Run a persistent CoderClaw Gateway on Oracle Cloud’s Always Free ARM tier.
Oracle’s free tier can be a great fit for CoderClaw (especially if you already have an OCI account), but it comes with tradeoffs:
| Provider | Plan | Specs | Price/mo | Notes |
|---|---|---|---|---|
| Oracle Cloud | Always Free ARM | up to 4 OCPU, 24GB RAM | $0 | ARM, limited capacity |
| Hetzner | CX22 | 2 vCPU, 4GB RAM | ~ $4 | Cheapest paid option |
| DigitalOcean | Basic | 1 vCPU, 1GB RAM | $6 | Easy UI, good docs |
| Vultr | Cloud Compute | 1 vCPU, 1GB RAM | $6 | Many locations |
| Linode | Nanode | 1 vCPU, 1GB RAM | $5 | Now part of Akamai |
coderclawVM.Standard.A1.Flex (Ampere ARM)Tip: If instance creation fails with “Out of capacity”, try a different availability domain or retry later. Free tier capacity is limited.
# Connect via public IP
ssh ubuntu@YOUR_PUBLIC_IP
# Update system
sudo apt update && sudo apt upgrade -y
sudo apt install -y build-essential
Note: build-essential is required for ARM compilation of some dependencies.
# Set hostname
sudo hostnamectl set-hostname coderclaw
# Set password for ubuntu user
sudo passwd ubuntu
# Enable lingering (keeps user services running after logout)
sudo loginctl enable-linger ubuntu
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --ssh --hostname=coderclaw
This enables Tailscale SSH, so you can connect via ssh coderclaw from any device on your tailnet — no public IP needed.
Verify:
tailscale status
From now on, connect via Tailscale: ssh ubuntu@coderclaw (or use the Tailscale IP).
curl -fsSL https://coderclaw.ai/install.sh | bash
source ~/.bashrc
When prompted “How do you want to hatch your bot?”, select “Do this later”.
Note: If you hit ARM-native build issues, start with system packages (e.g.
sudo apt install -y build-essential) before reaching for Homebrew.
Use token auth as the default. It’s predictable and avoids needing any “insecure auth” Control UI flags.
# Keep the Gateway private on the VM
coderclaw config set gateway.bind loopback
# Require auth for the Gateway + Control UI
coderclaw config set gateway.auth.mode token
coderclaw doctor --generate-gateway-token
# Expose over Tailscale Serve (HTTPS + tailnet access)
coderclaw config set gateway.tailscale.mode serve
coderclaw config set gateway.trustedProxies '["127.0.0.1"]'
systemctl --user restart coderclaw-gateway
# Check version
coderclaw --version
# Check daemon status
systemctl --user status coderclaw-gateway
# Check Tailscale Serve
tailscale serve status
# Test local response
curl http://localhost:18789
Now that everything is working, lock down the VCN to block all traffic except Tailscale. OCI’s Virtual Cloud Network acts as a firewall at the network edge — traffic is blocked before it reaches your instance.
0.0.0.0/0 UDP 41641 (Tailscale)This blocks SSH on port 22, HTTP, HTTPS, and everything else at the network edge. From now on, you can only connect via Tailscale.
From any device on your Tailscale network:
https://coderclaw.<tailnet-name>.ts.net/
Replace <tailnet-name> with your tailnet name (visible in tailscale status).
No SSH tunnel needed. Tailscale provides:
With the VCN locked down (only UDP 41641 open) and the Gateway bound to loopback, you get strong defense-in-depth: public traffic is blocked at the network edge, and admin access happens over your tailnet.
This setup often removes the need for extra host-based firewall rules purely to stop Internet-wide SSH brute force — but you should still keep the OS updated, run coderclaw security audit, and verify you aren’t accidentally listening on public interfaces.
| Traditional Step | Needed? | Why |
|---|---|---|
| UFW firewall | No | VCN blocks before traffic reaches instance |
| fail2ban | No | No brute force if port 22 blocked at VCN |
| sshd hardening | No | Tailscale SSH doesn’t use sshd |
| Disable root login | No | Tailscale uses Tailscale identity, not system users |
| SSH key-only auth | No | Tailscale authenticates via your tailnet |
| IPv6 hardening | Usually not | Depends on your VCN/subnet settings; verify what’s actually assigned/exposed |
chmod 700 ~/.coderclawcoderclaw security auditsudo apt update && sudo apt upgrade regularly# Confirm no public ports listening
sudo ss -tlnp | grep -v '127.0.0.1\|::1'
# Verify Tailscale SSH is active
tailscale status | grep -q 'offers: ssh' && echo "Tailscale SSH active"
# Optional: disable sshd entirely
sudo systemctl disable --now ssh
If Tailscale Serve isn’t working, use an SSH tunnel:
# From your local machine (via Tailscale)
ssh -L 18789:127.0.0.1:18789 ubuntu@coderclaw
Then open http://localhost:18789.
Free tier ARM instances are popular. Try:
# Check status
sudo tailscale status
# Re-authenticate
sudo tailscale up --ssh --hostname=coderclaw --reset
coderclaw gateway status
coderclaw doctor --non-interactive
journalctl --user -u coderclaw-gateway -n 50
# Verify Tailscale Serve is running
tailscale serve status
# Check gateway is listening
curl http://localhost:18789
# Restart if needed
systemctl --user restart coderclaw-gateway
Some tools may not have ARM builds. Check:
uname -m # Should show aarch64
Most npm packages work fine. For binaries, look for linux-arm64 or aarch64 releases.
All state lives in:
~/.coderclaw/ — config, credentials, session data~/.coderclaw/workspace/ — workspace (SOUL.md, memory, artifacts)Back up periodically:
tar -czvf coderclaw-backup.tar.gz ~/.coderclaw ~/.coderclaw/workspace