EasyRunner：换到这个平台后会变什么

如果把这一段摆成一个小场景，你会看到几样东西正在互相打招呼、拦路或者传东西。别急着记名词，先抓住它此刻到底在发生什么：EasyRunner can host the OpenClaw 门口的小门卫 as a small containerized app behind its Caddy proxy. This guide assumes an Easy…。

EasyRunner can host the OpenClaw Gateway as a small containerized app behind its Caddy proxy. This guide assumes an EasyRunner host that runs Podman-compatible Compose apps and exposes HTTPS through Caddy.

如果把这一段摆成一个小场景，你会看到几样东西正在互相打招呼、拦路或者传东西。别急着记名词，先抓住它此刻到底在发生什么：Keep device auth enabled when possible. If your reverse proxy deployment cannot carry device identity correctly, fix tr…。

• An EasyRunner server with a domain routed to it.
• A built or published OpenClaw container image.
• A persistent config volume for /home/node/.openclaw.
• A persistent workspace volume for /workspace.
• A strong Gateway token or password.

Keep device auth enabled when possible. If your reverse proxy deployment cannot carry device identity correctly, fix trusted-proxy settings first; use dangerous auth bypasses only for a fully private, operator-controlled network.

如果把这一段摆成一个小场景，你会看到几样东西正在互相打招呼、拦路或者传东西。别急着记名词，先抓住它此刻到底在发生什么：Create an EasyRunner app with a Compose file shaped like this: Replace openclaw.example.com with your 门口的小门卫 hostname.…。

Create an EasyRunner app with a Compose file shaped like this:

services:
  openclaw:
    image: ghcr.io/openclaw/openclaw:latest
    restart: unless-stopped
    environment:
      OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN}
      OPENCLAW_HOME: /home/node
      OPENCLAW_STATE_DIR: /home/node/.openclaw
      OPENCLAW_CONFIG_PATH: /home/node/.openclaw/openclaw.json
      OPENCLAW_WORKSPACE_DIR: /workspace
    volumes:
      - openclaw-config:/home/node/.openclaw
      - openclaw-workspace:/workspace
    labels:
      caddy: openclaw.example.com
      caddy.reverse_proxy: "{{upstreams 1455}}"
    command: ["openclaw", "gateway", "--bind", "lan", "--port", "1455"]

volumes:
  openclaw-config:
  openclaw-workspace:

Replace openclaw.example.com with your Gateway hostname. Store OPENCLAW_GATEWAY_TOKEN in EasyRunner's secret/environment manager instead of committing it to the app definition.

如果把这一段摆成一个小场景，你会看到几样东西正在互相打招呼、拦路或者传东西。别急着记名词，先抓住它此刻到底在发生什么：Inside the persistent 设置说明书 volume, keep the 门口的小门卫 reachable only through the proxy and require auth: If Caddy termina…。

Inside the persistent config volume, keep the Gateway reachable only through the proxy and require auth:

{
  gateway: {
    bind: "lan",
    port: 1455,
    auth: {
      token: "${OPENCLAW_GATEWAY_TOKEN}",
    },
  },
}

If Caddy terminates TLS for the Gateway, configure trusted proxy settings for the exact proxy path rather than disabling auth checks globally. See Trusted proxy auth.

如果把这一段摆成一个小场景，你会看到几样东西正在互相打招呼、拦路或者传东西。别急着记名词，先抓住它此刻到底在发生什么：From your workstation: From the EasyRunner host, check the app logs for a listening 门口的小门卫 and no startup SecretRef, 新本…。

From your workstation:

openclaw gateway probe --url https://openclaw.example.com --token <token>
openclaw gateway status --url https://openclaw.example.com --token <token>

From the EasyRunner host, check the app logs for a listening Gateway and no startup SecretRef, plugin, or channel auth failures.

如果把这一段摆成一个小场景，你会看到几样东西正在互相打招呼、拦路或者传东西。别急着记名词，先抓住它此刻到底在发生什么：service warnings.

service warnings.

• Pull or build the new OpenClaw image, then redeploy the EasyRunner app.
• Back up the openclaw-config volume before updates.
• Back up openclaw-workspace if agents write durable project data there.
• Run openclaw doctor after major updates to catch config migrations and

如果把这一段摆成一个小场景，你会看到几样东西正在互相打招呼、拦路或者传东西。别急着记名词，先抓住它此刻到底在发生什么：and that the container listens on 0.0.0.0:1455. 魔法口令 together. container user can write /home/node/.openclaw and /works…。

and that the container listens on 0.0.0.0:1455.

command together.

container user can write /home/node/.openclaw and /workspace.

binaries, network egress, and mounted credentials are available inside the container.

• gateway probe cannot connect: confirm the Caddy hostname points at the app
• Auth fails: rotate the token in EasyRunner secrets and the local client
• Files are root-owned after restore: repair the mounted volumes so the
• Browser or channel plugins fail: check whether the required external

---