Quiz: Deployment Patterns — OpenClaw Academy

1 What is the minimum Node.js version required to run OpenClaw?

Node.js 16 Node.js 18 Node.js 20 Node.js 22

2 You deploy OpenClaw on a Linux VPS with a user-level systemd service. You reboot the server and the Gateway doesn't start. What's the most likely cause?

The openclaw package needs to be reinstalled after every reboot You forgot to run 'loginctl enable-linger $USER' — user services only start after login without it systemd user services can never auto-start on boot — you must use a system service The Gateway port 18789 is blocked by the firewall

3 Why does the OpenClaw Docker image bind port 18789 to 127.0.0.1 by default, not 0.0.0.0?

127.0.0.1 is faster than 0.0.0.0 due to kernel routing optimisation Binding to loopback is the secure default — the Control UI shouldn't be exposed to the network without a reverse proxy or VPN The Gateway doesn't support LAN connections at all 0.0.0.0 requires Docker Desktop Pro — the free version only supports loopback

4 You're setting up Telegram webhooks on your VPS and the webhook registration fails. What does Telegram require that long polling doesn't?

A static IP address A valid HTTPS certificate (self-signed certs are rejected) The server must be in a data centre, not a residential connection A dedicated IP address not shared with other services

5 What is the critical difference between Docker volume mounts and named volumes when deploying OpenClaw?

Named volumes are faster; bind mounts cause Gateway startup delays Bind mounts map to host directories (portable, easy to backup); named volumes are Docker-managed (survive container recreation but harder to access directly) Only named volumes persist across container restarts — bind mounts are always deleted when the container stops Bind mounts require root permission; named volumes run as the node user

6 You configure your nginx reverse proxy but the OpenClaw Control UI connects and then immediately disconnects. What's the most likely missing nginx config?

The ssl_certificate path is wrong The proxy_read_timeout is too short The Upgrade and Connection headers for WebSocket upgrade are missing The proxy_pass URL should use HTTPS not HTTP for the backend

7 What does Tailscale's 'enable-linger' equivalent solve when used with OpenClaw on a VPS?

Nothing — Tailscale and systemd linger are completely unrelated features Tailscale replaces the need for a reverse proxy by providing automatic TLS Tailscale allows accessing the Gateway via its Tailscale IP without exposing port 18789 to the public internet, while 'loginctl enable-linger' ensures the Gateway starts at boot without login Tailscale provides the linger functionality natively, so 'loginctl enable-linger' is not needed when using Tailscale

📝 Module 9 Quiz: Deployment Patterns