openclaw-deployment-hardening

OpenClaw Deployment Hardening

Use this skill to add repeatable security gates around OpenClaw build and deployment workflows.

Enforce a Secure Build Pipeline

Add mandatory controls to CI before artifacts are promoted:

1. Dependency and lockfile vulnerability scan (fail on critical CVEs).
2. Image scan for OS/package vulnerabilities.
3. Secret scanning across source and build context.
4. SBOM generation and artifact signing.
5. Policy check that blocks deploy when controls fail.

Example CI step order:

# Build
npm ci
npm run build

# Security gates
trivy fs .
trivy image my-registry/openclaw:${GIT_SHA}
syft my-registry/openclaw:${GIT_SHA} -o spdx-json > sbom.json
cosign sign --key cosign.key my-registry/openclaw:${GIT_SHA}

Lock Down Container Runtime

Run OpenClaw with restrictive defaults:

• Non-root user in container
• Read-only root filesystem where possible
• Drop all Linux capabilities, add back only required
• no-new-privileges enabled
• Constrained CPU/memory limits to reduce abuse impact
• Seccomp/AppArmor (or equivalent) profile enforced

Kubernetes-oriented expectations:

• runAsNonRoot: true
• allowPrivilegeEscalation: false
• readOnlyRootFilesystem: true
• network policy deny-all baseline with explicit allow rules

Gate Production Promotion

Require explicit promotion checks:

• Security sign-off on CVE exceptions.
• Signed artifact verification in deployment stage.
• Drift check between expected and live manifest values.
• Deployment only from immutable tags or digests.

Avoid mutable latest tags for production OpenClaw services.

Protect Data and Session Surfaces

• Minimize prompt/response retention by policy.
• Mask secrets and PII in logs before shipping to SIEM.
• Encrypt persistent volumes and backups.
• Isolate tenant/session data boundaries when serving multiple teams.

Post-Deploy Verification

Run a hardening smoke test immediately after rollout:

kubectl get pods -n openclaw
kubectl auth can-i --as=system:serviceaccount:openclaw:default list secrets -n openclaw
kubectl get networkpolicy -n openclaw
kubectl logs deploy/openclaw -n openclaw --tail=200