VPS 部署 OpenClaw：Docker 安装、飞书接入与备份恢复实测

sudo apt update
sudo apt install -y ca-certificates curl openssl
sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg \
  -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc

sudo tee /etc/apt/sources.list.d/docker.sources >/dev/null <<EOF_DOCKER
Types: deb
URIs: https://download.docker.com/linux/debian
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF_DOCKER

sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin
sudo docker version
sudo docker compose version

mkdir -p ~/openclaw/state
cd ~/openclaw
sudo chown -R 1000:1000 state
sudo chmod 700 state

umask 077
printf 'OPENCLAW_GATEWAY_TOKEN=%s\n' "$(openssl rand -hex 32)" > .env
chmod 600 .env

services:
  openclaw:
    image: ghcr.io/openclaw/openclaw:2026.9.8
    init: true
    restart: unless-stopped
    env_file:
      - .env
    environment:
      HOME: /home/node
      OPENCLAW_STATE_DIR: /home/node/.openclaw
      OPENCLAW_CONFIG_PATH: /home/node/.openclaw/openclaw.json
      OPENCLAW_WORKSPACE_DIR: /home/node/.openclaw/workspace
      OPENCLAW_DISABLE_BONJOUR: "1"
      TZ: Asia/Shanghai
    volumes:
      - ./state:/home/node/.openclaw
    ports:
      - "127.0.0.1:18789:18789"
    command: ["node", "dist/index.js", "gateway", "--bind", "lan", "--port", "18789"]
    cap_drop:
      - NET_RAW
      - NET_ADMIN
    security_opt:
      - no-new-privileges:true
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"
    healthcheck:
      test: ["CMD", "node", "dist/docker-healthcheck.js"]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 60s

sudo tee state/openclaw.json >/dev/null <<'EOF_CONFIG'
{
  "gateway": {
    "mode": "local",
    "bind": "lan",
    "port": 18789,
    "auth": {
      "mode": "token",
      "token": {
        "source": "env",
        "provider": "default",
        "id": "OPENCLAW_GATEWAY_TOKEN"
      },
      "rateLimit": {
        "maxAttempts": 10,
        "windowMs": 60000,
        "lockoutMs": 300000
      }
    },
    "controlUi": {
      "allowedOrigins": [
        "http://127.0.0.1:18789",
        "http://localhost:18789"
      ]
    }
  },
  "session": {
    "dmScope": "per-channel-peer"
  },
  "tools": {
    "profile": "messaging",
    "deny": [
      "group:automation",
      "group:runtime",
      "group:fs",
      "sessions_spawn",
      "sessions_send"
    ],
    "fs": {
      "workspaceOnly": true
    },
    "exec": {
      "security": "deny",
      "ask": "always"
    },
    "elevated": {
      "enabled": false
    },
    "sessions": {
      "visibility": "agent"
    },
    "agentToAgent": {
      "enabled": false
    }
  },
  "browser": {
    "enabled": false,
    "extensionRelay": {
      "allowLegacyAuth": false
    }
  },
  "memory": {
    "search": {
      "enabled": false
    }
  }
}
EOF_CONFIG
sudo chown 1000:1000 state/openclaw.json
sudo chmod 600 state/openclaw.json

sudo docker compose config --quiet
sudo docker compose pull
sudo docker compose run --rm --no-deps openclaw \
  node dist/index.js config validate
sudo docker compose up -d
sudo docker compose ps
sudo docker compose logs --tail=100 openclaw

curl -fsS http://127.0.0.1:18789/healthz
sudo docker compose exec openclaw node dist/index.js health --json
sudo docker compose exec openclaw node dist/index.js security audit

ssh -o ExitOnForwardFailure=yes -N \
  -L 127.0.0.1:18789:127.0.0.1:18789 USER@VPS_IP

sudo docker compose exec openclaw \
  node dist/index.js gateway auth-token --show

sudo docker compose exec openclaw node dist/index.js devices list
sudo docker compose exec openclaw \
  node dist/index.js devices approve REQUEST_ID

sudo docker compose exec openclaw \
  node dist/index.js configure --section model

sudo docker compose exec openclaw node dist/index.js models list
sudo docker compose exec openclaw node dist/index.js models status

sudo docker compose exec openclaw \
  node dist/index.js models set PROVIDER/MODEL_ID

sudo docker compose up -d --force-recreate openclaw

sudo docker compose exec openclaw \
  node dist/index.js plugins install @openclaw/feishu@2026.9.8
sudo docker compose exec openclaw \
  node dist/index.js channels login --channel feishu

sudo docker compose exec openclaw \
  node dist/index.js channels status --probe
sudo docker compose logs -f --tail=100 openclaw

sudo docker compose exec openclaw node dist/index.js pairing list feishu
sudo docker compose exec openclaw \
  node dist/index.js pairing approve feishu YOUR_CODE

{
  "connectionMode": "websocket",
  "dmPolicy": "pairing",
  "groupPolicy": "allowlist",
  "groupAllowFrom": ["oc_替换为自己的群ID"],
  "requireMention": true,
  "groupSessionScope": "group_sender",
  "configWrites": false,
  "renderMode": "raw",
  "streaming": { "mode": "off" },
  "typingIndicator": false,
  "resolveSenderNames": false,
  "tools": {
    "doc": false,
    "chat": false,
    "wiki": false,
    "drive": false,
    "bitable": false,
    "perm": false
  }
}

sudo docker compose exec openclaw node dist/index.js config validate
sudo docker compose exec openclaw \
  node dist/index.js channels status --probe

sudo docker compose up -d --force-recreate openclaw
sudo docker compose exec openclaw \
  node dist/index.js channels add --channel telegram --use-env
sudo docker compose exec openclaw node dist/index.js pairing list telegram
sudo docker compose exec openclaw \
  node dist/index.js pairing approve telegram YOUR_CODE

cd ~/openclaw
backup_file="$HOME/openclaw-$(date +%Y%m%d-%H%M%S).tar.gz"
umask 077
sudo docker compose stop
if sudo tar -czf "$backup_file" compose.yaml .env state; then
  sudo chmod 600 "$backup_file"
else
  sudo docker compose start
  echo '备份失败，服务已重新启动；请检查磁盘与权限。' >&2
  exit 1
fi
sudo docker compose start
sudo tar -tzf "$backup_file" >/dev/null
printf '备份文件：%s\n' "$backup_file"

mkdir -p ~/openclaw-restored
cd ~/openclaw-restored
sudo tar -xzf /path/to/openclaw-backup.tar.gz
sudo docker compose pull
sudo docker compose up -d
sudo docker compose ps
curl -fsS http://127.0.0.1:18789/healthz