Native, VM, or Docker: choose the boundary first
Reviewed October 30, 2026. This is a deployment decision guide, not a claim that every option has been rehearsed on your device.
Our recommendation: learn with sample data in a restricted environment, then add access deliberately. “It worked on my personal computer” is not evidence that unrestricted installation is suitable for someone else.
Which option fits?
| Option | Useful when | What you give up or must control |
|---|---|---|
| Separate virtual machine | You want a disposable lab and a guest operating-system boundary | More setup and resources; guest updates, sharing, and account sign-in still matter |
| Docker deployment | You want repeatable Linux-based services and are comfortable managing containers | Mounts, network exposure, secrets, and engine access need configuration; native desktop apps do not appear automatically |
| Native installation | The workflow genuinely needs the host's apps or desktop session | The agent's tools can reach whatever that account and its permissions allow |
| Native gateway plus sandboxed tools | You need host integrations but want selected execution separated | Tool policy and sandbox coverage must be verified; the whole assistant is not inside that sandbox |
Docker is optional in OpenClaw, not a prerequisite or a guarantee of the easiest setup. The official guide also supports normal installation. Choose for the workflow, not for a security label. OpenClaw Docker guide.
A container is not a complete guest operating system
Linux containers share the kernel of their Linux runtime; Docker Desktop uses virtualization to provide its environment across platforms. Container portability does not make a Linux image a macOS or Windows desktop. A full VM has its own guest OS, with more overhead. Container concepts, Docker Desktop's VM explanation.
Isolation depends on what you expose. A container with broad writable home-folder mounts, a Docker control socket, privileged mode, or powerful credentials can still affect important systems. A VM with broadly shared folders or the same powerful accounts has similar access concerns. Rebuilding either environment does not undo an email sent through a real account. Docker security.
What about Messages and other native apps?
The documented iMessage integration uses Messages on macOS, not an iOS app running inside Docker. It requires a signed-in Mac and appropriate macOS permissions. A Linux container cannot directly run Messages.app; a remote Mac bridge is possible, but intentionally grants access outside the container. iMessage setup.
A VM does not automatically rule out iMessage: OpenClaw documents a macOS VM path on supported Apple hardware. Messages sign-in and permissions must work inside that guest. Do not promise this for a generic Linux/Windows VM or every hypervisor. macOS VM guide.
The same principle applies to native Outlook automation and desktop controls: match the integration to the OS and signed-in session it actually needs. Verify the complete read/draft/action path rather than assuming a bridge preserves every capability.
A useful middle ground
OpenClaw's tool sandbox is separate from containerizing the gateway. Sandboxing is off by default in the documented configuration. Selected tool execution can be isolated while the gateway remains on the host; some explicitly permitted tools can still run outside the ordinary sandbox. Installing Docker alone does not enable this protection. Sandboxing, what gets sandboxed.
Before relying on it, inspect the installed release's effective configuration, allowed folders, network access, tool permissions, and host-execution paths. Do not copy a configuration that sandboxes only some sessions while assuming your direct chat is protected.
For repository and runner placement, see GitHub and Gitea development workflows. Self-hosted storage does not by itself keep model inference offline.
The beginner path we recommend
- Choose a VM or a deliberately restricted container lab if feasible. If installing natively, prefer a separate non-admin account or dedicated machine; an account alone is not a VM boundary.
- Use sample files, a small workspace, and no personal messaging, browser profile, or institutional records for the first exercise.
- Verify one useful read-only task before adding tools or automation.
- Add each real account only after checking its permissions, data-handling policy, and recovery plan.
- Require review before sending, publishing, spending, or changing grades.
For every option, keep administrative access private, scope credentials and shared folders, maintain updates and backups, and inspect the supported openclaw security audit findings. Audit results are checks, not a certificate of safety. OpenClaw security guidance.
Native is sometimes the right engineering choice. Unrestricted native access should not be the teaching default.