-06T08:04:36.822+00:00 [hooks] loaded 4 internal hook handlers 2026-04-06T08:04:36.826+00:00 [plugins] embedded acpx runtime backend registered 2026-04-06T08:04:37.456+00:00 [browser] control listening on http://127.0.0.1:18791/ (auth=token) 2026-04-06T08:05:48.428+00:00 [plugins] memory-core failed during register from /app/extensions/memory-core/index.ts: RangeError: Maximum call stack size exceeded 2026-04-06T08:08:11.219+00:00 [bonjour] watchdog detected non-announced service; attempting re-advertise (gateway fqdn=20b4d0d87f15 (OpenClaw)._openclaw-gw._tcp.local. host=openclaw.local. port=18789 state=probing) 2026-04-06T08:08:11.255+00:00 [gateway] received SIGTERM; shutting down 2026-04-06T08:08:43.731+00:00 [gateway] starting HTTP server... 2026-04-06T08:08:43.738+00:00 [canvas] host mounted at http://127.0.0.1:18789/__openclaw__/canvas/ 2026-04-06T08:08:43.801+00:00 [gateway] agent model: openai/gpt-5.4 2026-04-06T08:08:43.802+00:00 [gateway] ready (5 plugins, 7.1s) 2026-04-06T08:38:48.807+00:00 [diagnostic] lane task error: lane=main durationMs=884 error="Error: No API key found for provider "openai". Auth store: /home/node/.openclaw/agents/main/agent/auth-profiles.json"

docker-ps.txt CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 20b4d0d87f15 openclaw:local "docker-entrypoint.s…" 57 minutes ago Up 53 minutes (healthy) 127.0.0.1:18789->18789/tcp, 127.0.0.1:18791->18791/tcp docker-openclaw-1 8d1136bcc83d moby/buildkit:buildx-stable-1 "/usr/bin/buildkitd-…" 17 hours ago Up 17 hours buildx_buildkit_openclaw-builder0

extent analysis

TL;DR

The OpenClaw gateway is not reachable from the host due to binding to 127.0.0.1 inside the Docker container, and a potential solution is to configure the gateway to bind to 0.0.0.0.

Guidance

  • Review the docker-compose.yml file to ensure that the ports configuration is correct and that the container is exposing the necessary ports.
  • Check the openclaw.env file to ensure that the OPENCLAW_GATEWAY_BIND variable is set to 0.0.0.0 to allow the gateway to bind to all available network interfaces.
  • Verify that the OPENCLAW_GATEWAY_MODE variable is set to lan or auto to enable the gateway to listen on all available network interfaces.
  • Attempt to set the OPENCLAW_GATEWAY_HOST_IP variable to 0.0.0.0 to force the gateway to bind to all available network interfaces.

Example

No code snippet is provided as the issue seems to be related to configuration rather than code.

Notes

The issue may be related to the fact that the OPENCLAW_GATEWAY_BIND variable is set to lan in the openclaw.env file, which may not be allowing the gateway to bind to all available network interfaces. Additionally, the docker-compose.yml file may need to be updated to reflect the correct port mappings.

Recommendation

Apply a workaround by setting the OPENCLAW_GATEWAY_BIND variable to 0.0.0.0 and the OPENCLAW_GATEWAY_MODE variable to lan or auto to enable the gateway to listen on all available network interfaces. This should allow the gateway to be reachable from the host.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

When configured for LAN/auto, the gateway should bind to 0.0.0.0 inside the container (or otherwise be reachable), so Docker host port forwarding (for example 127.0.0.1:18789:18789 or 0.0.0.0:18789:18789) can reach the service. If loopback-first behavior is intentional, the docs should show the exact docker-compose/env/CLI steps to expose the UI safely.

#api#serialization error#model compatibility#GPU setup#container setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING